AWS CodeBuild 的動作、資源和條件索引鍵

AWS CodeBuild （服務字首：codebuild) 提供下列服務特定的操作、資源、動作和條件索引鍵，可用於 IAM 許可政策。

參考資料：

• 了解如何設定此服務。

• 檢視可供此服務使用的 API 操作清單。

• 了解如何使用 IAM 許可政策來保護此服務及其資源。

• 檢視此服務的程式設計服務授權參考。

AWS CodeBuild 定義的 API 操作

下表將 API 操作映射至其授權的 IAM 動作。只會列出具有指定 API 和動作靜態值的條件金鑰；如需每個動作支援的完整條件金鑰集，請參閱動作表格。

作業	IAM 動作	條件鍵	可能的值 (s)	存取層級
BatchDeleteBuilds	codebuild：BatchDeleteBuilds			寫入
BatchGetBuildBatches	codebuild：BatchGetBuildBatches			讀取
BatchGetBuilds	codebuild：BatchGetBuilds			讀取
BatchGetCommandExecutions	codebuild：BatchGetCommandExecutions			讀取
BatchGetFleets	codebuild：BatchGetFleets			讀取
BatchGetProjects	codebuild：BatchGetProjects			讀取
BatchGetReportGroups	codebuild：BatchGetReportGroups			讀取
BatchGetReports	codebuild：BatchGetReports			讀取
BatchGetSandboxes	codebuild：BatchGetSandboxes			讀取
CreateFleet	codebuild：CreateFleet			寫入
	iam：PassRole			寫入
CreateProject	codebuild：CreateProject			寫入
	iam：PassRole	iam:PassedToService	codebuild.amazonaws.com	寫入
CreateReportGroup	codebuild：CreateReportGroup			寫入
CreateWebhook	codebuild：CreateWebhook			寫入
DeleteBuildBatch	codebuild：DeleteBuildBatch			寫入
DeleteFleet	codebuild：DeleteFleet			寫入
DeleteProject	codebuild：DeleteProject			寫入
DeleteReport	codebuild：DeleteReport			寫入
DeleteReportGroup	codebuild：DeleteReportGroup			寫入
DeleteResourcePolicy	codebuild：DeleteResourcePolicy			許可管理、寫入
DeleteSourceCredentials	codebuild：DeleteSourceCredentials			寫入
DeleteWebhook	codebuild：DeleteWebhook			寫入
DescribeCodeCoverages	codebuild：DescribeCodeCoverages			讀取
DescribeTestCases	codebuild：DescribeTestCases			讀取
GetReportGroupTrend	codebuild：GetReportGroupTrend			讀取
GetResourcePolicy	codebuild：GetResourcePolicy			讀取
ImportSourceCredentials	codebuild：ImportSourceCredentials			寫入
InvalidateProjectCache	codebuild：InvalidateProjectCache			寫入
ListBuildBatches	codebuild：ListBuildBatches			清單
ListBuildBatchesForProject	codebuild：ListBuildBatchesForProject			清單
ListBuilds	codebuild：ListBuilds			清單
ListBuildsForProject	codebuild：ListBuildsForProject			清單
ListCommandExecutionsForSandbox	codebuild：ListCommandExecutionsForSandbox			清單
ListCuratedEnvironmentImages	codebuild：ListCuratedEnvironmentImages			清單
ListFleets	codebuild：ListFleets			清單
ListProjects	codebuild：ListProjects			清單
ListReportGroups	codebuild：ListReportGroups			清單
ListReports	codebuild：ListReports			清單
ListReportsForReportGroup	codebuild：ListReportsForReportGroup			清單
ListSandboxes	codebuild：ListSandboxes			清單
ListSandboxesForProject	codebuild：ListSandboxesForProject			清單
ListSharedProjects	codebuild：ListSharedProjects			清單
ListSharedReportGroups	codebuild：ListSharedReportGroups			清單
ListSourceCredentials	codebuild：ListSourceCredentials			清單
PutResourcePolicy	codebuild：PutResourcePolicy			許可管理、寫入
RetryBuild	codebuild：RetryBuild			寫入
RetryBuildBatch	codebuild：RetryBuildBatch			寫入
StartBuild	codebuild：StartBuild			寫入
	iam：PassRole	iam:PassedToService	codebuild.amazonaws.com	寫入
StartBuildBatch	codebuild：StartBuildBatch			寫入
	iam：PassRole	iam:PassedToService	codebuild.amazonaws.com	寫入
StartCommandExecution	codebuild：StartCommandExecution			寫入
StartSandbox	codebuild：StartSandbox			寫入
StartSandboxConnection	codebuild：StartSandboxConnection			寫入
StopBuild	codebuild：StopBuild			寫入
StopBuildBatch	codebuild：StopBuildBatch			寫入
StopSandbox	codebuild：StopSandbox			寫入
UpdateFleet	codebuild：UpdateFleet			寫入
	iam：PassRole			寫入
UpdateProject	codebuild：UpdateProject			寫入
	iam：PassRole	iam:PassedToService	codebuild.amazonaws.com	寫入
UpdateProjectVisibility	codebuild：UpdateProjectVisibility			寫入
	iam：PassRole	iam:PassedToService	codebuild.amazonaws.com	寫入
UpdateReportGroup	codebuild：UpdateReportGroup			寫入
UpdateWebhook	codebuild：UpdateWebhook			寫入

