AWS codepipeline medium security documentation change
Summary
Added required 'codestar-connections:UseConnection' IAM permission and explanatory note about dual permissions.
Security assessment
Corrects IAM permission requirements for secure pipeline operations. Missing permissions could cause access failures or insecure workarounds. The note clarifies security configuration for connection resources.
Diff
diff --git a/codepipeline/latest/userguide/action-reference-CodestarConnectionSource.md b/codepipeline/latest/userguide/action-reference-CodestarConnectionSource.md index e69ca568d..6fc31c54a 100644 --- a//codepipeline/latest/userguide/action-reference-CodestarConnectionSource.md +++ b//codepipeline/latest/userguide/action-reference-CodestarConnectionSource.md @@ -254 +254,2 @@ For CodeConnections, the following permission is required to create pipelines wi - "codeconnections:UseConnection" + "codeconnections:UseConnection", + "codestar-connections:UseConnection" @@ -258,0 +260,4 @@ For CodeConnections, the following permission is required to create pipelines wi +###### Note + +Both actions are required. Operations invoked through call `codestar-connections:UseConnection`, while operations invoked outside of call `codeconnections:UseConnection`. Granting both actions ensures the role works for both code paths, regardless of whether the connection's resource ARN uses the `codeconnections` or `codestar-connections` service prefix. +