Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon CodeBuild

Amazon CodeBuild (service prefix: codebuild) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon CodeBuild
Actions defined by Amazon CodeBuild
Permission-only actions for Amazon CodeBuild
Resource types defined by Amazon CodeBuild
Condition keys for Amazon CodeBuild

API operations defined by Amazon CodeBuild

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchDeleteBuilds	codebuild:BatchDeleteBuilds			Write
BatchGetBuildBatches	codebuild:BatchGetBuildBatches			Read
BatchGetBuilds	codebuild:BatchGetBuilds			Read
BatchGetCommandExecutions	codebuild:BatchGetCommandExecutions			Read
BatchGetFleets	codebuild:BatchGetFleets			Read
BatchGetProjects	codebuild:BatchGetProjects			Read
BatchGetReportGroups	codebuild:BatchGetReportGroups			Read
BatchGetReports	codebuild:BatchGetReports			Read
BatchGetSandboxes	codebuild:BatchGetSandboxes			Read
CreateFleet	codebuild:CreateFleet			Write
CreateFleet	iam:PassRole			Write
CreateProject	codebuild:CreateProject			Write
CreateProject	iam:PassRole	iam:PassedToService	codebuild.amazonaws.com	Write
CreateReportGroup	codebuild:CreateReportGroup			Write
CreateWebhook	codebuild:CreateWebhook			Write
DeleteBuildBatch	codebuild:DeleteBuildBatch			Write
DeleteFleet	codebuild:DeleteFleet			Write
DeleteProject	codebuild:DeleteProject			Write
DeleteReport	codebuild:DeleteReport			Write
DeleteReportGroup	codebuild:DeleteReportGroup			Write
DeleteResourcePolicy	codebuild:DeleteResourcePolicy			Permissions management, Write
DeleteSourceCredentials	codebuild:DeleteSourceCredentials			Write
DeleteWebhook	codebuild:DeleteWebhook			Write
DescribeCodeCoverages	codebuild:DescribeCodeCoverages			Read
DescribeTestCases	codebuild:DescribeTestCases			Read
GetReportGroupTrend	codebuild:GetReportGroupTrend			Read
GetResourcePolicy	codebuild:GetResourcePolicy			Read
ImportSourceCredentials	codebuild:ImportSourceCredentials			Write
InvalidateProjectCache	codebuild:InvalidateProjectCache			Write
ListBuildBatches	codebuild:ListBuildBatches			List
ListBuildBatchesForProject	codebuild:ListBuildBatchesForProject			List
ListBuilds	codebuild:ListBuilds			List
ListBuildsForProject	codebuild:ListBuildsForProject			List
ListCommandExecutionsForSandbox	codebuild:ListCommandExecutionsForSandbox			List
ListCuratedEnvironmentImages	codebuild:ListCuratedEnvironmentImages			List
ListFleets	codebuild:ListFleets			List
ListProjects	codebuild:ListProjects			List
ListReportGroups	codebuild:ListReportGroups			List
ListReports	codebuild:ListReports			List
ListReportsForReportGroup	codebuild:ListReportsForReportGroup			List
ListSandboxes	codebuild:ListSandboxes			List
ListSandboxesForProject	codebuild:ListSandboxesForProject			List
ListSharedProjects	codebuild:ListSharedProjects			List
ListSharedReportGroups	codebuild:ListSharedReportGroups			List
ListSourceCredentials	codebuild:ListSourceCredentials			List
PutResourcePolicy	codebuild:PutResourcePolicy			Permissions management, Write
RetryBuild	codebuild:RetryBuild			Write
RetryBuildBatch	codebuild:RetryBuildBatch			Write
StartBuild	codebuild:StartBuild			Write
StartBuild	iam:PassRole	iam:PassedToService	codebuild.amazonaws.com	Write
StartBuildBatch	codebuild:StartBuildBatch			Write
StartBuildBatch	iam:PassRole	iam:PassedToService	codebuild.amazonaws.com	Write
StartCommandExecution	codebuild:StartCommandExecution			Write
StartSandbox	codebuild:StartSandbox			Write
StartSandboxConnection	codebuild:StartSandboxConnection			Write
StopBuild	codebuild:StopBuild			Write
StopBuildBatch	codebuild:StopBuildBatch			Write
StopSandbox	codebuild:StopSandbox			Write
UpdateFleet	codebuild:UpdateFleet			Write
UpdateFleet	iam:PassRole			Write
UpdateProject	codebuild:UpdateProject			Write
UpdateProject	iam:PassRole	iam:PassedToService	codebuild.amazonaws.com	Write
UpdateProjectVisibility	codebuild:UpdateProjectVisibility			Write
UpdateProjectVisibility	iam:PassRole	iam:PassedToService	codebuild.amazonaws.com	Write
UpdateReportGroup	codebuild:UpdateReportGroup			Write
UpdateWebhook	codebuild:UpdateWebhook			Write

Actions defined by Amazon CodeBuild

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchDeleteBuilds	Grants permission to delete one or more builds	project*	aws:ResourceTag/${TagKey}	Write
BatchGetBuildBatches	Grants permission to get information about one or more build batches	project*	aws:ResourceTag/${TagKey}	Read
BatchGetBuilds	Grants permission to get information about one or more builds	project*	aws:ResourceTag/${TagKey}	Read
BatchGetCommandExecutions	Grants permission to get information about one or more command executions	sandbox*		Read
BatchGetFleets	Grants permission to return an array of the Fleet objects specified by the input parameter	fleet*		Read
BatchGetProjects	Grants permission to get information about one or more build projects	project*	aws:ResourceTag/${TagKey}	Read
BatchGetReportGroups	Grants permission to return an array of ReportGroup objects that are specified by the input reportGroupArns parameter	report-group*	aws:ResourceTag/${TagKey}	Read