AWS CodeBuild 定義的動作

您可在 IAM 政策陳述式的 Action 元素中指定以下動作。使用政策來授予在 AWS中執行操作的許可。在政策中使用動作時，通常會允許或拒絕存取相同名稱的 API 操作或 CLI 命令。不過，在某些情況下，單一動作可控制對多個操作的存取。或者，某些操作需要多種不同的動作。

動作	說明	資源類型 (*必填項目)	條件索引鍵	存取層級
BatchDeleteBuilds	准許刪除一或多個建置	專案*	aws：ResourceTag/${TagKey}	寫入
BatchGetBuildBatches	准許取得關於一或多個建置批次的資訊	專案*	aws：ResourceTag/${TagKey}	讀取
BatchGetBuilds	准許取得關於一或多個建置的資訊	專案*	aws：ResourceTag/${TagKey}	讀取
BatchGetCommandExecutions	准許取得一或多個命令執行的相關資訊	沙盒*		讀取
BatchGetFleets	准許傳回輸入參數指定的機群物件陣列	機群*		讀取
BatchGetProjects	准許取得關於一或多個建置專案的資訊	專案*	aws：ResourceTag/${TagKey}	讀取
BatchGetReportGroups	准許傳回由輸入 reportGroupArns 參數指定的 ReportGroup 物件的陣列	report-group*	aws：ResourceTag/${TagKey}	讀取
BatchGetReports	准許傳回由輸入 reportArns 參數指定的 Report 物件的陣列	report-group*	aws：ResourceTag/${TagKey}	讀取
BatchGetSandboxes	准許取得一或多個沙盒的相關資訊	專案*	aws：ResourceTag/${TagKey}	讀取
CreateFleet	准許建立運算機群	機群*	aws：RequestTag/${TagKey} aws:TagKeys codebuild：computeConfiguration codebuild：computeConfiguration.disk codebuild：computeConfiguration.instanceType codebuild：computeConfiguration.machineType codebuild：computeConfiguration.memory codebuild：computeConfiguration.vCpu codebuild：computeType codebuild：environmentType codebuild：fleetServiceRole codebuild：imageId codebuild：vpcConfig codebuild：vpcConfig.securityGroupIds codebuild：vpcConfig.subnets codebuild：vpcConfig.vpcId	寫入
CreateProject	准許建立建置專案	專案*	aws：RequestTag/${TagKey} aws：ResourceTag/${TagKey} aws:TagKeys codebuild：artifacts codebuild：artifacts.bucketOwnerAccess codebuild：artifacts.encryptionDisabled codebuild：artifacts.location codebuild：autoRetryLimit codebuild：buildBatchConfig codebuild：buildBatchConfig.restrictions.computeTypesAllowed codebuild：buildBatchConfig.restrictions.fleetsAllowed codebuild：buildBatchConfig.serviceRole codebuild：cache codebuild：cache.location codebuild：cache.modes codebuild：cache.type codebuild：concurrentBuildLimit codebuild：encryptionKey codebuild：environment codebuild：environment.certificate codebuild：environment.computeConfiguration codebuild：environment.computeConfiguration.disk codebuild：environment.computeConfiguration.instanceType codebuild：environment.computeConfiguration.machineType codebuild：environment.computeConfiguration.memory codebuild：environment.computeConfiguration.vCpu codebuild：environment.computeType codebuild：environment.environmentVariables Codebuild：https：//environment.environmentVariables.name codebuild：environment.environmentVariables.value codebuild：environment.environmentVariables/${name}.value codebuild：environment.fleet.fleetArn codebuild：environment.image codebuild：environment.imagePullCredentialsType codebuild：environment.privilegedMode codebuild：environment.registryCredential codebuild：environment.registryCredential.credential codebuild：environment.registryCredential.credentialProvider codebuild：environment.type codebuild：fileSystemLocations.identifier codebuild：fileSystemLocations.location codebuild：fileSystemLocations.type codebuild：fileSystemLocations/${identifier}.location codebuild：fileSystemLocations/${identifier}.type codebuild：logsConfig codebuild：logsConfig.s3Logs codebuild：logsConfig.s3Logs.bucketOwnerAccess codebuild：logsConfig.s3Logs.encryptionDisabled codebuild：logsConfig.s3Logs.location codebuild：logsConfig.s3Logs.status codebuild：secondaryArtifacts codebuild：secondaryArtifacts.artifactIdentifier codebuild：secondaryArtifacts.bucketOwnerAccess codebuild：secondaryArtifacts.encryptionDisabled codebuild：secondaryArtifacts.location codebuild：secondaryArtifacts/${artifactIdentifier}.bucketOwnerAccess codebuild：secondaryArtifacts/${artifactIdentifier}.encryptionDisabled codebuild：secondaryArtifacts/${artifactIdentifier}.location codebuild：secondarySources codebuild：secondarySources.auth.resource codebuild：secondarySources.auth.type codebuild：secondarySources.buildspec codebuild：secondarySources.buildStatusConfig.context codebuild：secondarySources.buildStatusConfig.targetUrl codebuild：secondarySources.insecureSsl codebuild：secondarySources.location codebuild：secondarySources.sourceIdentifier codebuild：secondarySources/${sourceIdentifier}.auth.resource codebuild：secondarySources/${sourceIdentifier}.auth.type codebuild：secondarySources/${sourceIdentifier}.buildspec codebuild：secondarySources/${sourceIdentifier}.buildStatusConfig.context codebuild：secondarySources/${sourceIdentifier}.buildStatusConfig.targetUrl codebuild：secondarySources/${sourceIdentifier}.insecureSsl codebuild：secondarySources/${sourceIdentifier}.location codebuild：serviceRole codebuild：source codebuild：source.auth.resource codebuild：source.auth.type codebuild：source.buildspec codebuild：source.buildStatusConfig.context codebuild：source.buildStatusConfig.targetUrl codebuild：source.insecureSsl codebuild：source.location codebuild：vpcConfig codebuild：vpcConfig.securityGroupIds codebuild：vpcConfig.subnets codebuild：vpcConfig.vpcId	寫入
