Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS CodeStar Connections

AWS CodeStar Connections (service prefix: codestar-connections) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS CodeStar Connections
Actions defined by AWS CodeStar Connections
Permission-only actions for AWS CodeStar Connections
Resource types defined by AWS CodeStar Connections
Condition keys for AWS CodeStar Connections

API operations defined by AWS CodeStar Connections

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateConnection	codestar-connections:CreateConnection			Write
	codestar-connections:TagResource			Tagging, Write
	codeconnections:CreateConnection			Write
	codeconnections:TagResource			Tagging, Write
CreateHost	codestar-connections:CreateHost			Write
	codestar-connections:TagResource			Tagging, Write
	codeconnections:CreateHost			Write
	codeconnections:TagResource			Tagging, Write
CreateRepositoryLink	codestar-connections:CreateRepositoryLink			Write
	codestar-connections:PassConnection			Read
	codestar-connections:TagResource			Tagging, Write
	codestar-connections:UseConnection			Read
	codeconnections:CreateRepositoryLink			Write
	codeconnections:PassConnection			Read
	codeconnections:TagResource			Tagging, Write
	codeconnections:UseConnection			Read
CreateSyncConfiguration	codestar-connections:CreateSyncConfiguration			Write
	codestar-connections:PassRepository			Read
	codeconnections:CreateSyncConfiguration			Write
	codeconnections:PassRepository			Read
	iam:PassRole	iam:PassedToService	cloudformation.sync.codeconnections.amazonaws.com	Write
DeleteConnection	codestar-connections:DeleteConnection			Write
DeleteConnection	codeconnections:DeleteConnection			Write
DeleteHost	codestar-connections:DeleteHost			Write
DeleteHost	codeconnections:DeleteHost			Write
DeleteRepositoryLink	codestar-connections:DeleteRepositoryLink			Write
DeleteRepositoryLink	codeconnections:DeleteRepositoryLink			Write
DeleteSyncConfiguration	codestar-connections:DeleteSyncConfiguration			Write
DeleteSyncConfiguration	codeconnections:DeleteSyncConfiguration			Write
GetConnection	codestar-connections:GetConnection			Read
GetConnection	codeconnections:GetConnection			Read
GetHost	codestar-connections:GetHost			Read
GetHost	codeconnections:GetHost			Read
GetRepositoryLink	codestar-connections:GetRepositoryLink			Read
GetRepositoryLink	codeconnections:GetRepositoryLink			Read
GetRepositorySyncStatus	codestar-connections:GetRepositorySyncStatus			Read
GetRepositorySyncStatus	codeconnections:GetRepositorySyncStatus			Read
GetResourceSyncStatus	codestar-connections:GetResourceSyncStatus			Read
GetResourceSyncStatus	codeconnections:GetResourceSyncStatus			Read
GetSyncBlockerSummary	codestar-connections:GetSyncBlockerSummary			Read
GetSyncBlockerSummary	codeconnections:GetSyncBlockerSummary			Read
GetSyncConfiguration	codestar-connections:GetSyncConfiguration			Read
GetSyncConfiguration	codeconnections:GetSyncConfiguration			Read
ListConnections	codestar-connections:ListConnections			List
ListConnections	codeconnections:ListConnections			List
ListHosts	codestar-connections:ListHosts			List
ListHosts	codeconnections:ListHosts			List
ListRepositoryLinks	codestar-connections:ListRepositoryLinks			List
ListRepositoryLinks	codeconnections:ListRepositoryLinks			List
ListRepositorySyncDefinitions	codestar-connections:ListRepositorySyncDefinitions			List
ListRepositorySyncDefinitions	codeconnections:ListRepositorySyncDefinitions			List
ListSyncConfigurations	codestar-connections:ListSyncConfigurations			List
ListSyncConfigurations	codeconnections:ListSyncConfigurations			List
ListTagsForResource	codestar-connections:ListTagsForResource			List
ListTagsForResource	codeconnections:ListTagsForResource			List
TagResource	codestar-connections:TagResource			Tagging, Write
TagResource	codeconnections:TagResource			Tagging, Write
UntagResource	codestar-connections:UntagResource			Tagging, Write
UntagResource	codeconnections:UntagResource			Tagging, Write
UpdateHost	codestar-connections:UpdateHost			Write
UpdateHost	codeconnections:UpdateHost			Write
UpdateRepositoryLink	codestar-connections:PassConnection			Read
	codestar-connections:UpdateRepositoryLink			Write
	codestar-connections:UseConnection			Read
	codeconnections:PassConnection			Read
	codeconnections:UpdateRepositoryLink			Write
	codeconnections:UseConnection			Read
UpdateSyncBlocker	codestar-connections:UpdateSyncBlocker			Write
UpdateSyncBlocker	codeconnections:UpdateSyncBlocker			Write
UpdateSyncConfiguration	codestar-connections:PassRepository			Read
	codestar-connections:UpdateSyncConfiguration			Write
	codeconnections:PassRepository			Read
	codeconnections:UpdateSyncConfiguration			Write
	iam:PassRole	iam:PassedToService	cloudformation.sync.codeconnections.amazonaws.com	Write

