Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon CodeDeploy

Amazon CodeDeploy (service prefix: codedeploy) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon CodeDeploy
Actions defined by Amazon CodeDeploy
Permission-only actions for Amazon CodeDeploy
Resource types defined by Amazon CodeDeploy
Condition keys for Amazon CodeDeploy

API operations defined by Amazon CodeDeploy

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AddTagsToOnPremisesInstances	codedeploy:AddTagsToOnPremisesInstances			Tagging, Write
BatchGetApplicationRevisions	codedeploy:BatchGetApplicationRevisions			Read
BatchGetApplications	codedeploy:BatchGetApplications			Read
BatchGetDeploymentGroups	codedeploy:BatchGetDeploymentGroups			Read
BatchGetDeploymentInstances	codedeploy:BatchGetDeploymentInstances			Read
BatchGetDeploymentTargets	codedeploy:BatchGetDeploymentTargets			Read
BatchGetDeployments	codedeploy:BatchGetDeployments			Read
BatchGetOnPremisesInstances	codedeploy:BatchGetOnPremisesInstances			Read
ContinueDeployment	codedeploy:ContinueDeployment			Write
CreateApplication	codedeploy:CreateApplication			Write
CreateApplication	codedeploy:TagResource			Tagging, Write
CreateDeployment	codedeploy:CreateDeployment			Write
	codedeploy:GetApplicationRevision			List
	codedeploy:GetDeploymentConfig			List
	codedeploy:RegisterApplicationRevision			Write
	codedeploy:UpdateDeploymentGroup			Write
CreateDeploymentConfig	codedeploy:CreateDeploymentConfig			Write
CreateDeploymentGroup	codedeploy:CreateDeploymentGroup			Write
	codedeploy:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	codedeploy.amazonaws.com	Write
DeleteApplication	codedeploy:DeleteApplication			Write
DeleteDeploymentConfig	codedeploy:DeleteDeploymentConfig			Write
DeleteDeploymentGroup	codedeploy:DeleteDeploymentGroup			Write
DeleteGitHubAccountToken	codedeploy:DeleteGitHubAccountToken			Write
DeleteResourcesByExternalId	codedeploy:DeleteResourcesByExternalId			Write
DeregisterOnPremisesInstance	codedeploy:DeregisterOnPremisesInstance			Write
GetApplication	codedeploy:GetApplication			List
GetApplicationRevision	codedeploy:GetApplicationRevision			List
GetDeployment	codedeploy:GetDeployment			List
GetDeploymentConfig	codedeploy:GetDeploymentConfig			List
GetDeploymentGroup	codedeploy:GetDeploymentGroup			List
GetDeploymentInstance	codedeploy:GetDeploymentInstance			List
GetDeploymentTarget	codedeploy:GetDeploymentTarget			Read
GetOnPremisesInstance	codedeploy:GetOnPremisesInstance			List
ListApplicationRevisions	codedeploy:ListApplicationRevisions			List
ListApplications	codedeploy:ListApplications			List
ListDeploymentConfigs	codedeploy:ListDeploymentConfigs			List
ListDeploymentGroups	codedeploy:ListDeploymentGroups			List
ListDeploymentInstances	codedeploy:ListDeploymentInstances			List
ListDeploymentTargets	codedeploy:ListDeploymentTargets			List
ListDeployments	codedeploy:ListDeployments			List
ListGitHubAccountTokenNames	codedeploy:ListGitHubAccountTokenNames			List
ListOnPremisesInstances	codedeploy:ListOnPremisesInstances			List
ListTagsForResource	codedeploy:ListTagsForResource			List
PutLifecycleEventHookExecutionStatus	codedeploy:CreateCloudFormationDeployment			Write
PutLifecycleEventHookExecutionStatus	codedeploy:PutLifecycleEventHookExecutionStatus			Write
RegisterApplicationRevision	codedeploy:RegisterApplicationRevision			Write
RegisterOnPremisesInstance	codedeploy:RegisterOnPremisesInstance			Write
RemoveTagsFromOnPremisesInstances	codedeploy:RemoveTagsFromOnPremisesInstances			Tagging, Write
SkipWaitTimeForInstanceTermination	codedeploy:SkipWaitTimeForInstanceTermination			Write
StopDeployment	codedeploy:CreateCloudFormationDeployment			Write
StopDeployment	codedeploy:StopDeployment			Write
TagResource	codedeploy:TagResource			Tagging, Write
UntagResource	codedeploy:UntagResource			Tagging, Write
UpdateApplication	codedeploy:UpdateApplication			Write
UpdateDeploymentGroup	codedeploy:UpdateDeploymentGroup			Write
UpdateDeploymentGroup	iam:PassRole	iam:PassedToService	codedeploy.amazonaws.com	Write

