aws-cloudformation / aws-cloudformation/cloudformation-cli
Extra service principal in assume role document for Hooks
- Dominant language
- Python
- Stars
- 336
- Forks
- 172
- Avg merge
- 3d 5m
- Merged PRs (30d)
- 3
Description
It looks like the generated hook invocation role includes `resources.cloudformation.amazonaws.com` which is unnecessary.
As an example:
```yaml
Resources:
ExecutionRole:
Type: AWS::IAM::Role
Properties:
MaxSessionDuration: 8400
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- hooks.cloudformation.amazonaws.com
- resources.cloudformation.amazonaws.com
Action: sts:AssumeRole
Condition:
StringEquals:
aws:SourceAccount:
Ref: AWS::AccountId
```
should become
```yaml
Resources:
ExecutionRole:
Type: AWS::IAM::Role
Properties:
MaxSessionDuration: 8400
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- hooks.cloudformation.amazonaws.com
Action: sts:AssumeRole
Condition:
StringEquals:
aws:SourceAccount:
Ref: AWS::AccountId
```
Contributor guide
Assessment
This issue has not been assessed yet.