Repository navigation
Restrict use of the GitHub connection - #2331
Merged
Merged
Conversation
The manage-deployments policy let the support role update any pipeline in the account, pass any IAM role and pass the GitHub connection to CodePipeline. Together those allow a pipeline to be repointed at any repository the connection can reach and run under a role of the caller's choosing. Nothing needs them. The pause, unpause and deploy rake tasks and the trigger_terraform_pipeline make target only start executions and toggle stage transitions. CloudTrail shows the UpdatePipeline calls in dev came from admin roles and the deployer role, not the support role.
The deployer role could use and pass the connection with no limit on which repository it fetched. Limit UseConnection to the two repositories its pipelines fetch, and PassConnection to CodePipeline. The connection ARNs use the codeconnections prefix but the policy only granted codestar-connections actions. Each prefix has its own condition keys, so grant both, on both forms of the ARN. Remove the codecommit:GitPull statement. CodeCommit has no resource type that matches a connection ARN, so it granted nothing.
whi-tw
force-pushed
the
whi-tw/deployment-triggering
branch
from
October 20, 2026 11:05
0c48483 to
60ffe61
Compare
whi-tw
changed the title
theseanything
approved these changes
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem does this pull request solve?
Trello card: https://trello.com/c/j4GU3D6F/858-review-our-how-trigger-deployments
This limits which roles can use and pass the GitHub connection, and what they can use it for.
The support role (
manage-deployments) losescodepipeline:UpdatePipeline,iam:PassRole,iam:GetRole,PassConnectionandUseConnection. The pause, unpause and deploy rake tasks andtrigger_terraform_pipelineonly start executions and toggle stage transitions, so they are unaffected. CloudTrail shows noUpdatePipelinecalls through the support role in the last 90 days in dev, staging, production or deploy. Thecodestar_connection_arnvariable is removed from theengineer-accessmodule because nothing uses it now.The deployer role (
deployer-access) can now use the connection only forgovuk-forms/forms-deployandgovuk-forms/forms-e2e-tests, and pass it only to CodePipeline. Our connection ARNs use thecodeconnectionsprefix but the policy only hadcodestar-connectionsactions, so it now grants both prefixes on both ARN forms, each with its own condition key. Acodecommit:GitPullstatement is removed, because the connection ARN is not a CodeCommit resource and it never granted anything.Applied to dev: the plan showed only the two policy updates and
apply-forms-terraform-devsucceeded. As the support role,get-pipeline-state, the pause and unpause rake tasks andtrigger_terraform_pipelinestill work, andUpdatePipelineis denied.Things to consider when reviewing
codestar-connections:statements are kept until thecodeconnections:ones are shown to be enough on their own.Reminders
If you've made changes to the deployer role (files in
modules/deployer-access):make <environment> forms/account applyon the relevant environments (dev,stagingand/orprod)apply-forms-terraform-<environment>pipelines have run successfully