Apply PermissionBoundary to all bootstrap roles (for easier self-service bootstrapping under existing boundary)
- Dominant language
- TypeScript
- Stars
- 105
- Forks
- 122
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 71
Description
### Describe the feature
PermissionBoundary is only applied to Cloudformation Execution Role when bootstrapping with option --custom-permission-boundary
```bash
cdk bootstrap --custom-permissions-boundary PermissionBoundary
```
The following roles currently do not get the PermissionBoundary when the Bootstrap is done with the command above:
DeploymentActionRole
FilePublishingRole
ImagePublishingRole
LookupRole
### Use Case
The organisation I work for has a PermissionBoundary that enforces all roles to also be created with the PermissionBoundary.
```json
{
"Sid": "RestrictRoleCreation",
"Effect": "Deny",
"Action": [
"iam:CreateRole",
"iam:UpdateRole",
"iam:PutRolePermissionsBoundary"
],
"Resource": "*",
"Condition": {
"StringNotLike": {
"iam:PermissionsBoundary": [
"arn:aws:iam::*:policy/PermissionBoundary"
]
}
}
},
```
Currently we have to bootstrap CDK using a custom bootstrap-template.yaml that applies the PermissionBoundary on all other roles.
But sometimes this causes issues if someone later on runs cdk bootstrap without the template, and resources are updated without PermissionBoundary again...
### Proposed Solution
Add below code to all roles created by bootstrap-template.yaml
```yaml
PermissionsBoundary:
Fn::If:
- PermissionsBoundarySet
- Fn::Sub: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/${InputPermissionsBoundary}'
- Ref: AWS::NoValue
```
I can make a PR for this if needed.
### Other Information
Currently bootstrap-template.yaml only applies the below code for attaching the PermissionBoundary on CloudFormationExecutionRole:
```yaml
PermissionsBoundary:
Fn::If:
- PermissionsBoundarySet
- Fn::Sub: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/${InputPermissionsBoundary}'
- Ref: AWS::NoValue
```
### Acknowledgements
- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
v2.114.0
### Environment details (OS name and version, etc.)
Ubuntu
Contributor guide
Assessment
This issue has not been assessed yet.