BatchGetReports	Grants permission to return an array of the Report objects specified by the input reportArns parameter	report-group*	aws:ResourceTag/${TagKey}	Read
BatchGetSandboxes	Grants permission to get information about one or more sandboxes	project*	aws:ResourceTag/${TagKey}	Read
CreateFleet	Grants permission to create a compute fleet	fleet*	aws:RequestTag/${TagKey} aws:TagKeys codebuild:computeConfiguration codebuild:computeConfiguration.disk codebuild:computeConfiguration.instanceType codebuild:computeConfiguration.machineType codebuild:computeConfiguration.memory codebuild:computeConfiguration.vCpu codebuild:computeType codebuild:environmentType codebuild:fleetServiceRole codebuild:imageId codebuild:vpcConfig codebuild:vpcConfig.securityGroupIds codebuild:vpcConfig.subnets codebuild:vpcConfig.vpcId	Write
CreateProject	Grants permission to create a build project	project*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys codebuild:artifacts codebuild:artifacts.bucketOwnerAccess codebuild:artifacts.encryptionDisabled codebuild:artifacts.location codebuild:autoRetryLimit codebuild:buildBatchConfig codebuild:buildBatchConfig.restrictions.computeTypesAllowed codebuild:buildBatchConfig.restrictions.fleetsAllowed codebuild:buildBatchConfig.serviceRole codebuild:cache codebuild:cache.location codebuild:cache.modes codebuild:cache.type codebuild:concurrentBuildLimit codebuild:encryptionKey codebuild:environment codebuild:environment.certificate codebuild:environment.computeConfiguration codebuild:environment.computeConfiguration.disk codebuild:environment.computeConfiguration.instanceType codebuild:environment.computeConfiguration.machineType codebuild:environment.computeConfiguration.memory codebuild:environment.computeConfiguration.vCpu codebuild:environment.computeType codebuild:environment.environmentVariables codebuild:environment.environmentVariables.name codebuild:environment.environmentVariables.value codebuild:environment.environmentVariables/${name}.value codebuild:environment.fleet.fleetArn codebuild:environment.image codebuild:environment.imagePullCredentialsType codebuild:environment.privilegedMode codebuild:environment.registryCredential codebuild:environment.registryCredential.credential codebuild:environment.registryCredential.credentialProvider codebuild:environment.type codebuild:fileSystemLocations.identifier codebuild:fileSystemLocations.location codebuild:fileSystemLocations.type codebuild:fileSystemLocations/${identifier}.location codebuild:fileSystemLocations/${identifier}.type codebuild:logsConfig codebuild:logsConfig.s3Logs codebuild:logsConfig.s3Logs.bucketOwnerAccess codebuild:logsConfig.s3Logs.encryptionDisabled codebuild:logsConfig.s3Logs.location codebuild:logsConfig.s3Logs.status codebuild:secondaryArtifacts codebuild:secondaryArtifacts.artifactIdentifier codebuild:secondaryArtifacts.bucketOwnerAccess codebuild:secondaryArtifacts.encryptionDisabled codebuild:secondaryArtifacts.location codebuild:secondaryArtifacts/${artifactIdentifier}.bucketOwnerAccess codebuild:secondaryArtifacts/${artifactIdentifier}.encryptionDisabled codebuild:secondaryArtifacts/${artifactIdentifier}.location codebuild:secondarySources codebuild:secondarySources.auth.resource codebuild:secondarySources.auth.type codebuild:secondarySources.buildspec codebuild:secondarySources.buildStatusConfig.context codebuild:secondarySources.buildStatusConfig.targetUrl codebuild:secondarySources.insecureSsl codebuild:secondarySources.location codebuild:secondarySources.sourceIdentifier codebuild:secondarySources/${sourceIdentifier}.auth.resource codebuild:secondarySources/${sourceIdentifier}.auth.type codebuild:secondarySources/${sourceIdentifier}.buildspec codebuild:secondarySources/${sourceIdentifier}.buildStatusConfig.context codebuild:secondarySources/${sourceIdentifier}.buildStatusConfig.targetUrl codebuild:secondarySources/${sourceIdentifier}.insecureSsl codebuild:secondarySources/${sourceIdentifier}.location codebuild:serviceRole codebuild:source codebuild:source.auth.resource codebuild:source.auth.type codebuild:source.buildspec codebuild:source.buildStatusConfig.context codebuild:source.buildStatusConfig.targetUrl codebuild:source.insecureSsl codebuild:source.location codebuild:vpcConfig codebuild:vpcConfig.securityGroupIds codebuild:vpcConfig.subnets codebuild:vpcConfig.vpcId	Write
CreateReportGroup	Grants permission to create a report group	report-group*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys codebuild:exportConfig.s3Destination.bucket codebuild:exportConfig.s3Destination.bucketOwner codebuild:exportConfig.s3Destination.encryptionDisabled codebuild:exportConfig.s3Destination.encryptionKey codebuild:exportConfig.s3Destination.path	Write
CreateWebhook	Grants permission to create webhook. For an existing Amazon CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, enables Amazon CodeBuild to start rebuilding the source code every time a code change is pushed to the repository	project*	aws:ResourceTag/${TagKey} codebuild:buildType codebuild:manualCreation codebuild:scopeConfiguration.domain codebuild:scopeConfiguration.name codebuild:scopeConfiguration.scope	Write