Actions defined by Amazon CodeDeploy

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddTagsToOnPremisesInstances	Grants permission to add tags to one or more on-premises instances	instance*		Tagging, Write
BatchGetApplicationRevisions	Grants permission to get information about one or more application revisions	application*	aws:ResourceTag/${TagKey}	Read
BatchGetApplications	Grants permission to get information about multiple applications associated with the IAM user	application*	aws:ResourceTag/${TagKey}	Read
BatchGetDeploymentGroups	Grants permission to get information about one or more deployment groups	deploymentgroup*	aws:ResourceTag/${TagKey}	Read
BatchGetDeploymentInstances	Grants permission to get information about one or more instance that are part of a deployment group	deploymentgroup*	aws:ResourceTag/${TagKey}	Read
BatchGetDeploymentTargets	Grants permission to return an array of one or more targets associated with a deployment. This method works with all compute types and should be used instead of the deprecated BatchGetDeploymentInstances. The maximum number of targets that can be returned is 25			Read
BatchGetDeployments	Grants permission to get information about multiple deployments associated with the IAM user	deploymentgroup*	aws:ResourceTag/${TagKey}	Read
BatchGetOnPremisesInstances	Grants permission to get information about one or more on-premises instances	instance*		Read
ContinueDeployment	Grants permission to start the process of rerouting traffic from instances in the original environment to instances in thereplacement environment without waiting for a specified wait time to elapse			Write
CreateApplication	Grants permission to create an application associated with the IAM user	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDeployment	Grants permission to create a deployment for an application associated with the IAM user	deploymentgroup*	aws:ResourceTag/${TagKey}	Write
CreateDeploymentConfig	Grants permission to create a custom deployment configuration associated with the IAM user	deploymentconfig*		Write
CreateDeploymentGroup	Grants permission to create a deployment group for an application associated with the IAM user	deploymentgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteApplication	Grants permission to delete an application associated with the IAM user	application*	aws:ResourceTag/${TagKey}	Write
DeleteDeploymentConfig	Grants permission to delete a custom deployment configuration associated with the IAM user	deploymentconfig*		Write
DeleteDeploymentGroup	Grants permission to delete a deployment group for an application associated with the IAM user	deploymentgroup*	aws:ResourceTag/${TagKey}	Write
DeleteGitHubAccountToken	Grants permission to delete a GitHub account connection			Write
DeleteResourcesByExternalId	Grants permission to delete resources associated with the given external Id			Write
DeregisterOnPremisesInstance	Grants permission to deregister an on-premises instance	instance*		Write
GetApplication	Grants permission to get information about a single application associated with the IAM user	application*	aws:ResourceTag/${TagKey}	List
GetApplicationRevision	Grants permission to get information about a single application revision for an application associated with the IAM user	application*	aws:ResourceTag/${TagKey}	List
GetDeployment	Grants permission to get information about a single deployment to a deployment group for an application associated with the IAM user	deploymentgroup*	aws:ResourceTag/${TagKey}	List
GetDeploymentConfig	Grants permission to get information about a single deployment configuration associated with the IAM user	deploymentconfig*		List
GetDeploymentGroup	Grants permission to get information about a single deployment group for an application associated with the IAM user	deploymentgroup*	aws:ResourceTag/${TagKey}	List
GetDeploymentInstance	Grants permission to get information about a single instance in a deployment associated with the IAM user	deploymentgroup*	aws:ResourceTag/${TagKey}	List
GetDeploymentTarget	Grants permission to return information about a deployment target			Read
GetOnPremisesInstance	Grants permission to get information about a single on-premises instance	instance*		List
ListApplicationRevisions	Grants permission to get information about all application revisions for an application associated with the IAM user	application*	aws:ResourceTag/${TagKey}	List
