Why does CodePipeline service role need iam:PassRole?

Question

I was reading the [AWS documentation][1] explaining how to create the CodePipeline service role. However, I don't understand why it needs the following statement:
```json
{
  "Effect": "Allow",
  "Action": [
     "iam:PassRole"
   ],
   "Resource": "*"
}
```
inside the `RolePolicy.json` file.

I am **not asking for explanation** of what `iam:PassRole` is and why and when we use it in general. I understand that it allows a principal to pass a role to another service. However, I'm confused about why we need it particularly inside the CodePipeline service. So,

Q1: What is the principal, what is/are role(s), and what is/are service(s) in this case?   
Q2: Isn't it insecure to use `"Resource": "*"`?

**Important:** 
If you don't understand the question or don't know the answer, DO NOT post spams in order to simply collect points. It will be downvoted, you will get a rude response and I'll report your answer to remove from the post.

[1]: https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-create-service-role-cli.html

Riku_Kobayashi · Answer

Hello.

CodePipeline needs iam:PassRole because it often needs to pass roles to other AWS services to perform actions on your behalf.  
For example, if you have a pipeline stage that deploys to ECS, CodePipeline would need to pass an appropriate role to ECS to allow it to perform the deployment.  
If this action is not allowed by CodePipeline's IAM role, the IAM role cannot be passed to ECS and an error will occur.  
https://docs.aws.amazon.com/codepipeline/latest/userguide/security-iam.html  
> You must also add the iam:PassRole permissions to use IAM roles for tasks. For more information, see Amazon ECS task execution IAM role and IAM Roles for Tasks. Use the following policy text.

> Q2: Isn't it insecure to use "Resource": "*"?

As you know, "*" means all IAM roles will be targeted, so if you want to narrow it down to a specific IAM role, I think it's better to limit it to the ARN of the IAM role.  
When you create CodePipeline from the management console, an IAM role is created with the "Condition" statement added to the service role as shown below.

```
    "Statement": [
        {
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEqualsIfExists": {
                    "iam:PassedToService": [
                        "cloudformation.amazonaws.com",
                        "elasticbeanstalk.amazonaws.com",
                        "ec2.amazonaws.com",
                        "ecs-tasks.amazonaws.com"
                    ]
                }
            }
        },
```

Why does CodePipeline service role need iam:PassRole?

Add your answer

Relevant content