Amazon CodePipeline identity-based policy examples
By default, IAM users and roles don't have permission to create or modify CodePipeline resources. They also can't perform tasks using the Amazon Web Services Management Console, Amazon CLI, or Amazon API. An IAM administrator must create IAM policies that grant users and roles permission to perform specific API operations on the specified resources they need. The administrator must then attach those policies to the IAM users or groups that require those permissions.
To learn how to create an IAM identity-based policy using these example JSON policy documents, see Creating Policies on the JSON Tab in the IAM User Guide.
To learn how to create a pipeline that uses resources from another account, and for the related example policies, see Create a pipeline in CodePipeline that uses resources from another Amazon account.
Customer managed policy examples
In this section, you can find example user policies that grant permissions for various CodePipeline actions. These policies work when you are using the CodePipeline API, Amazon SDKs, or the Amazon CLI. When you are using the console, you must grant additional permissions specific to the console. For more information, see Permissions required to use the CodePipeline console.
Note
All examples use the US West (Oregon) Region (us-west-2
) and contain
fictitious account IDs.
Examples
-
Example 2: Grant permissions to enable and disable transitions between stages
-
Example 3: Grant permissions to get a list of all available action types
-
Example 4: Grant permissions to approve or reject manual approval actions
-
Example 5: Grant permissions to poll for jobs for a custom action
-
Example 6: Attach or edit a policy for Jenkins integration with Amazon CodePipeline
Example 1: Grant permissions to get the state of a pipeline
The following example grants permissions to get the state of the pipeline
named MyFirstPipeline
:
Example 2: Grant permissions to enable and disable transitions between stages
The following example grants permissions to disable and enable transitions
between all stages in the pipeline named
MyFirstPipeline
:
To allow the user to disable and enable transitions for a single stage in a
pipeline, you must specify the stage. For example, to allow the user to enable
and disable transitions for a stage named Staging
in a pipeline
named MyFirstPipeline
:
"Resource": "arn:aws:codepipeline:us-west-2:111222333444:MyFirstPipeline/Staging"
Example 3: Grant permissions to get a list of all available action types
The following example grants permissions to get a list of all available action
types available for pipelines in the us-west-2
Region:
Example 4: Grant permissions to approve or reject manual approval actions
The following example grants permissions to approve or reject manual approval
actions in a stage named Staging
in a pipeline named
MyFirstPipeline
:
Example 5: Grant permissions to poll for jobs for a custom action
The following example grants permissions to poll for jobs for the custom
action named TestProvider
, which is a Test
action type
in its first version, across all pipelines:
Note
The job worker for a custom action might be configured under a different Amazon account or require a specific IAM role in order to function.
Example 6: Attach or edit a policy for Jenkins integration with Amazon CodePipeline
If you configure a pipeline to use Jenkins for build or test, create a
separate identity for that integration and attach an IAM policy that has the
minimum permissions required for integration between Jenkins and CodePipeline.
This policy is the same as the AWSCodePipelineCustomActionAccess
managed policy. The following
example shows a policy for Jenkins integration:
Example 7: Configure cross-account access to a pipeline
You can configure access to pipelines for users and groups in another Amazon account. The recommended way is to create a role in the account where the pipeline was created. The role should allow users from the other Amazon account to assume that role and access the pipeline. For more information, see Walkthrough: Cross-Account Access Using Roles.
The following example shows a policy in the 80398EXAMPLE account that
allows users to view, but not change, the pipeline named
MyFirstPipeline
in the CodePipeline console. This
policy is based on the AWSCodePipeline_ReadOnlyAccess
managed policy, but because it is
specific to the MyFirstPipeline
pipeline, it cannot use the
managed policy directly. If you do not want to restrict the policy to a specific
pipeline, consider using one of the managed policies created and maintained by
CodePipeline. For more information, see Working with Managed
Policies. You must attach this policy to an IAM role you create
for access, for example, a role named
CrossAccountPipelineViewers
:
After you create this policy, create the IAM role in the 80398EXAMPLE account and attach the policy to that role. In the role's trust relationships, you must add the Amazon account that assumes this role.
The following example shows a policy created in the
111111111111
Amazon account that allows users to
assume the role named CrossAccountPipelineViewers
in the
80398EXAMPLE account: