適用於 AWS CodePipeline的 Identity and Access Management

登入 AWS Management Console ，並在 https：//https://console.aws.amazon.com/iam/ 開啟 IAM 主控台。

在 IAM 主控台的導覽窗格中，選擇角色，然後從AWS-CodePipeline-Service角色清單中選擇您的角色。

在許可索引標籤的內嵌政策中，在您的服務角色政策的 列中，選擇編輯政策。

在政策文件方塊中新增必要的許可。

例如，針對 CodeCommit 支援，將下列項目新增至您的政策陳述式：

{
  "Effect": "Allow",
  "Action": [  
      "codecommit:GetBranch",
      "codecommit:GetCommit",
      "codecommit:UploadArchive",
      "codecommit:GetUploadArchiveStatus",      
      "codecommit:CancelUploadArchive"
            ],
  "Resource": "resource_ARN"
},

如需 AWS OpsWorks 支援，請將下列項目新增至您的政策陳述式：

{
    "Effect": "Allow",
    "Action": [
        "opsworks:CreateDeployment",
        "opsworks:DescribeApps",
        "opsworks:DescribeCommands",
        "opsworks:DescribeDeployments",
        "opsworks:DescribeInstances",
        "opsworks:DescribeStacks",
        "opsworks:UpdateApp",
        "opsworks:UpdateStack"
    ],
    "Resource": "resource_ARN"
},

如需 AWS CloudFormation 支援，請將下列內容新增至您的政策陳述式：

{
    "Effect": "Allow",
    "Action": [
        "cloudformation:CreateStack",
        "cloudformation:DeleteStack",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStacks",
        "cloudformation:UpdateStack",
        "cloudformation:CreateChangeSet",
        "cloudformation:DeleteChangeSet",
        "cloudformation:DescribeChangeSet",
        "cloudformation:ExecuteChangeSet",
        "cloudformation:SetStackPolicy",
        "cloudformation:ValidateTemplate",
        "iam:PassRole"
    ],
    "Resource": "resource_ARN"
},

請注意，cloudformation:DescribeStackEvents許可是選用的。它可讓 AWS CloudFormation 動作顯示更詳細的錯誤訊息。如果您不希望資源詳細資訊出現在管道錯誤訊息中，可以從 IAM 角色撤銷此許可。如需詳細資訊，請參閱AWS CloudFormation 部署動作參考。

針對 CodeBuild 支援，請將下列內容新增至您的政策陳述式：

{
    "Effect": "Allow",
    "Action": [
        "codebuild:BatchGetBuilds",
        "codebuild:StartBuild"
    ],
    "Resource": "resource_ARN"
},

如需 AWS Device Farm 支援，請將下列項目新增至您的政策陳述式：

{
    "Effect": "Allow",
    "Action": [
        "devicefarm:ListProjects",
        "devicefarm:ListDevicePools",
        "devicefarm:GetRun",
        "devicefarm:GetUpload",
        "devicefarm:CreateUpload",
        "devicefarm:ScheduleRun"
    ],
    "Resource": "resource_ARN"
},

對於 Service Catalog 支援，請將下列項目新增至您的政策陳述式：

{
    "Effect": "Allow",
    "Action": [
        "servicecatalog:ListProvisioningArtifacts",
        "servicecatalog:CreateProvisioningArtifact",
        "servicecatalog:DescribeProvisioningArtifact",
        "servicecatalog:DeleteProvisioningArtifact",
        "servicecatalog:UpdateProduct"
    ],
    "Resource": "resource_ARN"
},
{
    "Effect": "Allow",
    "Action": [
        "cloudformation:ValidateTemplate"
    ],
    "Resource": "resource_ARN"
}

針對 Amazon ECR 支援，請將下列內容新增至您的政策陳述式：

{
    "Effect": "Allow",
    "Action": [
        "ecr:DescribeImages"
    ],
    "Resource": "resource_ARN"
},

對於 Amazon ECS，下列是使用 Amazon ECS 部署動作建立管道所需的最低許可。

{
    "Effect": "Allow",
    "Action": [
        "ecs:DescribeServices",
        "ecs:DescribeTaskDefinition",
        "ecs:DescribeTasks",
        "ecs:ListTasks",
        "ecs:RegisterTaskDefinition",
        "ecs:TagResource",
        "ecs:UpdateService"
    ],
    "Resource": "resource_ARN"
},

您可以選擇在 Amazon ECS 中使用標記授權。選擇加入後，您必須授予下列許可：ecs:TagResource。如需如何選擇加入和判斷是否需要許可和是否強制執行標籤授權的詳細資訊，請參閱《Amazon Elastic Container Service 開發人員指南》中的標記授權時間表。

您還必須新增iam:PassRole許可，才能將 IAM 角色用於任務。如需詳細資訊，請參閱 Amazon ECS 任務執行 IAM 角色和任務的 IAM 角色。使用下列政策文字。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": [
                "arn:aws:iam::aws_account_ID:role/ecsTaskExecutionRole_or_TaskRole_name"
            ]
        }
    ]
}

對於 CodeDeployToECS動作 （藍/綠部署），下列是使用 CodeDeploy 建立管道到 Amazon ECS 藍/綠部署動作所需的最低許可。

{
    "Effect": "Allow",
    "Action": [
        "codedeploy:CreateDeployment",
        "codedeploy:GetDeployment",
        "codedeploy:GetApplication",
        "codedeploy:GetApplicationRevision",
        "codedeploy:RegisterApplicationRevision",
        "codedeploy:GetDeploymentConfig",
        "ecs:RegisterTaskDefinition",
        "ecs:TagResource"
    ],
    "Resource": "resource_ARN"
},

您可以選擇在 Amazon ECS 中使用標記授權。選擇加入後，您必須授予下列許可：ecs:TagResource。如需有關如何選擇加入和判斷是否需要許可和是否強制執行標籤授權的詳細資訊，請參閱《Amazon Elastic Container Service 開發人員指南》中的標記授權時間表。

您還必須新增iam:PassRole許可，才能將 IAM 角色用於任務。如需詳細資訊，請參閱 Amazon ECS 任務執行 IAM 角色和任務的 IAM 角色。使用下列政策文字。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": [
                "arn:aws:iam::aws_account_ID:role/ecsTaskExecutionRole_or_TaskRole_name"
            ]
        }
    ]
}

您也可以將 ecs-tasks.amazonaws.com新增至iam:PassedToService條件下的 服務清單，如本範例所示。

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "resource_ARN",
            "Condition": {
                "StringEqualsIfExists": {
                    "iam:PassedToService": [
                        "cloudformation.amazonaws.com",
                        "elasticbeanstalk.amazonaws.com",
                        "ec2.amazonaws.com",
                        "ecs-tasks.amazonaws.com"
                    ]
                }
            }
        },

對於 AWS CodeStar 連線，需要下列許可，才能使用 Bitbucket Cloud 等連線的來源來建立管道。

{
    "Effect": "Allow",
    "Action": [
        "codestar-connections:UseConnection"
    ],
    "Resource": "resource_ARN"
},

如需連線的 IAM 許可的詳細資訊，請參閱連線許可參考。

對於 StepFunctions動作，下列是使用 Step Functions 呼叫動作建立管道所需的最低許可。

{
    "Effect": "Allow",
    "Action": [
        "states:DescribeStateMachine",
        "states:DescribeExecution",
        "states:StartExecution"
    ],
    "Resource": "resource_ARN"
},

對於 AppConfig動作，下列是使用 a AWS AppConfig 叫用動作建立管道所需的最低許可。

{
    "Effect": "Allow",
    "Action": [
        "appconfig:StartDeployment",
        "appconfig:GetDeployment",
        "appconfig:StopDeployment"
    ],
    "Resource": "resource_ARN"
},

針對批次建置的 CodeBuild 支援，請將下列內容新增至您的政策陳述式：

{
    "Effect": "Allow",
    "Action": [
        "codebuild:BatchGetBuildBatches",
        "codebuild:StartBuildBatch"
    ],
    "Resource": "resource_ARN"
},