DeleteBuildBatch	Grants permission to delete a build batch	project*	aws:ResourceTag/${TagKey}	Write
DeleteFleet	Grants permission to delete a compute fleet	fleet*		Write
DeleteProject	Grants permission to delete a build project	project*	aws:ResourceTag/${TagKey}	Write
DeleteReport	Grants permission to delete a report	report-group*	aws:ResourceTag/${TagKey}	Write
DeleteReportGroup	Grants permission to delete a report group	report-group*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete a resource policy for the associated project or report group	project	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteResourcePolicy		report-group	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteSourceCredentials	Grants permission to delete a set of GitHub, GitHub Enterprise, or Bitbucket source credentials			Write
DeleteWebhook	Grants permission to delete webhook. For an existing Amazon CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, stops Amazon CodeBuild from rebuilding the source code every time a code change is pushed to the repository	project*	aws:ResourceTag/${TagKey}	Write
DescribeCodeCoverages	Grants permission to return an array of CodeCoverage objects	report-group*	aws:ResourceTag/${TagKey}	Read
DescribeTestCases	Grants permission to return an array of TestCase objects	report-group*	aws:ResourceTag/${TagKey}	Read
GetReportGroupTrend	Grants permission to analyze and accumulate test report values for the test reports in the specified report group	report-group*	aws:ResourceTag/${TagKey}	Read
GetResourcePolicy	Grants permission to return a resource policy for the specified project or report group	project	aws:ResourceTag/${TagKey}	Read
GetResourcePolicy		report-group	aws:ResourceTag/${TagKey}	Read
ImportSourceCredentials	Grants permission to import the source repository credentials for an Amazon CodeBuild project that has its source code stored in a GitHub, GitHub Enterprise, or Bitbucket repository		codebuild:authType codebuild:serverType codebuild:shouldOverwrite codebuild:token codebuild:username	Write
InvalidateProjectCache	Grants permission to reset the cache for a project	project*	aws:ResourceTag/${TagKey}	Write
ListBuildBatches	Grants permission to get a list of build batch IDs, with each build batch ID representing a single build batch			List
ListBuildBatchesForProject	Grants permission to get a list of build batch IDs for the specified build project, with each build batch ID representing a single build batch	project*	aws:ResourceTag/${TagKey}	List
ListBuilds	Grants permission to get a list of build IDs, with each build ID representing a single build			List
ListBuildsForProject	Grants permission to get a list of build IDs for the specified build project, with each build ID representing a single build	project*	aws:ResourceTag/${TagKey}	List
ListCommandExecutionsForSandbox	Grants permission to get a list of command execution IDs for the specified sandbox, with each command execution ID representing a single command execution	sandbox*		List
ListCuratedEnvironmentImages	Grants permission to get information about Docker images that are managed by Amazon CodeBuild			List
ListFleets	Grants permission to get a list of compute fleet ARNs, with each compute fleet ARN representing a single fleet			List
ListProjects	Grants permission to get a list of build project names, with each build project name representing a single build project			List
ListReportGroups	Grants permission to return a list of report group ARNs. Each report group ARN represents one report group			List
ListReports	Grants permission to return a list of report ARNs. Each report ARN representing one report			List
ListReportsForReportGroup	Grants permission to return a list of report ARNs that belong to the specified report group. Each report ARN represents one report	report-group*	aws:ResourceTag/${TagKey}	List
ListSandboxes	Grants permission to get a list of sandbox IDs, with each sandbox ID representing a single sandbox			List
ListSandboxesForProject	Grants permission to get a list of sandbox IDs for the specified sandbox project, with each sandbox ID representing a single sandbox	project*	aws:ResourceTag/${TagKey}	List
ListSharedProjects	Grants permission to return a list of project ARNs that have been shared with the requester. Each project ARN represents one project			List
ListSharedReportGroups	Grants permission to return a list of report group ARNs that have been shared with the requester. Each report group ARN represents one report group			List
ListSourceCredentials	Grants permission to return a list of SourceCredentialsInfo objects			List
PutResourcePolicy	Grants permission to create a resource policy for the associated project or report group	project	aws:ResourceTag/${TagKey}	Permissions management, Write
PutResourcePolicy		report-group	aws:ResourceTag/${TagKey}	Permissions management, Write
