Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon CodeCommit

Amazon CodeCommit (service prefix: codecommit) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon CodeCommit
Actions defined by Amazon CodeCommit
Permission-only actions for Amazon CodeCommit
Resource types defined by Amazon CodeCommit
Condition keys for Amazon CodeCommit

API operations defined by Amazon CodeCommit

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateApprovalRuleTemplateWithRepository	codecommit:AssociateApprovalRuleTemplateWithRepository	Write
BatchAssociateApprovalRuleTemplateWithRepositories	codecommit:BatchAssociateApprovalRuleTemplateWithRepositories	Write
BatchDescribeMergeConflicts	codecommit:BatchDescribeMergeConflicts	Read
BatchDisassociateApprovalRuleTemplateFromRepositories	codecommit:BatchDisassociateApprovalRuleTemplateFromRepositories	Write
BatchGetCommits	codecommit:BatchGetCommits	Read
BatchGetRepositories	codecommit:BatchGetRepositories	Read
CreateApprovalRuleTemplate	codecommit:CreateApprovalRuleTemplate	Write
CreateBranch	codecommit:CreateBranch	Write
CreateCommit	codecommit:CreateCommit	Write
CreatePullRequest	codecommit:CreatePullRequest	Write
CreatePullRequestApprovalRule	codecommit:CreatePullRequestApprovalRule	Write
CreateRepository	codecommit:CreateRepository	Write
CreateRepository	codecommit:TagResource	Tagging, Write
CreateUnreferencedMergeCommit	codecommit:CreateUnreferencedMergeCommit	Write
DeleteApprovalRuleTemplate	codecommit:DeleteApprovalRuleTemplate	Write
DeleteBranch	codecommit:DeleteBranch	Write
DeleteCommentContent	codecommit:DeleteCommentContent	Write
DeleteFile	codecommit:DeleteFile	Write
DeletePullRequestApprovalRule	codecommit:DeletePullRequestApprovalRule	Write
DeleteRepository	codecommit:DeleteRepository	Write
DescribeMergeConflicts	codecommit:DescribeMergeConflicts	Read
DescribePullRequestEvents	codecommit:DescribePullRequestEvents	Read
DisassociateApprovalRuleTemplateFromRepository	codecommit:DisassociateApprovalRuleTemplateFromRepository	Write
EvaluatePullRequestApprovalRules	codecommit:EvaluatePullRequestApprovalRules	Read
GetApprovalRuleTemplate	codecommit:GetApprovalRuleTemplate	Read
GetBlob	codecommit:GetBlob	Read
GetBranch	codecommit:GetBranch	Read
GetComment	codecommit:GetComment	Read
GetCommentReactions	codecommit:GetCommentReactions	Read
GetCommentsForComparedCommit	codecommit:GetCommentsForComparedCommit	Read
GetCommentsForPullRequest	codecommit:GetCommentsForPullRequest	Read
GetCommit	codecommit:GetCommit	Read
GetDifferences	codecommit:GetDifferences	Read
GetFile	codecommit:GetFile	Read
GetFolder	codecommit:GetFolder	Read
GetMergeCommit	codecommit:GetMergeCommit	Read
GetMergeConflicts	codecommit:GetMergeConflicts	Read
GetMergeOptions	codecommit:GetMergeOptions	Read
GetPullRequest	codecommit:GetPullRequest	Read
GetPullRequestApprovalStates	codecommit:GetPullRequestApprovalStates	Read
GetPullRequestOverrideState	codecommit:GetPullRequestOverrideState	Read
GetRepository	codecommit:GetRepository	Read
GetRepositoryTriggers	codecommit:GetRepositoryTriggers	Read
ListApprovalRuleTemplates	codecommit:ListApprovalRuleTemplates	List
ListAssociatedApprovalRuleTemplatesForRepository	codecommit:ListAssociatedApprovalRuleTemplatesForRepository	List
ListBranches	codecommit:ListBranches	List
ListFileCommitHistory	codecommit:ListFileCommitHistory	List
ListPullRequests	codecommit:ListPullRequests	List
ListRepositories	codecommit:ListRepositories	List
ListRepositoriesForApprovalRuleTemplate	codecommit:ListRepositoriesForApprovalRuleTemplate	List
ListTagsForResource	codecommit:ListTagsForResource	List
MergeBranchesByFastForward	codecommit:MergeBranchesByFastForward	Write
MergeBranchesBySquash	codecommit:MergeBranchesBySquash	Write
MergeBranchesByThreeWay	codecommit:MergeBranchesByThreeWay	Write
MergePullRequestByFastForward	codecommit:MergePullRequestByFastForward	Write
MergePullRequestBySquash	codecommit:MergePullRequestBySquash	Write
MergePullRequestByThreeWay	codecommit:MergePullRequestByThreeWay	Write
OverridePullRequestApprovalRules	codecommit:OverridePullRequestApprovalRules	Write
PostCommentForComparedCommit	codecommit:PostCommentForComparedCommit	Write
PostCommentForPullRequest	codecommit:PostCommentForPullRequest	Write
PostCommentReply	codecommit:PostCommentReply	Write
PutCommentReaction	codecommit:PutCommentReaction	Write
PutFile	codecommit:PutFile	Write
PutRepositoryTriggers	codecommit:PutRepositoryTriggers	Write
TagResource	codecommit:TagResource	Tagging, Write
TestRepositoryTriggers	codecommit:TestRepositoryTriggers	Write
UntagResource	codecommit:UntagResource	Tagging, Write
UpdateApprovalRuleTemplateContent	codecommit:UpdateApprovalRuleTemplateContent	Write
UpdateApprovalRuleTemplateDescription	codecommit:UpdateApprovalRuleTemplateDescription	Write
UpdateApprovalRuleTemplateName	codecommit:UpdateApprovalRuleTemplateName	Write
UpdateComment	codecommit:UpdateComment	Write
UpdateDefaultBranch	codecommit:UpdateDefaultBranch	Write
UpdatePullRequestApprovalRuleContent	codecommit:UpdatePullRequestApprovalRuleContent	Write
UpdatePullRequestApprovalState	codecommit:UpdatePullRequestApprovalState	Write
UpdatePullRequestDescription	codecommit:UpdatePullRequestDescription	Write
UpdatePullRequestStatus	codecommit:UpdatePullRequestStatus	Write
UpdatePullRequestTitle	codecommit:UpdatePullRequestTitle	Write
UpdateRepositoryDescription	codecommit:UpdateRepositoryDescription	Write
UpdateRepositoryEncryptionKey	codecommit:UpdateRepositoryEncryptionKey	Write
UpdateRepositoryName	codecommit:TagResource	Tagging, Write
UpdateRepositoryName	codecommit:UpdateRepositoryName	Write

