(aws-cdk): (Disallow CDK Bootstrap to default AdministratorAccess for cfn-exec-role)
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
By default, CDK Bootstrap uses AdministratorAccess for cfn-exec-role when we run the `cdk bootstrap` command. This allows CDK to have higher privileges that the user is authorized to perform and poses a security concern. Feature request is to make '--cloudformation-execution-policies' parameter mandatory.
### Use Case
In my account, the account administrator disabled using AdministratorAccess. The account also has Config rules to remove AdministratorAccess access if found. We also have a security policy that removes the CDK S3 bucket first day of a month. Since we require re-bootstrapping the account each month, it would be ideal to make cdk bootstrap '--cloudformation-execution-policies' parameter mandatory. That way, it will force us to pass the right cfn-exec-role than to have CDK default to AdministratorAccess role.
### Proposed Solution
Make '--cloudformation-execution-policies' parameter mandatory
### Other Information
_No response_
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.94.0 (build 987c329)
### Environment details (OS name and version, etc.)
AWS Workspace (Microsoft Windows Server 2016 DataCenter 10.0.14393 Build 14393)
Contributor guide
Research direction
Start at the cdk bootstrap command and trace how --cloudformation-execution-policies is currently handled. Confirm the expected behavior for accounts that omit the option, identify the existing bootstrap command tests, and consider the breaking-change implications; done means the requested policy must be supplied and the behavior is covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100