RetryBuild	Grants permission to retry a build	project*	aws:ResourceTag/${TagKey}	Write
RetryBuildBatch	Grants permission to retry a build batch	project*	aws:ResourceTag/${TagKey}	Write
StartBuild	Grants permission to start running a build	project*	aws:ResourceTag/${TagKey} codebuild:artifacts codebuild:artifacts.bucketOwnerAccess codebuild:artifacts.encryptionDisabled codebuild:artifacts.location codebuild:autoRetryLimit codebuild:cache codebuild:cache.location codebuild:cache.modes codebuild:cache.type codebuild:encryptionKey codebuild:environment codebuild:environment.certificate codebuild:environment.computeType codebuild:environment.environmentVariables codebuild:environment.environmentVariables.name codebuild:environment.environmentVariables.value codebuild:environment.environmentVariables/${name}.value codebuild:environment.fleet.fleetArn codebuild:environment.image codebuild:environment.imagePullCredentialsType codebuild:environment.privilegedMode codebuild:environment.registryCredential codebuild:environment.registryCredential.credential codebuild:environment.registryCredential.credentialProvider codebuild:environment.type codebuild:logsConfig codebuild:logsConfig.s3Logs codebuild:logsConfig.s3Logs.bucketOwnerAccess codebuild:logsConfig.s3Logs.encryptionDisabled codebuild:logsConfig.s3Logs.location codebuild:logsConfig.s3Logs.status codebuild:secondaryArtifacts codebuild:secondaryArtifacts.artifactIdentifier codebuild:secondaryArtifacts.bucketOwnerAccess codebuild:secondaryArtifacts.encryptionDisabled codebuild:secondaryArtifacts.location codebuild:secondaryArtifacts/${artifactIdentifier}.bucketOwnerAccess codebuild:secondaryArtifacts/${artifactIdentifier}.encryptionDisabled codebuild:secondaryArtifacts/${artifactIdentifier}.location codebuild:secondarySources codebuild:secondarySources.auth.resource codebuild:secondarySources.auth.type codebuild:secondarySources.buildspec codebuild:secondarySources.buildStatusConfig.context codebuild:secondarySources.buildStatusConfig.targetUrl codebuild:secondarySources.insecureSsl codebuild:secondarySources.location codebuild:secondarySources.sourceIdentifier codebuild:secondarySources/${sourceIdentifier}.auth.resource codebuild:secondarySources/${sourceIdentifier}.auth.type codebuild:secondarySources/${sourceIdentifier}.buildspec codebuild:secondarySources/${sourceIdentifier}.buildStatusConfig.context codebuild:secondarySources/${sourceIdentifier}.buildStatusConfig.targetUrl codebuild:secondarySources/${sourceIdentifier}.insecureSsl codebuild:secondarySources/${sourceIdentifier}.location codebuild:serviceRole codebuild:source codebuild:source.auth.resource codebuild:source.auth.type codebuild:source.buildspec codebuild:source.buildStatusConfig.context codebuild:source.buildStatusConfig.targetUrl codebuild:source.insecureSsl codebuild:source.location	Write
StartBuildBatch	Grants permission to start running a build batch	project*	aws:ResourceTag/${TagKey} codebuild:artifacts codebuild:artifacts.bucketOwnerAccess codebuild:artifacts.encryptionDisabled codebuild:artifacts.location codebuild:buildBatchConfig codebuild:buildBatchConfig.restrictions.computeTypesAllowed codebuild:buildBatchConfig.restrictions.fleetsAllowed codebuild:buildBatchConfig.serviceRole codebuild:cache codebuild:cache.location codebuild:cache.modes codebuild:cache.type codebuild:encryptionKey codebuild:environment codebuild:environment.certificate codebuild:environment.computeType codebuild:environment.environmentVariables codebuild:environment.environmentVariables.name codebuild:environment.environmentVariables.value codebuild:environment.environmentVariables/${name}.value codebuild:environment.image codebuild:environment.imagePullCredentialsType codebuild:environment.privilegedMode codebuild:environment.registryCredential codebuild:environment.registryCredential.credential codebuild:environment.registryCredential.credentialProvider codebuild:environment.type codebuild:logsConfig codebuild:logsConfig.s3Logs codebuild:logsConfig.s3Logs.bucketOwnerAccess codebuild:logsConfig.s3Logs.encryptionDisabled codebuild:logsConfig.s3Logs.location codebuild:logsConfig.s3Logs.status codebuild:secondaryArtifacts codebuild:secondaryArtifacts.artifactIdentifier codebuild:secondaryArtifacts.bucketOwnerAccess codebuild:secondaryArtifacts.encryptionDisabled codebuild:secondaryArtifacts.location codebuild:secondaryArtifacts/${artifactIdentifier}.bucketOwnerAccess codebuild:secondaryArtifacts/${artifactIdentifier}.encryptionDisabled codebuild:secondaryArtifacts/${artifactIdentifier}.location codebuild:secondarySources codebuild:secondarySources.auth.resource codebuild:secondarySources.auth.type codebuild:secondarySources.buildspec codebuild:secondarySources.buildStatusConfig.context codebuild:secondarySources.buildStatusConfig.targetUrl codebuild:secondarySources.insecureSsl codebuild:secondarySources.location codebuild:secondarySources.sourceIdentifier codebuild:secondarySources/${sourceIdentifier}.auth.resource codebuild:secondarySources/${sourceIdentifier}.auth.type codebuild:secondarySources/${sourceIdentifier}.buildspec codebuild:secondarySources/${sourceIdentifier}.buildStatusConfig.context codebuild:secondarySources/${sourceIdentifier}.buildStatusConfig.targetUrl codebuild:secondarySources/${sourceIdentifier}.insecureSsl codebuild:secondarySources/${sourceIdentifier}.location codebuild:serviceRole codebuild:source codebuild:source.auth.resource codebuild:source.auth.type codebuild:source.buildspec codebuild:source.insecureSsl codebuild:source.location	Write
