AWS dtconsole documentation change
Summary
Expanded the list of supported actions for the 'codeconnections:ProviderAction' condition key and added detailed IAM permission requirements for new repository management operations.
Security assessment
This change documents new IAM permissions for granular repository operations (e.g., CreateBranch, DeleteRepository) but shows no evidence of addressing a specific vulnerability. It enhances security documentation by clarifying least-privilege permissions.
Diff
diff --git a/dtconsole/latest/userguide/security-iam.md b/dtconsole/latest/userguide/security-iam.md index e325f656d..6fcb87b08 100644 --- a//dtconsole/latest/userguide/security-iam.md +++ b//dtconsole/latest/userguide/security-iam.md @@ -356 +356 @@ Supported values for condition keys Key | Valid action providers -`codeconnections:ProviderAction` | `GetBranch`, `ListRepositories`, `ListOwners`, `ListBranches`, `StartUploadArchiveToS3`, `GitPush`, `GitPull`, `GetUploadArchiveToS3Status`, `CreatePullRequestDiffComment`, `GetPullRequest`, `ListBranchCommits`, `ListCommitFiles`, `ListPullRequestComments`, `ListPullRequestCommits`. For information, see the next section. +`codeconnections:ProviderAction` | `CreateBranch`, `CreateCommit`, `CreateCommitStatus`, `CreatePullRequest`, `CreatePullRequestComment`, `CreatePullRequestDiffComment`, `CreateRepository`, `DeleteRepository`, `GenerateReferenceLink`, `GetBranch`, `GetCommit`, `GetCommitDiffs`, `GetFile`, `GetFolder`, `GetPullRequest`, `GetRepository`, `GetUploadArchiveToS3Status`, `GitPull`, `GitPush`, `IsRepositoryEmpty`, `ListBranchCommits`, `ListBranches`, `ListCommitFiles`, `ListCommitStatuses`, `ListCommitsDiffs`, `ListIssues`, `ListOwners`, `ListPullRequestComments`, `ListPullRequestCommits`, `ListPullRequestDiffs`, `ListPullRequests`, `ListRepositories`, `StartUploadArchiveToS3`, `UpdatePullRequest`. For information, see the next section. @@ -371,0 +372,9 @@ AWS CodeConnections supported access types for `ProviderAction` AWS CodeConnecti +`CreateBranch` | ` codeconnections:CreateBranch` Required to create a branch in a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`CreateCommit` | ` codeconnections:CreateCommit` Required to create a commit for a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`CreateCommitStatus` | ` codeconnections:CreateCommitStatus` Required to create a commit status for a commit. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`CreatePullRequest` | ` codeconnections:CreatePullRequest` Required to create a pull request in a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`CreatePullRequestComment` | ` codeconnections:CreatePullRequestComment` Required to create a comment on a pull request. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`CreatePullRequestDiffComment` | ` codeconnections:CreatePullRequestDiffComment` Required to create an inline comment on a pull request diff. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`CreateRepository` | ` codeconnections:CreateRepository` Required to create a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`DeleteRepository` | ` codeconnections:DeleteRepository` Required to delete a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`GenerateReferenceLink` | ` codeconnections:GenerateReferenceLink` Required to generate a reference link. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` @@ -373,6 +382,6 @@ AWS CodeConnections supported access types for `ProviderAction` AWS CodeConnecti -`ListRepositories` | ` codeconnections:ListRepositories` Required to access a list of public and private repositories, including details about those repositories, that belong to an owner. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` -`ListOwners` | `codeconnections:ListOwners` Required to access a list of owners that the connection has access to. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` -`ListBranches` | ` codeconnections:ListBranches` Required to access the list of branches that exist on a given repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` -`StartUploadArchiveToS3` | ` codeconnections:StartUploadArchiveToS3` Required to read source code and upload it to Amazon S3. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` -`GitPush` | ` codeconnections:GitPush` Required to write to a repository using Git. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` -`GitPull` | ` codeconnections:GitPull` Required to read from a repository using Git. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`GetCommit` | ` codeconnections:GetCommit` Required to view details about a commit. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`GetCommitDiffs` | ` codeconnections:GetCommitDiffs` Required to view diffs for a commit. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`GetFile` | ` codeconnections:GetFile` Required to view the contents of a file in a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`GetFolder` | ` codeconnections:GetFolder` Required to view the contents of a folder in a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`GetPullRequest` | ` codeconnections:GetPullRequest` Required to view details about a pull request. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`GetRepository` | ` codeconnections:GetRepository` Required to view details about a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` @@ -380,2 +389,3 @@ AWS CodeConnections supported access types for `ProviderAction` AWS CodeConnecti -`CreatePullRequestDiffComment` | ` codeconnections:CreatePullRequestDiffComment` Required to access comments on a pull request. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` -`GetPullRequest` | ` codeconnections:GetPullRequest` Required to view pull requests for a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`GitPull` | ` codeconnections:GitPull` Required to read from a repository using Git. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`GitPush` | ` codeconnections:GitPush` Required to write to a repository using Git. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`IsRepositoryEmpty` | ` codeconnections:IsRepositoryEmpty` Required to check whether a repository is empty. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` @@ -382,0 +393 @@ AWS CodeConnections supported access types for `ProviderAction` AWS CodeConnecti +`ListBranches` | ` codeconnections:ListBranches` Required to access the list of branches that exist on a given repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` @@ -383,0 +395,4 @@ AWS CodeConnections supported access types for `ProviderAction` AWS CodeConnecti +`ListCommitStatuses` | ` codeconnections:ListCommitStatuses` Required to view a list of commit statuses for a commit. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`ListCommitsDiffs` | ` codeconnections:ListCommitsDiffs` Required to view a list of diffs for commits. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`ListIssues` | ` codeconnections:ListIssues` Required to view a list of issues for a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`ListOwners` | ` codeconnections:ListOwners` Required to access a list of owners that the connection has access to. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` @@ -385,0 +401,5 @@ AWS CodeConnections supported access types for `ProviderAction` AWS CodeConnecti +`ListPullRequestDiffs` | ` codeconnections:ListPullRequestDiffs` Required to view a list of diffs for a pull request. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`ListPullRequests` | ` codeconnections:ListPullRequests` Required to view a list of pull requests for a repository. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`ListRepositories` | ` codeconnections:ListRepositories` Required to access a list of public and private repositories, including details about those repositories, that belong to an owner. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`StartUploadArchiveToS3` | ` codeconnections:StartUploadArchiveToS3` Required to read source code and upload it to Amazon S3. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id` +`UpdatePullRequest` | ` codeconnections:UpdatePullRequest` Required to update a pull request. | arn:aws:codeconnections:`region`:`account-id`:connection/`connection-id`