Actions defined by Amazon CodeCommit

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateApprovalRuleTemplateWithRepository	Grants permission to associate an approval rule template with a repository	repository*	aws:ResourceTag/${TagKey}	Write
BatchAssociateApprovalRuleTemplateWithRepositories	Grants permission to associate an approval rule template with multiple repositories in a single operation	repository*	aws:ResourceTag/${TagKey}	Write
BatchDescribeMergeConflicts	Grants permission to get information about multiple merge conflicts when attempting to merge two commits using either the three-way merge or the squash merge option	repository*	aws:ResourceTag/${TagKey}	Read
BatchDisassociateApprovalRuleTemplateFromRepositories	Grants permission to remove the association between an approval rule template and multiple repositories in a single operation	repository*	aws:ResourceTag/${TagKey}	Write
BatchGetCommits	Grants permission to return information about one or more commits in an Amazon CodeCommit repository	repository*	aws:ResourceTag/${TagKey}	Read
BatchGetRepositories	Grants permission to get information about multiple repositories	repository*	aws:ResourceTag/${TagKey}	Read
CreateApprovalRuleTemplate	Grants permission to create an approval rule template that will automatically create approval rules in pull requests that match the conditions defined in the template; does not grant permission to create approval rules for individual pull requests			Write
CreateBranch	Grants permission to create a branch in an Amazon CodeCommit repository with this API; does not control Git create branch actions	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
CreateCommit	Grants permission to add, copy, move or update single or multiple files in a branch in an Amazon CodeCommit repository, and generate a commit for the changes in the specified branch	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
CreatePullRequest	Grants permission to create a pull request in the specified repository	repository*	aws:ResourceTag/${TagKey}	Write
CreatePullRequestApprovalRule	Grants permission to create an approval rule specific to an individual pull request; does not grant permission to create approval rule templates	repository*	aws:ResourceTag/${TagKey}	Write
CreateRepository	Grants permission to create an Amazon CodeCommit repository	repository*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateUnreferencedMergeCommit	Grants permission to create an unreferenced commit that contains the result of merging two commits using either the three-way or the squash merge option; does not control Git merge actions	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
DeleteApprovalRuleTemplate	Grants permission to delete an approval rule template			Write
DeleteBranch	Grants permission to delete a branch in an Amazon CodeCommit repository with this API; does not control Git delete branch actions	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
DeleteCommentContent	Grants permission to delete the content of a comment made on a change, file, or commit in a repository	repository*	aws:ResourceTag/${TagKey}	Write
DeleteFile	Grants permission to delete a specified file from a specified branch	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
DeletePullRequestApprovalRule	Grants permission to delete approval rule created for a pull request if the rule was not created by an approval rule template	repository*	aws:ResourceTag/${TagKey}	Write
DeleteRepository	Grants permission to delete an Amazon CodeCommit repository	repository*	aws:ResourceTag/${TagKey}	Write
DescribeMergeConflicts	Grants permission to get information about specific merge conflicts when attempting to merge two commits using either the three-way or the squash merge option	repository*	aws:ResourceTag/${TagKey}	Read
DescribePullRequestEvents	Grants permission to return information about one or more pull request events	repository*	aws:ResourceTag/${TagKey}	Read
DisassociateApprovalRuleTemplateFromRepository	Grants permission to remove the association between an approval rule template and a repository	repository*	aws:ResourceTag/${TagKey}	Write
EvaluatePullRequestApprovalRules	Grants permission to evaluate whether a pull request is mergable based on its current approval state and approval rule requirements	repository*	aws:ResourceTag/${TagKey}	Read
GetApprovalRuleTemplate	Grants permission to return information about an approval rule template			Read