CreateReportGroup	准許建立報告群組	report-group*	aws：RequestTag/${TagKey} aws：ResourceTag/${TagKey} aws:TagKeys codebuild：exportConfig.s3Destination.bucket codebuild：exportConfig.s3Destination.bucketOwner codebuild：exportConfig.s3Destination.encryptionDisabled codebuild：exportConfig.s3Destination.encryptionKey codebuild：exportConfig.s3Destination.path	寫入
CreateWebhook	准許建立 Webhook。對於在 GitHub 或 Bitbucket 儲存庫中存放其原始碼的現有 AWS CodeBuild 組建專案， 可讓 AWS CodeBuild 在每次程式碼變更推送至儲存庫時開始重建原始碼	專案*	aws：ResourceTag/${TagKey} codebuild：buildType codebuild：manualCreation codebuild：scopeConfiguration.domain codebuild：scopeConfiguration.name codebuild：scopeConfiguration.scope	寫入
DeleteBuildBatch	准許刪除建置批次	專案*	aws：ResourceTag/${TagKey}	寫入
DeleteFleet	准許刪除運算機群	機群*		寫入
DeleteProject	准許刪除建置專案	專案*	aws：ResourceTag/${TagKey}	寫入
DeleteReport	准許刪除報告	report-group*	aws：ResourceTag/${TagKey}	寫入
DeleteReportGroup	准許刪除報告群組	report-group*	aws：ResourceTag/${TagKey}	寫入
DeleteResourcePolicy	准許刪除相關聯專案或報告群組的資源政策	project	aws：ResourceTag/${TagKey}	許可管理、寫入
		report-group	aws：ResourceTag/${TagKey}
DeleteSourceCredentials	准許刪除一組 GitHub、GitHub Enterprise 或 Bitbucket 來源憑證			寫入
DeleteWebhook	准許刪除 Webhook。對於其原始程式碼存放在 GitHub 或 Bitbucket 儲存庫中的現有 AWS CodeBuild 組建專案，stop AWS CodeBuild 不會在每次程式碼變更推送至儲存庫時重建原始程式碼	專案*	aws：ResourceTag/${TagKey}	寫入
DescribeCodeCoverages	准許傳回 CodeCoverage 物件的陣列	report-group*	aws：ResourceTag/${TagKey}	讀取
DescribeTestCases	准許傳回 TestCase 物件的陣列	report-group*	aws：ResourceTag/${TagKey}	讀取
GetReportGroupTrend	准許分析和累積測試報告在指定報告群組中的測試報告值	report-group*	aws：ResourceTag/${TagKey}	讀取
GetResourcePolicy	准許傳回所指定專案或報告群組的資源政策	project	aws：ResourceTag/${TagKey}	讀取
		report-group	aws：ResourceTag/${TagKey}
ImportSourceCredentials	准許匯入其原始碼存放在 GitHub、GitHub Enterprise 或 Bitbucket 儲存庫中的 AWS CodeBuild 專案的來源儲存庫登入資料		codebuild：authType codebuild：serverType codebuild：shouldOverwrite codebuild：token codebuild：username	寫入
InvalidateProjectCache	准許重設專案的快取	專案*	aws：ResourceTag/${TagKey}	寫入
ListBuildBatches	准許取得建置批次 ID 清單，每個建置批次 ID 代表單一建置批次			清單
ListBuildBatchesForProject	准許取得特定建置專案的建置批次 ID 清單，每個建置批次 ID 代表單一建置批次	專案*	aws：ResourceTag/${TagKey}	清單
ListBuilds	准許取得建置 ID 清單，每個建置 ID 代表單一建置			清單
ListBuildsForProject	取得特定建置專案的建置 ID 清單，每個建置 ID 代表單一建置	專案*	aws：ResourceTag/${TagKey}	清單
ListCommandExecutionsForSandbox	准許取得指定沙盒的命令執行 IDs 清單，每個命令執行 ID 代表單一命令執行	沙盒*		清單
ListCuratedEnvironmentImages	准許取得由 AWS CodeBuild 管理之 Docker 映像的相關資訊			清單
ListFleets	准許取得運算機群 ARNs 的清單，每個運算機群 ARN 代表單一機群			清單
ListProjects	准許取得建置專案名稱的清單，每個建置專案名稱代表單一建置專案			清單
ListReportGroups	准許傳回報告群組 ARN 的清單。每個報告群組 ARN 代表一個報告群組			清單
ListReports	准許傳回報告 ARN 的清單。每個報告 ARN 代表一個報告			清單
ListReportsForReportGroup	准許傳回屬於所指定報告群組的報告 ARN 清單。每個報告 ARN 代表一個報告	report-group*	aws：ResourceTag/${TagKey}	清單
ListSandboxes	准許取得沙盒 IDs 清單，每個沙盒 ID 代表單一沙盒			清單
ListSandboxesForProject	准許取得指定沙盒專案的沙盒 IDs 清單，每個沙盒 ID 代表單一沙盒	專案*	aws：ResourceTag/${TagKey}	清單
ListSharedProjects	准許傳回已與申請者共用的專案 ARN 清單。每個專案 ARN 代表一個專案			清單
ListSharedReportGroups	准許傳回已與申請者共用的報告群組 ARN 清單。每個報告群組 ARN 代表一個報告群組			清單
ListSourceCredentials	准許傳回 SourceCredentialsInfo 物件的清單			清單
PutResourcePolicy	准許建立相關聯專案或報告群組的資源政策	project	aws：ResourceTag/${TagKey}	許可管理、寫入
		report-group	aws：ResourceTag/${TagKey}
RetryBuild	准許重試建置	專案*	aws：ResourceTag/${TagKey}	寫入
RetryBuildBatch	准許重試建置批次	專案*	aws：ResourceTag/${TagKey}	寫入
StartBuild	准許開始執行建置	專案*	aws：ResourceTag/${TagKey} codebuild：artifacts codebuild：artifacts.bucketOwnerAccess codebuild：artifacts.encryptionDisabled codebuild：artifacts.location codebuild：autoRetryLimit codebuild：cache codebuild：cache.location codebuild：cache.modes codebuild：cache.type codebuild：encryptionKey codebuild：環境 codebuild：environment.certificate codebuild：environment.computeType codebuild：environment.environmentVariables 程式碼建置：https：//environment.environmentVariables.name codebuild：environment.environmentVariables.value codebuild：environment.environmentVariables/${name}.value codebuild：environment.fleet.fleetArn codebuild：environment.image codebuild：environment.imagePullCredentialsType codebuild：environment.privilegedMode codebuild：environment.registryCredential codebuild：environment.registryCredential.credential codebuild：environment.registryCredential.credentialProvider codebuild：environment.type codebuild：logsConfig codebuild：logsConfig.s3Logs codebuild：logsConfig.s3Logs.bucketOwnerAccess codebuild：logsConfig.s3Logs.encryptionDisabled codebuild：logsConfig.s3Logs.location codebuild：logsConfig.s3Logs.status