StartCommandExecution	Grants permission to start running a command execution	sandbox*		Write
StartSandbox	Grants permission to start running a sandbox	project*	aws:ResourceTag/${TagKey}	Write
StartSandboxConnection	Grants permission to establish a connection to the sandbox	sandbox*		Write
StopBuild	Grants permission to attempt to stop running a build	project*	aws:ResourceTag/${TagKey}	Write
StopBuildBatch	Grants permission to attempt to stop running a build batch	project*	aws:ResourceTag/${TagKey}	Write
StopSandbox	Grants permission to attempt to stop running a sandbox	project*	aws:ResourceTag/${TagKey}	Write
UpdateFleet	Grants permission to change the settings of an existing compute fleet	fleet*	aws:RequestTag/${TagKey} aws:TagKeys codebuild:computeConfiguration codebuild:computeConfiguration.disk codebuild:computeConfiguration.instanceType codebuild:computeConfiguration.machineType codebuild:computeConfiguration.memory codebuild:computeConfiguration.vCpu codebuild:computeType codebuild:environmentType codebuild:fleetServiceRole codebuild:imageId codebuild:vpcConfig codebuild:vpcConfig.securityGroupIds codebuild:vpcConfig.subnets codebuild:vpcConfig.vpcId	Write
UpdateProject	Grants permission to change the settings of an existing build project	project*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys codebuild:artifacts codebuild:artifacts.bucketOwnerAccess codebuild:artifacts.encryptionDisabled codebuild:artifacts.location codebuild:autoRetryLimit codebuild:buildBatchConfig codebuild:buildBatchConfig.restrictions.computeTypesAllowed codebuild:buildBatchConfig.restrictions.fleetsAllowed codebuild:buildBatchConfig.serviceRole codebuild:cache codebuild:cache.location codebuild:cache.modes codebuild:cache.type codebuild:concurrentBuildLimit codebuild:encryptionKey codebuild:environment codebuild:environment.certificate codebuild:environment.computeConfiguration codebuild:environment.computeConfiguration.disk codebuild:environment.computeConfiguration.instanceType codebuild:environment.computeConfiguration.machineType codebuild:environment.computeConfiguration.memory codebuild:environment.computeConfiguration.vCpu codebuild:environment.computeType codebuild:environment.environmentVariables codebuild:environment.environmentVariables.name codebuild:environment.environmentVariables.value codebuild:environment.environmentVariables/${name}.value codebuild:environment.fleet.fleetArn codebuild:environment.image codebuild:environment.imagePullCredentialsType codebuild:environment.privilegedMode codebuild:environment.registryCredential codebuild:environment.registryCredential.credential codebuild:environment.registryCredential.credentialProvider codebuild:environment.type codebuild:fileSystemLocations.identifier codebuild:fileSystemLocations.location codebuild:fileSystemLocations.type codebuild:fileSystemLocations/${identifier}.location codebuild:fileSystemLocations/${identifier}.type codebuild:logsConfig codebuild:logsConfig.s3Logs codebuild:logsConfig.s3Logs.bucketOwnerAccess codebuild:logsConfig.s3Logs.encryptionDisabled codebuild:logsConfig.s3Logs.location codebuild:logsConfig.s3Logs.status codebuild:secondaryArtifacts codebuild:secondaryArtifacts.artifactIdentifier codebuild:secondaryArtifacts.bucketOwnerAccess codebuild:secondaryArtifacts.encryptionDisabled codebuild:secondaryArtifacts.location codebuild:secondaryArtifacts/${artifactIdentifier}.bucketOwnerAccess codebuild:secondaryArtifacts/${artifactIdentifier}.encryptionDisabled codebuild:secondaryArtifacts/${artifactIdentifier}.location codebuild:secondarySources codebuild:secondarySources.auth.resource codebuild:secondarySources.auth.type codebuild:secondarySources.buildspec codebuild:secondarySources.buildStatusConfig.context codebuild:secondarySources.buildStatusConfig.targetUrl codebuild:secondarySources.insecureSsl codebuild:secondarySources.location codebuild:secondarySources.sourceIdentifier codebuild:secondarySources/${sourceIdentifier}.auth.resource codebuild:secondarySources/${sourceIdentifier}.auth.type codebuild:secondarySources/${sourceIdentifier}.buildspec codebuild:secondarySources/${sourceIdentifier}.buildStatusConfig.context codebuild:secondarySources/${sourceIdentifier}.buildStatusConfig.targetUrl codebuild:secondarySources/${sourceIdentifier}.insecureSsl codebuild:secondarySources/${sourceIdentifier}.location codebuild:serviceRole codebuild:source codebuild:source.auth.resource codebuild:source.auth.type codebuild:source.buildspec codebuild:source.buildStatusConfig.context codebuild:source.buildStatusConfig.targetUrl codebuild:source.insecureSsl codebuild:source.location codebuild:vpcConfig codebuild:vpcConfig.securityGroupIds codebuild:vpcConfig.subnets codebuild:vpcConfig.vpcId	Write