GetBlob	Grants permission to view the encoded content of an individual file in an Amazon CodeCommit repository from the Amazon CodeCommit console	repository*	aws:ResourceTag/${TagKey}	Read
GetBranch	Grants permission to get details about a branch in an Amazon CodeCommit repository with this API; does not control Git branch actions	repository*	aws:ResourceTag/${TagKey}	Read
GetComment	Grants permission to get the content of a comment made on a change, file, or commit in a repository	repository*	aws:ResourceTag/${TagKey}	Read
GetCommentReactions	Grants permission to get the reactions on a comment	repository*	aws:ResourceTag/${TagKey}	Read
GetCommentsForComparedCommit	Grants permission to get information about comments made on the comparison between two commits	repository*	aws:ResourceTag/${TagKey}	Read
GetCommentsForPullRequest	Grants permission to get comments made on a pull request	repository*	aws:ResourceTag/${TagKey}	Read
GetCommit	Grants permission to return information about a commit, including commit message and committer information, with this API; does not control Git log actions	repository*	aws:ResourceTag/${TagKey}	Read
GetDifferences	Grants permission to view information about the differences between valid commit specifiers such as a branch, tag, HEAD, commit ID, or other fully qualified reference	repository*	aws:ResourceTag/${TagKey}	Read
GetFile	Grants permission to return the base-64 encoded contents of a specified file and its metadata	repository*	aws:ResourceTag/${TagKey}	Read
GetFolder	Grants permission to return the contents of a specified folder in a repository	repository*	aws:ResourceTag/${TagKey}	Read
GetMergeCommit	Grants permission to get information about a merge commit created by one of the merge options for pull requests that creates merge commits. Not all merge options create merge commits. This permission does not control Git merge actions	repository*	aws:ResourceTag/${TagKey} codecommit:References	Read
GetMergeConflicts	Grants permission to get information about merge conflicts between the before and after commit IDs for a pull request in a repository	repository*	aws:ResourceTag/${TagKey}	Read
GetMergeOptions	Grants permission to get information about merge options for pull requests that can be used to merge two commits; does not control Git merge actions	repository*	aws:ResourceTag/${TagKey}	Read
GetPullRequest	Grants permission to get information about a pull request in a specified repository	repository*	aws:ResourceTag/${TagKey}	Read
GetPullRequestApprovalStates	Grants permission to retrieve the current approvals on an inputted pull request	repository*	aws:ResourceTag/${TagKey}	Read
GetPullRequestOverrideState	Grants permission to retrieve the current override state of a given pull request	repository*	aws:ResourceTag/${TagKey}	Read
GetRepository	Grants permission to get information about an Amazon CodeCommit repository	repository*	aws:ResourceTag/${TagKey}	Read
GetRepositoryTriggers	Grants permission to get information about triggers configured for a repository	repository*	aws:ResourceTag/${TagKey}	Read
ListApprovalRuleTemplates	Grants permission to list all approval rule templates in an Amazon Web Services Region for the Amazon Web Services account			List
ListAssociatedApprovalRuleTemplatesForRepository	Grants permission to list approval rule templates that are associated with a repository	repository*	aws:ResourceTag/${TagKey}	List
ListBranches	Grants permission to list branches for an Amazon CodeCommit repository with this API; does not control Git branch actions	repository*	aws:ResourceTag/${TagKey}	List
ListFileCommitHistory	Grants permission to list commits and changes to a specified file	repository*	aws:ResourceTag/${TagKey}	List
ListPullRequests	Grants permission to list pull requests for a specified repository	repository*	aws:ResourceTag/${TagKey}	List
ListRepositories	Grants permission to list information about Amazon CodeCommit repositories in the current Region for your Amazon Web Services account			List
ListRepositoriesForApprovalRuleTemplate	Grants permission to list repositories that are associated with an approval rule template			List
ListTagsForResource	Grants permission to list the resource attached to a CodeCommit resource ARN	repository	aws:ResourceTag/${TagKey}	List
MergeBranchesByFastForward	Grants permission to merge two commits into the specified destination branch using the fast-forward merge option	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