codebuild：secondaryArtifacts codebuild：secondaryArtifacts.artifactIdentifier codebuild：secondaryArtifacts.bucketOwnerAccess codebuild：secondaryArtifacts.encryptionDisabled codebuild：secondaryArtifacts.location codebuild：secondaryArtifacts/${artifactIdentifier}.bucketOwnerAccess codebuild：secondaryArtifacts/${artifactIdentifier}.encryptionDisabled codebuild：secondaryArtifacts/${artifactIdentifier}.location codebuild：secondarySources codebuild：secondarySources.auth.resource codebuild：secondarySources.auth.type codebuild：secondarySources.buildspec codebuild：secondarySources.buildStatusConfig.context codebuild：secondarySources.buildStatusConfig.targetUrl codebuild：secondarySources.insecureSsl codebuild：secondarySources.location codebuild：secondarySources.sourceIdentifier codebuild：secondarySources/${sourceIdentifier}.auth.resource codebuild：secondarySources/${sourceIdentifier}.auth.type codebuild：secondarySources/${sourceIdentifier}.buildspec codebuild：secondarySources/${sourceIdentifier}.buildStatusConfig.context codebuild：secondarySources/${sourceIdentifier}.buildStatusConfig.targetUrl codebuild：secondarySources/${sourceIdentifier}.insecureSsl codebuild：secondarySources/${sourceIdentifier}.location codebuild：serviceRole codebuild：source codebuild：source.auth.resource codebuild：source.auth.type codebuild：source.buildspec codebuild：source.buildStatusConfig.context codebuild：source.buildStatusConfig.targetUrl codebuild：source.insecureSsl codebuild：source.location	寫入
StartBuildBatch	准許開始執行建置批次	專案*	aws：ResourceTag/${TagKey} codebuild：artifacts codebuild：artifacts.bucketOwnerAccess codebuild：artifacts.encryptionDisabled codebuild：artifacts.location codebuild：buildBatchConfig codebuild：buildBatchConfig.restrictions.computeTypesAllowed codebuild：buildBatchConfig.restrictions.fleetsAllowed codebuild：buildBatchConfig.serviceRole codebuild：cache codebuild：cache.location codebuild：cache.modes codebuild：cache.type codebuild：encryptionKey codebuild：environment codebuild：environment.certificate codebuild：environment.computeType codebuild：environment.environmentVariables Codebuild：https：//environment.environmentVariables.name codebuild：environment.environmentVariables.value codebuild：environment.environmentVariables/${name}.value codebuild：environment.image codebuild：environment.imagePullCredentialsType codebuild：environment.privilegedMode codebuild：environment.registryCredential codebuild：environment.registryCredential.credential codebuild：environment.registryCredential.credentialProvider codebuild：environment.type codebuild：logsConfig codebuild：logsConfig.s3Logs codebuild：logsConfig.s3Logs.bucketOwnerAccess codebuild：logsConfig.s3Logs.encryptionDisabled codebuild：logsConfig.s3Logs.location codebuild：logsConfig.s3Logs.status codebuild：secondaryArtifacts codebuild：secondaryArtifacts.artifactIdentifier codebuild：secondaryArtifacts.bucketOwnerAccess codebuild：secondaryArtifacts.encryptionDisabled codebuild：secondaryArtifacts.location codebuild：secondaryArtifacts/${artifactIdentifier}.bucketOwnerAccess codebuild：secondaryArtifacts/${artifactIdentifier}.encryptionDisabled codebuild：secondaryArtifacts/${artifactIdentifier}.location codebuild：secondarySources codebuild：secondarySources.auth.resource codebuild：secondarySources.auth.type codebuild：secondarySources.buildspec codebuild：secondarySources.buildStatusConfig.context codebuild：secondarySources.buildStatusConfig.targetUrl codebuild：secondarySources.insecureSsl codebuild：secondarySources.location codebuild：secondarySources.sourceIdentifier codebuild：secondarySources/${sourceIdentifier}.auth.resource codebuild：secondarySources/${sourceIdentifier}.auth.type codebuild：secondarySources/${sourceIdentifier}.buildspec codebuild：secondarySources/${sourceIdentifier}.buildStatusConfig.context codebuild：secondarySources/${sourceIdentifier}.buildStatusConfig.targetUrl codebuild：secondarySources/${sourceIdentifier}.insecureSsl codebuild：secondarySources/${sourceIdentifier}.location codebuild：serviceRole codebuild：source codebuild：source.auth.resource codebuild：source.auth.type codebuild：source.buildspec codebuild：source.insecureSsl codebuild：source.location	寫入
StartCommandExecution	准許開始執行命令	沙盒*		寫入
StartSandbox	准許開始執行沙盒	專案*	aws：ResourceTag/${TagKey}	寫入
StartSandboxConnection	准許建立與沙盒的連線	沙盒*		寫入
StopBuild	准許嘗試停止執行建置	專案*	aws：ResourceTag/${TagKey}	寫入
StopBuildBatch	准許嘗試停止執行建置批次	專案*	aws：ResourceTag/${TagKey}	寫入
StopSandbox	准許嘗試停止執行沙盒	專案*	aws：ResourceTag/${TagKey}	寫入