對於 AWS CloudFormation StackSets 動作，需要下列最低許可。

對於完整複製選項的 CodeCommit 支援，請將下列內容新增至您的政策陳述式：

{
    "Effect": "Allow",
    "Action": [
        "codecommit:GetRepository"
    ],
    "Resource": "resource_ARN"
},

對於 Elastic Beanstalk，下列是使用ElasticBeanstalk部署動作建立管道所需的最低許可。

{
    "Effect": "Allow",
    "Action": [
        "elasticbeanstalk:*",
        "ec2:*",
        "elasticloadbalancing:*",
        "autoscaling:*",
        "cloudwatch:*",
        "s3:*",
        "sns:*",
        "cloudformation:*",
        "rds:*",
        "sqs:*",
        "ecs:*"
    ],
    "Resource": "resource_ARN"
},

對於您要為 CloudWatch Logs 設定的管道，以下是您需要新增至 CodePipeline 服務角色的最低許可。

{
    "Effect": "Allow",
    "Action": [
        "logs:DescribeLogGroups",
        "logs:PutRetentionPolicy"
    ],
    "Resource": "resource_ARN"
},

對於 命令動作支援，請將下列內容新增至您的政策陳述式：

{
    "Effect": "Allow",
    "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
    ],
    "Resource": [
        "arn:aws:logs:*:YOUR_AWS_ACCOUNT_ID:log-group:/aws/codepipeline/YOUR_PIPELINE_NAME",
        "arn:aws:logs:*:YOUR_AWS_ACCOUNT_ID:log-group:/aws/codepipeline/YOUR_PIPELINE_NAME:*"
   ]
}

如需ECRBuildAndPublish動作支援，請將下列項目新增至您的政策陳述式：

{
    "Statement": [
         {
            "Sid": "ECRRepositoryAllResourcePolicy",
            "Effect": "Allow",
            "Action": [
                "ecr:DescribeRepositories",
                "ecr:GetAuthorizationToken",
                "ecr-public:DescribeRepositories",
                "ecr-public:GetAuthorizationToken"
            ],
        "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken",
                "ecr:InitiateLayerUpload",
                "ecr:UploadLayerPart",
                "ecr:CompleteLayerUpload",
                "ecr:PutImage",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchCheckLayerAvailability"
            ],
            "Resource": "PrivateECR_Resource_ARN"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecr-public:GetAuthorizationToken",
                "ecr-public:DescribeRepositories",
                "ecr-public:InitiateLayerUpload",
                "ecr-public:UploadLayerPart",
                "ecr-public:CompleteLayerUpload",
                "ecr-public:PutImage",
                "ecr-public:BatchCheckLayerAvailability",
                "sts:GetServiceBearerToken"
            ],
            "Resource": "PublicECR_Resource_ARN"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sts:GetServiceBearerToken"
            ],
            "Resource": "*"
        }
    ]
}

此外，如果尚未新增命令動作，請將下列許可新增至您的服務角色，以檢視 CloudWatch 日誌。

{
    "Effect": "Allow",
    "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream", 
        "logs:PutLogEvents"
    ],
    "Resource": "resource_ARN"
},

如需InspectorScan動作支援，請將下列項目新增至您的政策陳述式：

{
        "Effect": "Allow",
        "Action": "inspector-scan:ScanSbom",
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "ecr:GetDownloadUrlForLayer",
            "ecr:BatchGetImage",
            "ecr:BatchCheckLayerAvailability"
        ],
        "Resource": "resource_ARN"
    },

此外，如果尚未新增命令動作，請將下列許可新增至您的服務角色，以檢視 CloudWatch 日誌。

{
    "Effect": "Allow",
    "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream", 
        "logs:PutLogEvents"
    ],
    "Resource": "resource_ARN"
},

選擇檢閱政策，確保政策沒有任何錯誤。當政策沒有錯誤時，請選擇套用政策。