Actions defined by AWS CodeStar Connections

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateConnection	Grants permission to create a Connection resource		aws:RequestTag/${TagKey} aws:TagKeys codestar-connections:ProviderType	Write
CreateHost	Grants permission to create a host resource		aws:RequestTag/${TagKey} aws:TagKeys codestar-connections:ProviderType codestar-connections:VpcId	Write
CreateRepositoryLink	Grants permission to create a repository link	Connection*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSyncConfiguration	Grants permission to create a template sync config	RepositoryLink*	aws:ResourceTag/${TagKey} codestar-connections:Branch	Write
DeleteConnection	Grants permission to delete a Connection resource	Connection*	aws:ResourceTag/${TagKey}	Write
DeleteHost	Grants permission to delete a host resource	Host*	aws:ResourceTag/${TagKey}	Write
DeleteRepositoryLink	Grants permission to delete a repository link	RepositoryLink*	aws:ResourceTag/${TagKey}	Write
DeleteSyncConfiguration	Grants permission to delete a sync configuration			Write
GetConnection	Grants permission to get details about a Connection resource	Connection*	aws:ResourceTag/${TagKey}	Read
GetHost	Grants permission to get details about a host resource	Host*	aws:ResourceTag/${TagKey}	Read
GetRepositoryLink	Grants permission to describe a repository link	RepositoryLink*	aws:ResourceTag/${TagKey}	Read
GetRepositorySyncStatus	Grants permission to get the latest sync status for a repository	RepositoryLink*	aws:ResourceTag/${TagKey} codestar-connections:Branch	Read
GetResourceSyncStatus	Grants permission to get the latest sync status for a resource (cfn stack or other resources)			Read
GetSyncBlockerSummary	Grants permission to describe service sync blockers on a resource (cfn stack or other resources)			Read
GetSyncConfiguration	Grants permission to describe a sync configuration			Read
ListConnections	Grants permission to list Connection resources	Connection*	aws:ResourceTag/${TagKey} codestar-connections:ProviderTypeFilter	List
ListHosts	Grants permission to list host resources		codestar-connections:ProviderTypeFilter	List
ListRepositoryLinks	Grants permission to list repository links			List
ListRepositorySyncDefinitions	Grants permission to list repository sync definitions			List
ListSyncConfigurations	Grants permission to list sync configurations for a repository link			List
ListTagsForResource	Grants permission to the set of key-value pairs that are used to manage the resource	Connection	aws:ResourceTag/${TagKey}	List
		Host	aws:ResourceTag/${TagKey}
		RepositoryLink	aws:ResourceTag/${TagKey}
TagResource	Grants permission to add or modify the tags of the given resource	Connection	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		Host	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		RepositoryLink	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from an AWS resource	Connection	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		Host	aws:ResourceTag/${TagKey} aws:TagKeys
		RepositoryLink	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateConnectionInstallation	Grants permission to update a Connection resource with an installation of the CodeStar Connections App	Connection*	aws:ResourceTag/${TagKey} codestar-connections:InstallationId	Write
UpdateHost	Grants permission to update a host resource	Host*	aws:ResourceTag/${TagKey} codestar-connections:VpcId	Write
UpdateRepositoryLink	Grants permission to update a repository link	RepositoryLink*	aws:ResourceTag/${TagKey}	Write
UpdateSyncBlocker	Grants permission to update a sync blocker for a resource (cfn stack or other resources)			Write
UpdateSyncConfiguration	Grants permission to update a sync configuration		codestar-connections:Branch	Write