UpdateFleet	准許變更現有運算機群的設定	機群*	aws：RequestTag/${TagKey} aws:TagKeys codebuild：computeConfiguration codebuild：computeConfiguration.disk codebuild：computeConfiguration.instanceType codebuild：computeConfiguration.machineType codebuild：computeConfiguration.memory codebuild：computeConfiguration.vCpu codebuild：computeType codebuild：environmentType codebuild：fleetServiceRole codebuild：imageId codebuild：vpcConfig codebuild：vpcConfig.securityGroupIds codebuild：vpcConfig.subnets codebuild：vpcConfig.vpcId	寫入
UpdateProject	准許變更現有建置專案的設定	專案*	aws：RequestTag/${TagKey} aws：ResourceTag/${TagKey} aws:TagKeys codebuild：artifacts codebuild：artifacts.bucketOwnerAccess codebuild：artifacts.encryptionDisabled codebuild：artifacts.location codebuild：autoRetryLimit codebuild：buildBatchConfig codebuild：buildBatchConfig.restrictions.computeTypesAllowed codebuild：buildBatchConfig.restrictions.fleetsAllowed codebuild：buildBatchConfig.serviceRole codebuild：cache codebuild：cache.location codebuild：cache.modes codebuild：cache.type codebuild：concurrentBuildLimit codebuild：encryptionKey codebuild：environment codebuild：environment.certificate codebuild：environment.computeConfiguration codebuild：environment.computeConfiguration.disk codebuild：environment.computeConfiguration.instanceType codebuild：environment.computeConfiguration.machineType codebuild：environment.computeConfiguration.memory codebuild：environment.computeConfiguration.vCpu codebuild：environment.computeType codebuild：environment.environmentVariables Codebuild：https：//environment.environmentVariables.name codebuild：environment.environmentVariables.value codebuild：environment.environmentVariables/${name}.value codebuild：environment.fleet.fleetArn codebuild：environment.image codebuild：environment.imagePullCredentialsType codebuild：environment.privilegedMode codebuild：environment.registryCredential codebuild：environment.registryCredential.credential codebuild：environment.registryCredential.credentialProvider codebuild：environment.type codebuild：fileSystemLocations.identifier codebuild：fileSystemLocations.location codebuild：fileSystemLocations.type codebuild：fileSystemLocations/${identifier}.location codebuild：fileSystemLocations/${identifier}.type codebuild：logsConfig codebuild：logsConfig.s3Logs codebuild：logsConfig.s3Logs.bucketOwnerAccess codebuild：logsConfig.s3Logs.encryptionDisabled codebuild：logsConfig.s3Logs.location codebuild：logsConfig.s3Logs.status codebuild：secondaryArtifacts codebuild：secondaryArtifacts.artifactIdentifier codebuild：secondaryArtifacts.bucketOwnerAccess codebuild：secondaryArtifacts.encryptionDisabled codebuild：secondaryArtifacts.location codebuild：secondaryArtifacts/${artifactIdentifier}.bucketOwnerAccess codebuild：secondaryArtifacts/${artifactIdentifier}.encryptionDisabled codebuild：secondaryArtifacts/${artifactIdentifier}.location codebuild：secondarySources codebuild：secondarySources.auth.resource codebuild：secondarySources.auth.type codebuild：secondarySources.buildspec codebuild：secondarySources.buildStatusConfig.context codebuild：secondarySources.buildStatusConfig.targetUrl codebuild：secondarySources.insecureSsl codebuild：secondarySources.location codebuild：secondarySources.sourceIdentifier codebuild：secondarySources/${sourceIdentifier}.auth.resource codebuild：secondarySources/${sourceIdentifier}.auth.type codebuild：secondarySources/${sourceIdentifier}.buildspec codebuild：secondarySources/${sourceIdentifier}.buildStatusConfig.context codebuild：secondarySources/${sourceIdentifier}.buildStatusConfig.targetUrl codebuild：secondarySources/${sourceIdentifier}.insecureSsl codebuild：secondarySources/${sourceIdentifier}.location codebuild：serviceRole codebuild：source codebuild：source.auth.resource codebuild：source.auth.type codebuild：source.buildspec codebuild：source.buildStatusConfig.context codebuild：source.buildStatusConfig.targetUrl codebuild：source.insecureSsl codebuild：source.location codebuild：vpcConfig codebuild：vpcConfig.securityGroupIds codebuild：vpcConfig.subnets codebuild：vpcConfig.vpcId	寫入
UpdateProjectVisibility	准許變更專案及其建置的公有可見性	專案*	aws：RequestTag/${TagKey} aws：ResourceTag/${TagKey} aws:TagKeys codebuild：projectVisibility	寫入
UpdateReportGroup	准許變更現有報告群組的設定	report-group*	aws：RequestTag/${TagKey} aws：ResourceTag/${TagKey} aws:TagKeys codebuild：exportConfig.s3Destination.bucket codebuild：exportConfig.s3Destination.bucketOwner codebuild：exportConfig.s3Destination.encryptionDisabled codebuild：exportConfig.s3Destination.encryptionKey codebuild：exportConfig.s3Destination.path	寫入
UpdateWebhook	准許更新與 an AWS CodeBuild 組建專案相關聯的 Webhook	專案*	aws：ResourceTag/${TagKey} codebuild：buildType codebuild：manualCreation codebuild：scopeConfiguration.domain codebuild：scopeConfiguration.name codebuild：scopeConfiguration.scope	寫入

