Actions, resources, and condition keys for AWS Continuum

AWS Continuum (service prefix: continuum) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

• View the programmatic service authorization reference for this service.

Actions defined by AWS Continuum

You can specify the following actions in the Action element of an IAM policy statement. For each action, the table lists the resource types and condition keys supported by that action. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateCollector	Grants permission to associate a collector with an environment	environments*	continuum:CollectorArn	Write
CreateCodeFinding	Grants permission to create a code finding in an environment	code-findings*		Write
		environments*
CreateCodeScan	Grants permission to start a code scan of an environment	code-scans*		Write
		environments*
CreateCollector	Grants permission to create a collector	collectors*		Write
CreateEnvironment	Grants permission to create an environment	environments*	continuum:RepositoryName	Write
		integrations	continuum:RepositoryName
CreateIntegration	Grants permission to create an integration with an external source provider	integrations*	continuum:S3BucketName	Write
DeleteCollector	Grants permission to delete a collector	collectors*		Write
DeleteEnvironment	Grants permission to delete an environment	environments*		Write
DeleteIntegration	Grants permission to delete an integration	integrations*		Write
DisassociateCollector	Grants permission to disassociate a collector from an environment	environments*	continuum:CollectorArn	Write
GetCodeFinding	Grants permission to get a code finding	code-findings*		Read
GetCodeIssue	Grants permission to get a code issue	code-issues*		Read
GetCodeIssueArtifact	Grants permission to get an artifact of a code issue	code-issues*		Read
GetCodeScan	Grants permission to get a code scan	code-scans*		Read
GetCollector	Grants permission to get a collector	collectors*		Read
GetCollectorDataAccessAuthorization	Grants permission to access the data of a collector from an environment	collectors*	continuum:EnvironmentArn	Read
GetEnvironment	Grants permission to get an environment	environments*		Read
GetIntegration	Grants permission to get an integration	integrations*		Read
GetResourcePolicy	Grants permission to get the resource policy attached to a resource	collectors*		Read
ListAssociatedCollectors	Grants permission to list the collectors associated with an environment	environments*		List
ListAssociatedEnvironments	Grants permission to list the environments associated with a collector	collectors*		List
ListCodeFindings	Grants permission to list the code findings in an environment	environments*		List
ListCodeIssueArtifacts	Grants permission to list the artifacts of a code issue	code-issues*		List
ListCodeIssues	Grants permission to list the code issues in an environment	environments*		List
ListCodeScans	Grants permission to list the code scans of an environment	environments*		List
ListCollectors	Grants permission to list collectors	collectors*		List
ListEnvironments	Grants permission to list environments	environments*		List
ListIntegrations	Grants permission to list integrations	integrations*		List
PutResourcePolicy	Grants permission to attach a resource policy to a resource	collectors*		Write
StartIntegrationAuthorization	Grants permission to start an OAuth authorization for a new integration			Write
UpdateCollector	Grants permission to update a collector	collectors*		Write
UpdateEnvironment	Grants permission to update an environment	environments*	continuum:RepositoryName	Write
		integrations	continuum:RepositoryName
UpdateIntegration	Grants permission to update the IAM role of an Amazon S3 integration	integrations*		Write

Resource types defined by AWS Continuum

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
code-findings	arn:${Partition}:continuum:${Region}:${Account}:environments/${EnvironmentId}/code-findings/${FindingId}
code-issues	arn:${Partition}:continuum:${Region}:${Account}:environments/${EnvironmentId}/code-issues/${IssueId}
code-scans	arn:${Partition}:continuum:${Region}:${Account}:environments/${EnvironmentId}/code-scans/${ScanRunId}
collectors	arn:${Partition}:continuum:${Region}:${Account}:collectors/${CollectorId}
environments	arn:${Partition}:continuum:${Region}:${Account}:environments/${EnvironmentId}
integrations	arn:${Partition}:continuum:${Region}:${Account}:integrations/${IntegrationId}

Condition keys for AWS Continuum

AWS Continuum defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
continuum:CollectorArn	Filters access by the ARNs of the collectors in an AssociateCollector or DisassociateCollector request	ArrayOfARN
continuum:EnvironmentArn	Filters access by the ARN of the environment that requests access to the data of a collector	ARN
continuum:RepositoryName	Filters access by the repositories, as lowercase owner/repo values, that a CreateEnvironment or UpdateEnvironment request selects as sources	ArrayOfString
continuum:S3BucketName	Filters access by the name of the Amazon S3 bucket in a CreateIntegration request	String