Configuring IAM roles for connected accounts
You create roles in AWS Identity and Access Management (IAM) for the account that you want to add to CodeCatalyst. If you are adding a billing account, you do not need to create roles.
In your AWS account, you must have permissions to create roles for the AWS account you want to add to your space. For more information about IAM roles and policies, including IAM references and example policies, see Identity and Access Management and Amazon CodeCatalyst. For more information about the trust policy and service principals used in CodeCatalyst, see Understanding the CodeCatalyst trust model.
In CodeCatalyst, you must be signed in with the Space administrator role to complete the steps to add accounts (and the roles, if applicable) to your space.
You can add roles to your account connections by using one of the following methods.
-
To create a service role that contains the permissions policy and trust policy for the CodeCatalystWorkflowDevelopmentRole-
spaceName
role, see CodeCatalystWorkflowDevelopmentRole-spaceName role. -
For an example of creating a role and adding a policy to create a project from a blueprint, see Creating an IAM role and using the CodeCatalyst trust policy.
-
For a list of sample role policies to use when creating your IAM roles, see Grant access to project AWS resources with IAM roles.
-
For detailed steps to create roles for workflow actions, see the workflow tutorial for that action as follows:
Topics
CodeCatalystWorkflowDevelopmentRole-spaceName
role
You create the developer role as a 1-click role in IAM. You must have the Space administrator or Power user role in the space where you want to add the account. You must also have administrative permissions for the AWS account you want to add.
Before you start the procedure below, you must log in to the AWS Management Console with the same account that you want to add to your CodeCatalyst space. Otherwise, the console will return an unknown account error.
To create and add the CodeCatalyst CodeCatalystWorkflowDevelopmentRole-spaceName
-
Before you start in the CodeCatalyst console, open the AWS Management Console, and then make sure you are logged in with the same AWS account for your space.
Open the CodeCatalyst console at https://codecatalyst.aws/
. -
Navigate to your CodeCatalyst space. Choose Settings, and then choose AWS accounts.
-
Choose the link for the AWS account where you want to create the role. The AWS account details page displays.
-
Choose Manage roles from AWS Management Console.
The Add IAM role to Amazon CodeCatalyst space page opens in the AWS Management Console. This is the Amazon CodeCatalyst spaces page. You might need to log in to access the page.
-
Choose Create CodeCatalyst development administrator role in IAM. This option creates a service role that contains the permissions policy and trust policy for the development role. The role will have a name
CodeCatalystWorkflowDevelopmentRole-
. For more information about the role and role policy, see Understanding the CodeCatalystWorkflowDevelopmentRole-spaceName service role.spaceName
Note
This role is only recommended for use with developer accounts and uses the
AdministratorAccess
AWS managed policy, giving it full access to create new policies and resources in this AWS account. -
Choose Create development role.
-
On the connections page, under IAM roles available to CodeCatalyst, view the
CodeCatalystWorkflowDevelopmentRole-
role in the list of IAM roles added to your account.spaceName
-
To return to your space, choose Go to Amazon CodeCatalyst.
AWSRoleForCodeCatalystSupport role
You create the support role as a 1-click role in IAM. You must have the Space administrator or Power user role in the space where you want to add the account. You must also have administrative permissions for the AWS account you want to add.
Before you start the procedure below, you must log in to the AWS Management Console with the same account that you want to add to your CodeCatalyst space. Otherwise, the console will return an unknown account error.
To create and add the CodeCatalyst AWSRoleForCodeCatalystSupport
-
Before you start in the CodeCatalyst console, open the AWS Management Console, and then make sure you are logged in with the same AWS account for your space.
-
Navigate to your CodeCatalyst space. Choose Settings, and then choose AWS accounts.
-
Choose the link for the AWS account where you want to create the role. The AWS account details page displays.
-
Choose Manage roles from AWS Management Console.
The Add IAM role to Amazon CodeCatalyst space page opens in the AWS Management Console. This is the Amazon CodeCatalyst Spaces page. You might need to sign in to access the page.
-
Under CodeCatalyst space details, choose Add CodeCatalyst Support role. This option creates a service role that contains the permissions policy and trust policy for the preview development role. The role will have a name AWSRoleForCodeCatalystSupport with a unique identifier appended. For more information about the role and role policy, see Understanding the AWSRoleForCodeCatalystSupport service role.
-
On the Add role for CodeCatalyst Support page, leave the default selected, and then choose Create role.
-
Under IAM roles available to CodeCatalyst, view the
CodeCatalystWorkflowDevelopmentRole-
role in the list of IAM roles added to your account.spaceName
-
To return to your space, choose Go to Amazon CodeCatalyst.
Creating an IAM role and using the CodeCatalyst trust policy
IAM roles to be used in CodeCatalyst with AWS account connections must be configured to use the trust policy provided here. Use these steps to create an IAM role and attach a policy that allows you to create projects from blueprints in CodeCatalyst.
As an alternative, you can create a service role that contains the permissions policy
and trust policy for the CodeCatalystWorkflowDevelopmentRole-
role. For more information, see Adding IAM roles to account
connections.spaceName
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/
. -
Choose Roles, and then choose Create role.
-
Choose Custom trust policy.
-
Under the Custom trust policy form, paste the following trust policy.
"Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "codecatalyst-runner.amazonaws.com", "codecatalyst.amazonaws.com" ] }, "Action": "sts:AssumeRole", "Condition": { "ArnLike": { "aws:SourceArn": "arn:aws:codecatalyst:::space/spaceId/project/*" } } } ]
-
Choose Next.
-
Under Add permissions, search for and select a custom policy that you have already created in IAM.
-
Choose Next.
-
For Role name, enter a name for the role, for example:
codecatalyst-project-role
-
Choose Create role.
-
Copy the role Amazon Resource Name (ARN). You'll need to provide this information when adding the role to your account connection or environment.