AWS CodeBuild 的僅限許可動作

下列動作是由 AWS CodeBuild 定義，但無法透過任何 API 操作直接叫用。它們只能在 IAM 政策陳述式中使用，以授予或拒絕許可。

動作	說明	資源類型 (*必填項目)	條件索引鍵	存取層級
BatchPutCodeCoverages	准許新增或更新報告的資訊	report-group*	aws：ResourceTag/${TagKey}	寫入
BatchPutTestCases	准許新增或更新報告的資訊	report-group*	aws：ResourceTag/${TagKey}	寫入
CreateReport	准許建立新報告。在建置專案期間，針對報告群組執行 buildspec 檔案中指定的測試時，將會建立報告	report-group*	aws：ResourceTag/${TagKey}	寫入
DeleteOAuthToken	准許從連接的第三方 OAuth 提供者刪除 OAuth 權杖。僅在 AWS CodeBuild 主控台中使用			寫入
ListConnectedOAuthAccounts	准許列出連接的第三方 OAuth 提供者。僅在 AWS CodeBuild 主控台中使用			清單
ListRepositories	准許列出來自連接的第三方 OAuth 提供者的原始程式碼儲存庫。僅在 AWS CodeBuild 主控台中使用			清單
PersistOAuthToken	准許儲存來自連接的第三方 OAuth 提供者的 OAuth 權杖。僅在 AWS CodeBuild 主控台中使用			寫入
UpdateReport	准許更新報告的相關資訊	report-group*	aws：ResourceTag/${TagKey}	寫入

AWS CodeBuild 定義的資源類型

此服務會定義下列資源類型，並可用在 IAM 許可政策陳述式的 Resource 元素中。

資源類型	ARN	條件索引鍵
組建	arn：${Partition}：codebuild：${Region}：${Account}：build/${BuildId}
build-batch	arn：${Partition}：codebuild：${Region}：${Account}：build-batch/${BuildBatchId}
機群	arn：${Partition}：codebuild：${Region}：${Account}：fleet/${FleetName}：${FleetId}
專案	arn：${Partition}：codebuild：${Region}：${Account}：project/${ProjectName}	aws：ResourceTag/${TagKey}
報告	arn：${Partition}：codebuild：${Region}：${Account}：report/${ReportGroupName}：${ReportId}
report-group	arn：${Partition}：codebuild：${Region}：${Account}：report-group/${ReportGroupName}	aws：ResourceTag/${TagKey}
沙盒	arn：${Partition}：codebuild：${Region}：${Account}：sandbox/${SandboxId}

