aws / aws/aws-cdk-cli

Apply PermissionBoundary to all bootstrap roles (for easier self-service bootstrapping under existing boundary)

Open
#284 16 comments 9 reactions 0 assignees View on GitHub
feature-request p2
Dominant language
TypeScript
Stars
105
Forks
122
Avg merge
1d 17h
Merged PRs (30d)
71

Description

### Describe the feature

PermissionBoundary is only applied to Cloudformation Execution Role when bootstrapping with option --custom-permission-boundary

```bash
cdk bootstrap --custom-permissions-boundary PermissionBoundary
```

The following roles currently do not get the PermissionBoundary when the Bootstrap is done with the command above:

DeploymentActionRole
FilePublishingRole
ImagePublishingRole
LookupRole

### Use Case

The organisation I work for has a PermissionBoundary that enforces all roles to also be created with the PermissionBoundary.

```json
{
"Sid": "RestrictRoleCreation",
"Effect": "Deny",
"Action": [
"iam:CreateRole",
"iam:UpdateRole",
"iam:PutRolePermissionsBoundary"
],
"Resource": "*",
"Condition": {
"StringNotLike": {
"iam:PermissionsBoundary": [
"arn:aws:iam::*:policy/PermissionBoundary"
]
}
}
},
```
Currently we have to bootstrap CDK using a custom bootstrap-template.yaml that applies the PermissionBoundary on all other roles.
But sometimes this causes issues if someone later on runs cdk bootstrap without the template, and resources are updated without PermissionBoundary again...

### Proposed Solution

Add below code to all roles created by bootstrap-template.yaml

```yaml
PermissionsBoundary:
Fn::If:
- PermissionsBoundarySet
- Fn::Sub: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/${InputPermissionsBoundary}'
- Ref: AWS::NoValue
```
I can make a PR for this if needed.

### Other Information

Currently bootstrap-template.yaml only applies the below code for attaching the PermissionBoundary on CloudFormationExecutionRole:

```yaml
PermissionsBoundary:
Fn::If:
- PermissionsBoundarySet
- Fn::Sub: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/${InputPermissionsBoundary}'
- Ref: AWS::NoValue
```

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

v2.114.0

### Environment details (OS name and version, etc.)

Ubuntu

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.