UpdateProjectVisibility	Grants permission to change the public visibility of a project and its builds	project*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys codebuild:projectVisibility	Write
UpdateReportGroup	Grants permission to change the settings of an existing report group	report-group*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys codebuild:exportConfig.s3Destination.bucket codebuild:exportConfig.s3Destination.bucketOwner codebuild:exportConfig.s3Destination.encryptionDisabled codebuild:exportConfig.s3Destination.encryptionKey codebuild:exportConfig.s3Destination.path	Write
UpdateWebhook	Grants permission to update the webhook associated with an Amazon CodeBuild build project	project*	aws:ResourceTag/${TagKey} codebuild:buildType codebuild:manualCreation codebuild:scopeConfiguration.domain codebuild:scopeConfiguration.name codebuild:scopeConfiguration.scope	Write

Permission-only actions for Amazon CodeBuild

The following actions are defined by Amazon CodeBuild but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchPutCodeCoverages	Grants permission to add or update information about a report	report-group*	aws:ResourceTag/${TagKey}	Write
BatchPutTestCases	Grants permission to add or update information about a report	report-group*	aws:ResourceTag/${TagKey}	Write
CreateReport	Grants permission to create a report. A report is created when tests specified in the buildspec file for a report groups run during the build of a project	report-group*	aws:ResourceTag/${TagKey}	Write
DeleteOAuthToken	Grants permission to delete an OAuth token from a connected third-party OAuth provider. Only used in the Amazon CodeBuild console			Write
ListConnectedOAuthAccounts	Grants permission to list connected third-party OAuth providers. Only used in the Amazon CodeBuild console			List
ListRepositories	Grants permission to list source code repositories from a connected third-party OAuth provider. Only used in the Amazon CodeBuild console			List
PersistOAuthToken	Grants permission to save an OAuth token from a connected third-party OAuth provider. Only used in the Amazon CodeBuild console			Write
UpdateReport	Grants permission to update information about a report	report-group*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon CodeBuild

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
build	arn:${Partition}:codebuild:${Region}:${Account}:build/${BuildId}
build-batch	arn:${Partition}:codebuild:${Region}:${Account}:build-batch/${BuildBatchId}
fleet	arn:${Partition}:codebuild:${Region}:${Account}:fleet/${FleetName}:${FleetId}
project	arn:${Partition}:codebuild:${Region}:${Account}:project/${ProjectName}	aws:ResourceTag/${TagKey}
report	arn:${Partition}:codebuild:${Region}:${Account}:report/${ReportGroupName}:${ReportId}
report-group	arn:${Partition}:codebuild:${Region}:${Account}:report-group/${ReportGroupName}	aws:ResourceTag/${TagKey}
sandbox	arn:${Partition}:codebuild:${Region}:${Account}:sandbox/${SandboxId}

Condition keys for Amazon CodeBuild

Amazon CodeBuild defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by actions based on the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by actions based on tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by actions based on the presence of tag keys in the request	ArrayOfString
codebuild:artifacts	Filters access by the API corresponding argument value	Bool
codebuild:artifacts.bucketOwnerAccess	Filters access by the API corresponding argument value	String
codebuild:artifacts.encryptionDisabled	Filters access by the API corresponding argument value	Bool
codebuild:artifacts.location	Filters access by the API corresponding argument value	String
codebuild:authType	Filters access by the API corresponding argument value	String
codebuild:autoRetryLimit	Filters access by the API corresponding argument value	Numeric
codebuild:buildArn	Filters access by the ARN of the Amazon CodeBuild build from which the request originated	ARN
codebuild:buildBatchConfig	Filters access by the API corresponding argument value	Bool
codebuild:buildBatchConfig.restrictions.computeTypesAllowed	Filters access by the API corresponding argument value	ArrayOfString
codebuild:buildBatchConfig.restrictions.fleetsAllowed	Filters access by the API corresponding argument value	ArrayOfString
codebuild:buildBatchConfig.serviceRole	Filters access by the API corresponding argument value	String
codebuild:buildType	Filters access by the API corresponding argument value	String
codebuild:cache	Filters access by the API corresponding argument value	Bool
codebuild:cache.location	Filters access by the API corresponding argument value	String
codebuild:cache.modes	Filters access by the API corresponding argument value	ArrayOfString