MergeBranchesBySquash	Grants permission to merge two commits into the specified destination branch using the squash merge option	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
MergeBranchesByThreeWay	Grants permission to merge two commits into the specified destination branch using the three-way merge option	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
MergePullRequestByFastForward	Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the fast-forward merge option	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
MergePullRequestBySquash	Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the squash merge option	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
MergePullRequestByThreeWay	Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the three-way merge option	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
OverridePullRequestApprovalRules	Grants permission to override all approval rules for a pull request, including approval rules created by a template	repository*	aws:ResourceTag/${TagKey}	Write
PostCommentForComparedCommit	Grants permission to post a comment on the comparison between two commits	repository*	aws:ResourceTag/${TagKey}	Write
PostCommentForPullRequest	Grants permission to post a comment on a pull request	repository*	aws:ResourceTag/${TagKey}	Write
PostCommentReply	Grants permission to post a comment in reply to a comment on a comparison between commits or a pull request	repository*	aws:ResourceTag/${TagKey}	Write
PutCommentReaction	Grants permission to post a reaction on a comment	repository*	aws:ResourceTag/${TagKey}	Write
PutFile	Grants permission to add or update a file in a branch in an Amazon CodeCommit repository, and generate a commit for the addition in the specified branch	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
PutRepositoryTriggers	Grants permission to create, update, or delete triggers for a repository	repository*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to attach resource tags to a CodeCommit resource ARN	repository	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TestRepositoryTriggers	Grants permission to test the functionality of repository triggers by sending information to the trigger target	repository*	aws:ResourceTag/${TagKey}	Write
UntagResource	Grants permission to disassociate resource tags from a CodeCommit resource ARN	repository	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateApprovalRuleTemplateContent	Grants permission to update the content of approval rule templates; does not grant permission to update content of approval rules created specifically for pull requests			Write
UpdateApprovalRuleTemplateDescription	Grants permission to update the description of approval rule templates			Write
UpdateApprovalRuleTemplateName	Grants permission to update the name of approval rule templates			Write
UpdateComment	Grants permission to update the contents of a comment if the identity matches the identity used to create the comment	repository*	aws:ResourceTag/${TagKey}	Write
UpdateDefaultBranch	Grants permission to change the default branch in an Amazon CodeCommit repository	repository*	aws:ResourceTag/${TagKey}	Write
UpdatePullRequestApprovalRuleContent	Grants permission to update the content for approval rules created for a specific pull requests; does not grant permission to update approval rule content for rules created with an approval rule template	repository*	aws:ResourceTag/${TagKey}	Write
UpdatePullRequestApprovalState	Grants permission to update the approval state for pull requests	repository*	aws:ResourceTag/${TagKey}	Write
UpdatePullRequestDescription	Grants permission to update the description of a pull request	repository*	aws:ResourceTag/${TagKey}	Write
UpdatePullRequestStatus	Grants permission to update the status of a pull request	repository*	aws:ResourceTag/${TagKey}	Write
UpdatePullRequestTitle	Grants permission to update the title of a pull request	repository*	aws:ResourceTag/${TagKey}	Write
UpdateRepositoryDescription	Grants permission to change the description of an Amazon CodeCommit repository	repository*	aws:ResourceTag/${TagKey}	Write
UpdateRepositoryEncryptionKey	Grants permission to change the Amazon KMS encryption key used to encrypt and decrypt an Amazon CodeCommit repository	repository*	aws:ResourceTag/${TagKey}	Write
UpdateRepositoryName	Grants permission to change the name of an Amazon CodeCommit repository	repository*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon CodeCommit