Permission-only actions for AWS CodeStar Connections

The following actions are defined by AWS CodeStar Connections but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
GetConnectionToken	Grants permission to get a Connection token to call provider actions	Connection*	aws:ResourceTag/${TagKey}	Read
GetIndividualAccessToken	Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection		codestar-connections:ProviderType	Read
GetInstallationUrl	Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection		codestar-connections:ProviderType	Read
ListInstallationTargets	Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection			List
PassConnection	Grants permission to pass a Connection resource to an AWS service that accepts a Connection ARN as input, such as codepipeline:CreatePipeline	Connection*	aws:ResourceTag/${TagKey} codestar-connections:PassedToService	Read
PassRepository	Grants permission to pass a repository link resource to an AWS service that accepts a RepositoryLinkId as input, such as codestar-connections:CreateSyncConfiguration	RepositoryLink*	aws:ResourceTag/${TagKey} codestar-connections:PassedToService	Read
RegisterAppCode	Grants permission to associate a third party server, such as a GitHub Enterprise Server instance, with a Host		codestar-connections:HostArn	Read
StartAppRegistrationHandshake	Grants permission to associate a third party server, such as a GitHub Enterprise Server instance, with a Host		codestar-connections:HostArn	Read
StartOAuthHandshake	Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection		codestar-connections:ProviderType	Read
UseConnection	Grants permission to use a Connection resource to call provider actions	Connection*	aws:ResourceTag/${TagKey} codestar-connections:BranchName codestar-connections:FullRepositoryId codestar-connections:OwnerId codestar-connections:ProviderAction codestar-connections:ProviderPermissionsRequired codestar-connections:RepositoryName	Read

Resource types defined by AWS CodeStar Connections

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Connection	arn:${Partition}:codestar-connections:${Region}:${Account}:connection/${ConnectionId}	aws:ResourceTag/${TagKey}
Host	arn:${Partition}:codestar-connections:${Region}:${Account}:host/${HostId}	aws:ResourceTag/${TagKey}
RepositoryLink	arn:${Partition}:codestar-connections:${Region}:${Account}:repository-link/${RepositoryLinkId}	aws:ResourceTag/${TagKey}

Condition keys for AWS CodeStar Connections

AWS CodeStar Connections defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
codestar-connections:Branch	Filters access by the branch name that is passed in the request	String
codestar-connections:BranchName	Filters access by the branch name that is passed in the request. Applies only to UseConnection requests for access to a specific repository branch	String
codestar-connections:FullRepositoryId	Filters access by the repository that is passed in the request. Applies only to UseConnection requests for access to a specific repository	String
codestar-connections:HostArn	Filters access by the host resource associated with the connection used in the request	ARN
codestar-connections:InstallationId	Filters access by the third-party ID (such as the Bitbucket App installation ID for CodeStar Connections) that is used to update a Connection. Allows you to restrict which third-party App installations can be used to make a Connection	String
codestar-connections:OwnerId	Filters access by the owner of the third-party repository. Applies only to UseConnection requests for access to repositories owned by a specific user	String
codestar-connections:PassedToService	Filters access by the service to which the principal is allowed to pass a Connection or RepositoryLink	String
codestar-connections:ProviderAction	Filters access by the provider action in a UseConnection request such as ListRepositories. See documentation for all valid values	String
codestar-connections:ProviderPermissionsRequired	Filters access by the write permissions of a provider action in a UseConnection request. Valid types include read_only and read_write	String
codestar-connections:ProviderType	Filters access by the type of third-party provider passed in the request	String
codestar-connections:ProviderTypeFilter	Filters access by the type of third-party provider used to filter results	String
codestar-connections:RepositoryName	Filters access by the repository name that is passed in the request. Applies only to UseConnection requests for access to repositories owned by a specific user	String
codestar-connections:VpcId	Filters access by the VpcId passed in the request	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS CodeStar (codestar)

AWS CodeStar Notifications (codestar-notifications)