codebuild:cache.type	Filters access by the API corresponding argument value	String
codebuild:computeConfiguration	Filters access by the API corresponding argument value	Bool
codebuild:computeConfiguration.disk	Filters access by the API corresponding argument value	Numeric
codebuild:computeConfiguration.instanceType	Filters access by the API corresponding argument value	String
codebuild:computeConfiguration.machineType	Filters access by the API corresponding argument value	String
codebuild:computeConfiguration.memory	Filters access by the API corresponding argument value	Numeric
codebuild:computeConfiguration.vCpu	Filters access by the API corresponding argument value	Numeric
codebuild:computeType	Filters access by the API corresponding argument value	String
codebuild:concurrentBuildLimit	Filters access by the API corresponding argument value	Numeric
codebuild:encryptionKey	Filters access by the API corresponding argument value	String
codebuild:environment	Filters access by the API corresponding argument value	Bool
codebuild:environment.certificate	Filters access by the API corresponding argument value	String
codebuild:environment.computeConfiguration	Filters access by the API corresponding argument value	Bool
codebuild:environment.computeConfiguration.disk	Filters access by the API corresponding argument value	Numeric
codebuild:environment.computeConfiguration.instanceType	Filters access by the API corresponding argument value	String
codebuild:environment.computeConfiguration.machineType	Filters access by the API corresponding argument value	String
codebuild:environment.computeConfiguration.memory	Filters access by the API corresponding argument value	Numeric
codebuild:environment.computeConfiguration.vCpu	Filters access by the API corresponding argument value	Numeric
codebuild:environment.computeType	Filters access by the API corresponding argument value	String
codebuild:environment.environmentVariables	Filters access by the API corresponding argument value	Bool
codebuild:environment.environmentVariables.name	Filters access by the API corresponding argument value	ArrayOfString
codebuild:environment.environmentVariables.value	Filters access by the API corresponding argument value	ArrayOfString
codebuild:environment.environmentVariables/${name}.value	Filters access by the API corresponding argument value	String
codebuild:environment.fleet.fleetArn	Filters access by the API corresponding argument value	ARN
codebuild:environment.image	Filters access by the API corresponding argument value	String
codebuild:environment.imagePullCredentialsType	Filters access by the API corresponding argument value	String
codebuild:environment.privilegedMode	Filters access by the API corresponding argument value	Bool
codebuild:environment.registryCredential	Filters access by the API corresponding argument value	Bool
codebuild:environment.registryCredential.credential	Filters access by the API corresponding argument value	String
codebuild:environment.registryCredential.credentialProvider	Filters access by the API corresponding argument value	String
codebuild:environment.type	Filters access by the API corresponding argument value	String
codebuild:environmentType	Filters access by the API corresponding argument value	String
codebuild:exportConfig.s3Destination.bucket	Filters access by the API corresponding argument value	String
codebuild:exportConfig.s3Destination.bucketOwner	Filters access by the API corresponding argument value	String
codebuild:exportConfig.s3Destination.encryptionDisabled	Filters access by the API corresponding argument value	Bool
codebuild:exportConfig.s3Destination.encryptionKey	Filters access by the API corresponding argument value	String
codebuild:exportConfig.s3Destination.path	Filters access by the API corresponding argument value	String
codebuild:fileSystemLocations.identifier	Filters access by the API corresponding argument value	ArrayOfString
codebuild:fileSystemLocations.location	Filters access by the API corresponding argument value	ArrayOfString
codebuild:fileSystemLocations.type	Filters access by the API corresponding argument value	ArrayOfString
codebuild:fileSystemLocations/${identifier}.location	Filters access by the API corresponding argument value	String
codebuild:fileSystemLocations/${identifier}.type	Filters access by the API corresponding argument value	String
codebuild:fleetServiceRole	Filters access by the API corresponding argument value	String
codebuild:imageId	Filters access by the API corresponding argument value	String
codebuild:logsConfig	Filters access by the API corresponding argument value	Bool
codebuild:logsConfig.s3Logs	Filters access by the API corresponding argument value	Bool
codebuild:logsConfig.s3Logs.bucketOwnerAccess	Filters access by the API corresponding argument value	String
codebuild:logsConfig.s3Logs.encryptionDisabled	Filters access by the API corresponding argument value	Bool
codebuild:logsConfig.s3Logs.location	Filters access by the API corresponding argument value	String