The following actions are defined by Amazon CodeCommit but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchGetPullRequests	Grants permission to return information about one or more pull requests in an Amazon CodeCommit repository	repository*	aws:ResourceTag/${TagKey}	Read
CancelUploadArchive	Grants permission to cancel the uploading of an archive to a pipeline in Amazon CodePipeline	repository*	aws:ResourceTag/${TagKey}	Read
GetCommitHistory	Grants permission to get information about the history of commits in a repository	repository*	aws:ResourceTag/${TagKey}	Read
GetCommitsFromMergeBase	Grants permission to get information about the difference between commits in the context of a potential merge	repository*	aws:ResourceTag/${TagKey}	Read
GetObjectIdentifier	Grants permission to resolve blobs, trees, and commits to their identifier	repository*	aws:ResourceTag/${TagKey}	Read
GetReferences	Grants permission to get details about references in an Amazon CodeCommit repository; does not control Git reference actions	repository*	aws:ResourceTag/${TagKey}	Read
GetTree	Grants permission to view the contents of a specified tree in an Amazon CodeCommit repository from the Amazon CodeCommit console	repository*	aws:ResourceTag/${TagKey}	Read
GetUploadArchiveStatus	Grants permission to get status information about an archive upload to a pipeline in Amazon CodePipeline	repository*	aws:ResourceTag/${TagKey}	Read
GitPull	Grants permission to pull information from an Amazon CodeCommit repository to a local repo	repository*	aws:ResourceTag/${TagKey}	Read
GitPush	Grants permission to push information from a local repo to an Amazon CodeCommit repository	repository*	aws:ResourceTag/${TagKey} codecommit:References	Write
UploadArchive	Grants permission to the service role for Amazon CodePipeline to upload repository changes into a pipeline	repository*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon CodeCommit

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
repository	arn:${Partition}:codecommit:${Region}:${Account}:${RepositoryName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon CodeCommit

Amazon CodeCommit defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
codecommit:References	Filters access by Git reference to specified Amazon CodeCommit actions	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon CodeBuild (codebuild)

Amazon CodeDeploy (codedeploy)