AWS CodeBuild 的條件索引鍵

AWS CodeBuild 定義下列條件索引鍵，可用於 IAM 政策的 Condition元素。

條件索引鍵	描述	Type
aws:RequestTag/${TagKey}	根據請求中的標籤鍵值對是否存在，依動作篩選存取權	String
aws:ResourceTag/${TagKey}	根據連線到資源的標籤鍵值對，依動作篩選存取權	String
aws:TagKeys	根據請求中的標籤索引鍵是否存在，依動作篩選存取權	ArrayOfString
codebuild：artifacts	依 API 對應的引數值篩選存取權	Bool
codebuild：artifacts.bucketOwnerAccess	依 API 對應的引數值篩選存取權	String
codebuild：artifacts.encryptionDisabled	依 API 對應的引數值篩選存取權	Bool
codebuild：artifacts.location	依 API 對應的引數值篩選存取權	String
codebuild：authType	依 API 對應的引數值篩選存取權	String
codebuild：autoRetryLimit	依 API 對應的引數值篩選存取權	數值
codebuild：buildArn	依發出請求的 AWS CodeBuild 組建的 ARN 篩選存取權	ARN
codebuild：buildBatchConfig	依 API 對應的引數值篩選存取權	Bool
codebuild：buildBatchConfig.restrictions.computeTypesAllowed	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：buildBatchConfig.restrictions.fleetsAllowed	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：buildBatchConfig.serviceRole	依 API 對應的引數值篩選存取權	String
codebuild：buildType	依 API 對應的引數值篩選存取權	String
codebuild：cache	依 API 對應的引數值篩選存取權	Bool
codebuild：cache.location	依 API 對應的引數值篩選存取權	String
codebuild：cache.modes	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：cache.type	依 API 對應的引數值篩選存取權	String
codebuild：computeConfiguration	依 API 對應的引數值篩選存取權	Bool
codebuild：computeConfiguration.disk	依 API 對應的引數值篩選存取權	數值
codebuild：computeConfiguration.instanceType	依 API 對應的引數值篩選存取權	String
codebuild：computeConfiguration.machineType	依 API 對應的引數值篩選存取權	String
codebuild：computeConfiguration.memory	依 API 對應的引數值篩選存取權	數值
codebuild：computeConfiguration.vCpu	依 API 對應的引數值篩選存取權	數值
codebuild：computeType	依 API 對應的引數值篩選存取權	String
codebuild：concurrentBuildLimit	依 API 對應的引數值篩選存取權	數值
codebuild：encryptionKey	依 API 對應的引數值篩選存取權	String
codebuild：environment	依 API 對應的引數值篩選存取權	Bool
codebuild：environment.certificate	依 API 對應的引數值篩選存取權	String
codebuild：environment.computeConfiguration	依 API 對應的引數值篩選存取權	Bool
codebuild：environment.computeConfiguration.disk	依 API 對應的引數值篩選存取權	數值
codebuild：environment.computeConfiguration.instanceType	依 API 對應的引數值篩選存取權	String
codebuild：environment.computeConfiguration.machineType	依 API 對應的引數值篩選存取權	String
codebuild：environment.computeConfiguration.memory	依 API 對應的引數值篩選存取權	數值
codebuild：environment.computeConfiguration.vCpu	依 API 對應的引數值篩選存取權	數值
codebuild：environment.computeType	依 API 對應的引數值篩選存取權	String
codebuild：environment.environmentVariables	依 API 對應的引數值篩選存取權	Bool
Codebuild：https：//environment.environmentVariables.name	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：environment.environmentVariables.value	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：environment.environmentVariables/${name}.value	依 API 對應的引數值篩選存取權	String
codebuild：environment.fleet.fleetArn	依 API 對應的引數值篩選存取權	ARN
codebuild：environment.image	依 API 對應的引數值篩選存取權	String
codebuild：environment.imagePullCredentialsType	依 API 對應的引數值篩選存取權	String
codebuild：environment.privilegedMode	依 API 對應的引數值篩選存取權	Bool
codebuild：environment.registryCredential	依 API 對應的引數值篩選存取權	Bool
codebuild：environment.registryCredential.credential	依 API 對應的引數值篩選存取權	String
codebuild：environment.registryCredential.credentialProvider	依 API 對應的引數值篩選存取權	String
codebuild：environment.type	依 API 對應的引數值篩選存取權	String
codebuild：environmentType	依 API 對應的引數值篩選存取權	String
codebuild：exportConfig.s3Destination.bucket	依 API 對應的引數值篩選存取權	String
codebuild：exportConfig.s3Destination.bucketOwner	依 API 對應的引數值篩選存取權	String
codebuild：exportConfig.s3Destination.encryptionDisabled	依 API 對應的引數值篩選存取權	Bool
codebuild：exportConfig.s3Destination.encryptionKey	依 API 對應的引數值篩選存取權	String
codebuild：exportConfig.s3Destination.path	依 API 對應的引數值篩選存取權	String
codebuild：fileSystemLocations.identifier	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：fileSystemLocations.location	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：fileSystemLocations.type	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：fileSystemLocations/${identifier}.location	依 API 對應的引數值篩選存取權	String
