如何配置AWS IAM策略管控带Owner标签的CodeCommit仓库权限

你的核心需求是：仅当仓库存在Owner标签且操作用户与标签值不匹配时，才拒绝主分支推送/合并及仓库编辑操作。原策略的问题在于，当仓库没有Owner标签时，StringNotEqualsIgnoreCase条件会被判定为true（空值与任何用户名都不相等），导致所有用户被拒绝操作。

以下是调整后的完整IAM策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "LockMasterProductionBranches",
            "Effect": "Deny",
            "Action": [
                "codecommit:GitPush",
                "codecommit:DeleteBranch",
                "codecommit:PutFile",
                "codecommit:MergeBranchesByFastForward",
                "codecommit:MergeBranchesBySquash",
                "codecommit:MergeBranchesByThreeWay",
                "codecommit:MergePullRequestByFastForward",
                "codecommit:MergePullRequestBySquash",
                "codecommit:MergePullRequestByThreeWay"
            ],
            "Resource": "*",
            "Condition": {
                "StringEqualsIfExists": {
                    "codecommit:References": [
                        "refs/heads/master",
                        "refs/heads/prod"
                    ]
                },
                "Null": {
                    "codecommit:References": "false",
                    "aws:ResourceTag/Owner": "false"
                },
                "StringNotEqualsIgnoreCase": {
                    "aws:ResourceTag/Owner": "${aws:username}"
                }
            }
        },
        {
            "Sid": "LockRepo",
            "Effect": "Deny",
            "Action": [
                "codecommit:UpdateDefaultBranch",
                "codecommit:CreatePullRequestApprovalRule",
                "codecommit:DeletePullRequestApprovalRule",
                "codecommit:OverridePullRequestApprovalRules",
                "codecommit:UpdatePullRequestApprovalRuleContent",
                "codecommit:DeleteRepository",
                "codecommit:UpdateRepositoryDescription",
                "codecommit:UpdateRepositoryName",
                "codecommit:TagResource",
                "codecommit:UntagResource",
                "codecommit:PutRepositoryTriggers"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "aws:ResourceTag/Owner": "false"
                },
                "StringNotEqualsIgnoreCase": {
                    "aws:ResourceTag/Owner": "${aws:username}"
                }
            }
        }
    ]
}

关键调整说明 #

• 强制Owner标签存在性：在两个Statement的Condition中加入"Null": {"aws:ResourceTag/Owner": "false"}，这个条件要求仓库必须存在Owner标签（标签值不为null），否则整个Condition判定为false，不会触发Deny。
• 保留分支操作限制：第一个Statement中关于codecommit:References的条件保持不变，确保仅针对master/prod分支生效。
• 逻辑与条件组合：IAM策略的Condition默认是逻辑与关系，只有所有条件同时满足时才执行Deny操作，刚好匹配你要求的「仓库有Owner标签且用户与标签不匹配」的拒绝前提。

内容的提问来源于stack exchange，提问作者Cailean Parker