aws / aws/aws-cdk

(aws-cdk): (Disallow CDK Bootstrap to default AdministratorAccess for cfn-exec-role)

Open
#27,097 5 comments 2 reactions 0 assignees View on GitHub
feature-request p2 package/tools
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

By default, CDK Bootstrap uses AdministratorAccess for cfn-exec-role when we run the `cdk bootstrap` command. This allows CDK to have higher privileges that the user is authorized to perform and poses a security concern. Feature request is to make '--cloudformation-execution-policies' parameter mandatory.

### Use Case

In my account, the account administrator disabled using AdministratorAccess. The account also has Config rules to remove AdministratorAccess access if found. We also have a security policy that removes the CDK S3 bucket first day of a month. Since we require re-bootstrapping the account each month, it would be ideal to make cdk bootstrap '--cloudformation-execution-policies' parameter mandatory. That way, it will force us to pass the right cfn-exec-role than to have CDK default to AdministratorAccess role.

### Proposed Solution

Make '--cloudformation-execution-policies' parameter mandatory

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.94.0 (build 987c329)

### Environment details (OS name and version, etc.)

AWS Workspace (Microsoft Windows Server 2016 DataCenter 10.0.14393 Build 14393)

Contributor guide

Open the contributing guide

Research direction

Start at the cdk bootstrap command and trace how --cloudformation-execution-policies is currently handled. Confirm the expected behavior for accounts that omit the option, identify the existing bootstrap command tests, and consider the breaking-change implications; done means the requested policy must be supplied and the behavior is covered by tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.