codebuild:logsConfig.s3Logs.status	Filters access by the API corresponding argument value	String
codebuild:manualCreation	Filters access by the API corresponding argument value	Bool
codebuild:projectArn	Filters access by the ARN of the Amazon CodeBuild project from which the request originated	ARN
codebuild:projectVisibility	Filters access by the API corresponding argument value	String
codebuild:scopeConfiguration.domain	Filters access by the API corresponding argument value	String
codebuild:scopeConfiguration.name	Filters access by the API corresponding argument value	String
codebuild:scopeConfiguration.scope	Filters access by the API corresponding argument value	String
codebuild:secondaryArtifacts	Filters access by the API corresponding argument value	Bool
codebuild:secondaryArtifacts.artifactIdentifier	Filters access by the API corresponding argument value	ArrayOfString
codebuild:secondaryArtifacts.bucketOwnerAccess	Filters access by the API corresponding argument value	ArrayOfString
codebuild:secondaryArtifacts.encryptionDisabled	Filters access by the API corresponding argument value	ArrayOfBool
codebuild:secondaryArtifacts.location	Filters access by the API corresponding argument value	ArrayOfString
codebuild:secondaryArtifacts/${artifactIdentifier}.bucketOwnerAccess	Filters access by the API corresponding argument value	String
codebuild:secondaryArtifacts/${artifactIdentifier}.encryptionDisabled	Filters access by the API corresponding argument value	Bool
codebuild:secondaryArtifacts/${artifactIdentifier}.location	Filters access by the API corresponding argument value	String
codebuild:secondarySources	Filters access by the API corresponding argument value	Bool
codebuild:secondarySources.auth.resource	Filters access by the API corresponding argument value	ArrayOfString
codebuild:secondarySources.auth.type	Filters access by the API corresponding argument value	ArrayOfString
codebuild:secondarySources.buildStatusConfig.context	Filters access by the API corresponding argument value	ArrayOfString
codebuild:secondarySources.buildStatusConfig.targetUrl	Filters access by the API corresponding argument value	ArrayOfString
codebuild:secondarySources.buildspec	Filters access by the API corresponding argument value	Bool
codebuild:secondarySources.insecureSsl	Filters access by the API corresponding argument value	ArrayOfBool
codebuild:secondarySources.location	Filters access by the API corresponding argument value	ArrayOfString
codebuild:secondarySources.sourceIdentifier	Filters access by the API corresponding argument value	ArrayOfString
codebuild:secondarySources/${sourceIdentifier}.auth.resource	Filters access by the API corresponding argument value	String
codebuild:secondarySources/${sourceIdentifier}.auth.type	Filters access by the API corresponding argument value	String
codebuild:secondarySources/${sourceIdentifier}.buildStatusConfig.context	Filters access by the API corresponding argument value	String
codebuild:secondarySources/${sourceIdentifier}.buildStatusConfig.targetUrl	Filters access by the API corresponding argument value	String
codebuild:secondarySources/${sourceIdentifier}.buildspec	Filters access by the API corresponding argument value	Bool
codebuild:secondarySources/${sourceIdentifier}.insecureSsl	Filters access by the API corresponding argument value	Bool
codebuild:secondarySources/${sourceIdentifier}.location	Filters access by the API corresponding argument value	String
codebuild:serverType	Filters access by the API corresponding argument value	String
codebuild:serviceRole	Filters access by the API corresponding argument value	String
codebuild:shouldOverwrite	Filters access by the API corresponding argument value	Bool
codebuild:source	Filters access by the API corresponding argument value	Bool
codebuild:source.auth.resource	Filters access by the API corresponding argument value	String
codebuild:source.auth.type	Filters access by the API corresponding argument value	String
codebuild:source.buildStatusConfig.context	Filters access by the API corresponding argument value	String
codebuild:source.buildStatusConfig.targetUrl	Filters access by the API corresponding argument value	String
codebuild:source.buildspec	Filters access by the API corresponding argument value	Bool
codebuild:source.insecureSsl	Filters access by the API corresponding argument value	Bool
codebuild:source.location	Filters access by the API corresponding argument value	String
codebuild:token	Filters access by the API corresponding argument value	String
codebuild:username	Filters access by the API corresponding argument value	String
codebuild:vpcConfig	Filters access by the API corresponding argument value	Bool
codebuild:vpcConfig.securityGroupIds	Filters access by the API corresponding argument value	ArrayOfString
codebuild:vpcConfig.subnets	Filters access by the API corresponding argument value	ArrayOfString
codebuild:vpcConfig.vpcId	Filters access by the API corresponding argument value	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon CloudTrail (cloudtrail)

Amazon CodeCommit (codecommit)