ListApplications	Grants permission to get information about all applications associated with the IAM user			List
ListDeploymentConfigs	Grants permission to get information about all deployment configurations associated with the IAM user			List
ListDeploymentGroups	Grants permission to get information about all deployment groups for an application associated with the IAM user	application*	aws:ResourceTag/${TagKey}	List
ListDeploymentInstances	Grants permission to get information about all instances in a deployment associated with the IAM user	deploymentgroup*	aws:ResourceTag/${TagKey}	List
ListDeploymentTargets	Grants permission to return an array of target IDs that are associated a deployment			List
ListDeployments	Grants permission to get information about all deployments to a deployment group associated with the IAM user, or to get all deployments associated with the IAM user	deploymentgroup*	aws:ResourceTag/${TagKey}	List
ListGitHubAccountTokenNames	Grants permission to list the names of stored connections to GitHub accounts			List
ListOnPremisesInstances	Grants permission to get a list of one or more on-premises instance names			List
ListTagsForResource	Grants permission to return a list of tags for the resource identified by a specified ARN. Tags are used to organize and categorize your CodeDeploy resources	application	aws:ResourceTag/${TagKey}	List
ListTagsForResource		deploymentgroup	aws:ResourceTag/${TagKey}	List
PutLifecycleEventHookExecutionStatus	Grants permission to notify a lifecycle event hook execution status for associated deployment with the IAM user			Write
RegisterApplicationRevision	Grants permission to register information about an application revision for an application associated with the IAM user	application*	aws:ResourceTag/${TagKey}	Write
RegisterOnPremisesInstance	Grants permission to register an on-premises instance	instance*		Write
RemoveTagsFromOnPremisesInstances	Grants permission to remove tags from one or more on-premises instances	instance*		Tagging, Write
SkipWaitTimeForInstanceTermination	Grants permission to override any specified wait time and starts terminating instances immediately after the traffic routing is complete. This action applies to blue-green deployments only			Write
StopDeployment	Grants permission to stop a deployment			Write
TagResource	Grants permission to associate the list of tags in the input Tags parameter with the resource identified by the ResourceArn input parameter	application	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource		deploymentgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to disassociate a resource from a list of tags. The resource is identified by the ResourceArn input parameter. The tags are identfied by the list of keys in the TagKeys input parameter	application	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		deploymentgroup	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateApplication	Grants permission to update an application	application*	aws:ResourceTag/${TagKey}	Write
UpdateDeploymentGroup	Grants permission to change information about a single deployment group for an application associated with the IAM user	deploymentgroup*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon CodeDeploy

The following actions are defined by Amazon CodeDeploy but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateCloudFormationDeployment	Grants permission to create CloudFormation deployment to cooperate ochestration for a CloudFormation stack update			Write

Resource types defined by Amazon CodeDeploy

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
application	arn:${Partition}:codedeploy:${Region}:${Account}:application:${ApplicationName}	aws:ResourceTag/${TagKey}
deploymentconfig	arn:${Partition}:codedeploy:${Region}:${Account}:deploymentconfig:${DeploymentConfigurationName}
deploymentgroup	arn:${Partition}:codedeploy:${Region}:${Account}:deploymentgroup:${ApplicationName}/${DeploymentGroupName}	aws:ResourceTag/${TagKey}
instance	arn:${Partition}:codedeploy:${Region}:${Account}:instance:${InstanceName}

Condition keys for Amazon CodeDeploy

Amazon CodeDeploy defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters actions based on tag key-value pairs attached to the resource	String
aws:TagKeys	Filters actions based on the presence of tag keys in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon CodeCommit (codecommit)

Amazon CodeDeploy secure host commands service (codedeploy-commands-secure)