blocks|key|4207033|text|这是一个IAM策略，它应该支持这里列出的所有条件运算符：https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html。但是，由于GitPush操作本身在幕后涉及两个单独的操作，为了实现预期的行为，应该使用..IfExists条件运算符系列。也就是说，为了在这种情况下使用通配符，应该使用StringLikeIfExists。您的策略可以是这样的：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4207034|{
++++"Version":+"2012-10-17",
++++"Statement":+[
++++++++{
++++++++++++"Effect":+"Deny",
++++++++++++"Action":+[
++++++++++++++++"codecommit:GitPush"
++++++++++++],
++++++++++++"Resource":+"arn:aws:codecommit:us-east-2:80398EXAMPLE:MyDemoRepo",
++++++++++++"Condition":+{
++++++++++++++++"StringLikeIfExists":+{
++++++++++++++++++++"codecommit:References":+[
++++++++++++++++++++++++"refs/heads/release-*"
++++++++++++++++++++]
++++++++++++++++},
++++++++++++"Null":+{
++++++++++++++++"codecommit:References":+false
++++++++++++++++}
++++++++++++}
++++++++},
++++++++{
++++++++++++"Effect":+"Deny",
++++++++++++"Action":+[
++++++++++++++++"codecommit:GitPush",
++++++++++++++++"codecommit:DeleteBranch",
++++++++++++++++"codecommit:PutFile",
++++++++++++++++"codecommit:MergePullRequestByFastForward"
++++++++++++],
++++++++++++"Resource":+"arn:aws:codecommit:us-east-2:80398EXAMPLE:MyDemoRepo",
++++++++++++"Condition":+{
++++++++++++++++"StringEqualsIfExists":+{
++++++++++++++++++++"codecommit:References":+[
++++++++++++++++++++++++"refs/heads/master",
++++++++++++++++++++++++"refs/heads/prod"
++++++++++++++++++++]
++++++++++++++++},
++++++++++++"Null":+{
++++++++++++++++"codecommit:References":+false
++++++++++++++++}
++++++++++++}
++++++++}
++++]
}|code-block|syntax|javascript|4207035|这样，通配符匹配和精确匹配都应该得到支持。|4207036|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html^0|3R|7|5Y|I|S|2T|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]|$9|X|A|Y|B|C]]|D|@$9|Z|A|10|1|11]]|E|$]]|$1|F|3|G|5|H|7|12|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|13|8|@]|D|@]|E|$]]|$1|M|3|-4|5|6|7|14|8|@]|D|@]|E|$]]]|N|$O|$5|P|Q|R|E|$S|T]]]]

This is an IAM policy, which is supposed to support all the conditional operators listed here: <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html</a> . But since <code>GitPush</code> action itself involves two separate actions behind the scene, to achieve the expected behavior, the ..IfExists conditional operator family should be used. That being said, in order to use wildcard in this case, <code>StringLikeIfExists</code> should be used. Your policy could be like this:
<pre class="lang-json prettyprint-override"><code>{
 &quot;Version&quot;: &quot;2012-10-17&quot;,
 &quot;Statement&quot;: [
 {
 &quot;Effect&quot;: &quot;Deny&quot;,
 &quot;Action&quot;: [
 &quot;codecommit:GitPush&quot;
 ],
 &quot;Resource&quot;: &quot;arn:aws:codecommit:us-east-2:80398EXAMPLE:MyDemoRepo&quot;,
 &quot;Condition&quot;: {
 &quot;StringLikeIfExists&quot;: {
 &quot;codecommit:References&quot;: [
 &quot;refs/heads/release-*&quot;
 ]
 },
 &quot;Null&quot;: {
 &quot;codecommit:References&quot;: false
 }
 }
 },
 {
 &quot;Effect&quot;: &quot;Deny&quot;,
 &quot;Action&quot;: [
 &quot;codecommit:GitPush&quot;,
 &quot;codecommit:DeleteBranch&quot;,
 &quot;codecommit:PutFile&quot;,
 &quot;codecommit:MergePullRequestByFastForward&quot;
 ],
 &quot;Resource&quot;: &quot;arn:aws:codecommit:us-east-2:80398EXAMPLE:MyDemoRepo&quot;,
 &quot;Condition&quot;: {
 &quot;StringEqualsIfExists&quot;: {
 &quot;codecommit:References&quot;: [
 &quot;refs/heads/master&quot;,
 &quot;refs/heads/prod&quot;
 ]
 },
 &quot;Null&quot;: {
 &quot;codecommit:References&quot;: false
 }
 }
 }
 ]
}
</code></pre>
This way both the wildcard matching and exact matching should be supported.

Amazon now support being able to limit access to CodeCommit repository on a branch by branch basis by means of IAM policies. 
I have successfully denied access to specific branches using a form of the policy below, but cannot find a way to deny access to all branches beginning with a certain name. 
Ie: master and develop are specific branches but then I have release-1, release-2 etc which I also want to deny. 
What I want is to be able to use a wildcard. I've tried release-* but that didn't work.
Is their a format to include wildcards in the "codecommit:References"?

<pre><code>{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Deny",
 "Action": [
 "codecommit:GitPush",
 "codecommit:DeleteBranch",
 "codecommit:PutFile",
 "codecommit:MergePullRequestByFastForward"
 ],
 "Resource": "arn:aws:codecommit:us-east-2:80398EXAMPLE:MyDemoRepo",
 "Condition": {
 "StringEqualsIfExists": {
 "codecommit:References": [
 "refs/heads/master",
 "refs/heads/develop",
 "refs/heads/release-[now what]"
 ]
 },
 "Null": {
 "codecommit:References": false
 }
 }
 }
 ]
}
</code></pre>

AWS IAM policy to limit access to CodeCommit branches with wildcards in their names

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

亚马逊现在支持通过IAM策略逐个分支地限制对CodeCommit存储库的访问。我已经使用下面的策略形式成功地拒绝了对特定分支的访问，但找不到一种方法来拒绝对以特定名称开头的所有分支的访问。例如: master和develop是具体的分支，但是我有release-1，release-2等等，我也想否认。我想要的是能够使用...

限制对名称中带有通配符的CodeCommit分支的访问的AWS IAM策略-腾讯云开发者社区-腾讯云

问限制对名称中带有通配符的CodeCommit分支的访问的AWS IAM策略
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问限制对名称中带有通配符的CodeCommit分支的访问的AWS IAM策略EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问限制对名称中带有通配符的CodeCommit分支的访问的AWS IAM策略
EN