codebuild：fileSystemLocations/${identifier}.type	依 API 對應的引數值篩選存取權	String
codebuild：fleetServiceRole	依 API 對應的引數值篩選存取權	String
codebuild：imageId	依 API 對應的引數值篩選存取權	String
codebuild：logsConfig	依 API 對應的引數值篩選存取權	Bool
codebuild：logsConfig.s3Logs	依 API 對應的引數值篩選存取權	Bool
codebuild：logsConfig.s3Logs.bucketOwnerAccess	依 API 對應的引數值篩選存取權	String
codebuild：logsConfig.s3Logs.encryptionDisabled	依 API 對應的引數值篩選存取權	Bool
codebuild：logsConfig.s3Logs.location	依 API 對應的引數值篩選存取權	String
codebuild：logsConfig.s3Logs.status	依 API 對應的引數值篩選存取權	String
codebuild：manualCreation	依 API 對應的引數值篩選存取權	Bool
codebuild：projectArn	依發出請求之 AWS CodeBuild 專案的 ARN 篩選存取權	ARN
codebuild：projectVisibility	依 API 對應的引數值篩選存取權	String
codebuild：scopeConfiguration.domain	依 API 對應的引數值篩選存取權	String
codebuild：scopeConfiguration.name	依 API 對應的引數值篩選存取權	String
codebuild：scopeConfiguration.scope	依 API 對應的引數值篩選存取權	String
codebuild：secondaryArtifacts	依 API 對應的引數值篩選存取權	Bool
codebuild：secondaryArtifacts.artifactIdentifier	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：secondaryArtifacts.bucketOwnerAccess	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：secondaryArtifacts.encryptionDisabled	依 API 對應的引數值篩選存取權	ArrayOfBool
codebuild：secondaryArtifacts.location	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：secondaryArtifacts/${artifactIdentifier}.bucketOwnerAccess	依 API 對應的引數值篩選存取權	String
codebuild：secondaryArtifacts/${artifactIdentifier}.encryptionDisabled	依 API 對應的引數值篩選存取權	Bool
codebuild：secondaryArtifacts/${artifactIdentifier}.location	依 API 對應的引數值篩選存取權	String
codebuild：secondarySources	依 API 對應的引數值篩選存取權	Bool
codebuild：secondarySources.auth.resource	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：secondarySources.auth.type	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：secondarySources.buildStatusConfig.context	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：secondarySources.buildStatusConfig.targetUrl	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：secondarySources.buildspec	依 API 對應的引數值篩選存取權	Bool
codebuild：secondarySources.insecureSsl	依 API 對應的引數值篩選存取權	ArrayOfBool
codebuild：secondarySources.location	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：secondarySources.sourceIdentifier	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：secondarySources/${sourceIdentifier}.auth.resource	依 API 對應的引數值篩選存取權	String
codebuild：secondarySources/${sourceIdentifier}.auth.type	依 API 對應的引數值篩選存取權	String
codebuild：secondarySources/${sourceIdentifier}.buildStatusConfig.context	依 API 對應的引數值篩選存取權	String
codebuild：secondarySources/${sourceIdentifier}.buildStatusConfig.targetUrl	依 API 對應的引數值篩選存取權	String
codebuild：secondarySources/${sourceIdentifier}.buildspec	依 API 對應的引數值篩選存取權	Bool
codebuild：secondarySources/${sourceIdentifier}.insecureSsl	依 API 對應的引數值篩選存取權	Bool
codebuild：secondarySources/${sourceIdentifier}.location	依 API 對應的引數值篩選存取權	String
codebuild：serverType	依 API 對應的引數值篩選存取權	String
codebuild：serviceRole	依 API 對應的引數值篩選存取權	String
codebuild：shouldOverwrite	依 API 對應的引數值篩選存取權	Bool
codebuild：source	依 API 對應的引數值篩選存取權	Bool
codebuild：source.auth.resource	依 API 對應的引數值篩選存取權	String
codebuild：source.auth.type	依 API 對應的引數值篩選存取權	String
codebuild：source.buildStatusConfig.context	依 API 對應的引數值篩選存取權	String
codebuild：source.buildStatusConfig.targetUrl	依 API 對應的引數值篩選存取權	String
codebuild：source.buildspec	依 API 對應的引數值篩選存取權	Bool
codebuild：source.insecureSsl	依 API 對應的引數值篩選存取權	Bool
codebuild：source.location	依 API 對應的引數值篩選存取權	String
codebuild：token	依 API 對應的引數值篩選存取權	String
codebuild：username	依 API 對應的引數值篩選存取權	String
codebuild：vpcConfig	依 API 對應的引數值篩選存取權	Bool
codebuild：vpcConfig.securityGroupIds	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：vpcConfig.subnets	依 API 對應的引數值篩選存取權	ArrayOfString
codebuild：vpcConfig.vpcId	依 API 對應的引數值篩選存取權	String