Amazon CodeGuru Security is in preview release and is subject to change.
You can use AWS condition keys in your Amazon CodeGuru Security policies to express conditions. For a list, see IAM JSON policy elements reference in the IAM User Guide.
You specify the actions in the policy's Action field. To specify an action,
use the codeguru-security: prefix followed by the API operation name (for
example, codeguru-security:CreateUploadUrl and
codeguru-security:CreateScan). To specify multiple actions in a single
statement, separate them with commas (for example, "Action": [
"codeguru-security:CreateUploadUrl", "codeguru-security:CreateScan" ]).
Using wildcard characters
You specify an Amazon Resource Name (ARN), with or without a wildcard character (*), as
the resource value in the policy's Resource field. You can use a wildcard to
specify multiple actions or resources. For example, codeguru-security:*
specifies all Amazon CodeGuru Security actions and codeguru-security:Get*
specifies all Amazon CodeGuru Security actions that begin with the word Get.
You can use the following table as a reference when you are setting up Authenticating with identities in Amazon CodeGuru Security and writing permissions policies that you can attach to an IAM identity (identity-based policies).
| Amazon CodeGuru Security API operations | Required permissions (API actions) | Resources |
|---|---|---|
BatchGetFindings |
Required to get multiple findings. |
(multiple) |
CreateScan |
Required to create a CodeGuru Security scan. |
|
CreateUploadUrl |
Required to generate a URL used to upload code artifacts. |
|
GetAccountConfiguration |
Required to get account level configuration. |
|
GetMetricsSummary |
Required to get summary metrics for an account. |
|
GetFindings |
Required to get findings generated by a scan. |
|
GetScan |
Required to get information about a scan. |
|
ListFindingsMetrics |
Required to list metrics about all findings in an account. |
* |
ListScans |
Required to list all scans in an account. |
|
ListTagsForResource |
Required to list all tags associated with a scan. |
|
TagResource |
Required to add tags to a scan. |
|
UntagResource |
Required to remove tags from a scan. |
|
UpdateAccountConfiguration |
Required to update account level configuration. |
* |
