AmazonCodeGuruReviewerFullAccess

OperatorAWS managedActivePermissions reviewedShow on map Compare

Summary

Grants full access to Amazon CodeGuru Reviewer and scoped access to required dependencies.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AmazonCodeGuruReviewerFullAccess
Default version: v3
Created: 2019-12-03
Last edited: 2020-08-29
Services: codecommit, codeguru, codeguru-reviewer, codestar-connections, events, iam

Control-plane actions (34)

By access level: 8 List, 10 Read, 6 Tagging, 10 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
CodeCommit	3 of 91	1 List, 2 Tagging; 2 restricted, 2 conditional	codecommit:ListRepositories, codecommit:TagResource, codecommit:UntagResource
CodeGuru	All 1 actions (see the CodeGuru page)	1 Read; 0 restricted, 0 conditional	codeguru:*
CodeGuru Reviewer	All 17 actions (see the CodeGuru Reviewer page)	5 List, 6 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	codeguru-reviewer:*
CodeStar Connections	6 of 38	2 List, 2 Read, 2 Tagging; 6 restricted, 6 conditional	codestar-connections:ListConnections, codestar-connections:ListTagsForResource, codestar-connections:PassConnection, codestar-connections:TagResource, codestar-connections:UntagResource, codestar-connections:UseConnection
EventBridge	4 of 71	4 Write; 4 restricted, 4 conditional	events:DeleteRule, events:PutRule, events:PutTargets, events:RemoveTargets
IAM	3 of 190	1 Read, 2 Write; 3 restricted, 1 conditional	iam:CreateServiceLinkedRole, iam:DeleteServiceLinkedRole, iam:GetServiceLinkedRoleDeletionStatus

CodeCommit: 3 actions

codecommit:ListRepositories (List)
codecommit:TagResource (Tagging)
codecommit:UntagResource (Tagging)

CodeStar Connections: 6 actions

codestar-connections:ListConnections (List)
codestar-connections:ListTagsForResource (List)
codestar-connections:PassConnection (Read)
codestar-connections:TagResource (Tagging)
codestar-connections:UntagResource (Tagging)
codestar-connections:UseConnection (Read)

EventBridge: 4 actions

events:DeleteRule (Write)
events:PutRule (Write)
events:PutTargets (Write)
events:RemoveTargets (Write)

IAM: 3 actions

iam:CreateServiceLinkedRole (Write)
iam:DeleteServiceLinkedRole (Write)
iam:GetServiceLinkedRoleDeletionStatus (Read)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 16 write, tagging or permissions-management actions, short of full control of any service.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AmazonCodeGuruReviewerFullAccess",
      "Effect": "Allow",
      "Action": [
        "codeguru-reviewer:*",
        "codeguru:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AmazonCodeGuruReviewerSLRCreation",
      "Action": "iam:CreateServiceLinkedRole",
      "Effect": "Allow",
      "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AmazonCodeGuruReviewerSLRDeletion",
      "Effect": "Allow",
      "Action": [
        "iam:DeleteServiceLinkedRole",
        "iam:GetServiceLinkedRoleDeletionStatus"
      ],
      "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer"
    },
    {
      "Sid": "CodeCommitAccess",
      "Effect": "Allow",
      "Action": [
        "codecommit:ListRepositories"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CodeCommitTagManagement",
      "Effect": "Allow",
      "Action": [
        "codecommit:TagResource",
        "codecommit:UntagResource"
      ],
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:TagKeys": "codeguru-reviewer"
        }
      }
    },
    {
      "Sid": "CodeConnectTagManagement",
      "Effect": "Allow",
      "Action": [
        "codestar-connections:TagResource",
        "codestar-connections:UntagResource",
        "codestar-connections:ListTagsForResource"
      ],
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:TagKeys": "codeguru-reviewer"
        }
      }
    },
    {
      "Sid": "CodeConnectManagedRules",
      "Effect": "Allow",
      "Action": [
        "codestar-connections:UseConnection",
        "codestar-connections:ListConnections",
        "codestar-connections:PassConnection"
      ],
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "codestar-connections:ProviderAction": [
            "ListRepositories",
            "ListOwners"
          ]
        }
      }
    },
    {
      "Sid": "CloudWatchEventsManagedRules",
      "Effect": "Allow",
      "Action": [
        "events:PutRule",
        "events:PutTargets",
        "events:DeleteRule",
        "events:RemoveTargets"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "events:ManagedBy": "codeguru-reviewer.amazonaws.com"
        }
      }
    }
  ]
}

Version history

Current version v3, edited by AWS on 2020-08-29. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonCodeGuruReviewerFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonCodeGuruReviewerFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonCodeGuruReviewerFullAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonCodeGuruReviewerFullAccess

Terraform

resource "aws_iam_role_policy_attachment" "amazoncodegurureviewerfullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonCodeGuruReviewerFullAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonCodeGuruReviewerFullAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.