In short, we want to isolate deployments in a CI user. But for security, we’d prefer not to have this user be bale to assign higher privilege to itself (which would happen if it had full IAM createRole access). One solution is to add a permissions boundary to policy to this CI user, so that it wouldn’t be able to create users without a permission boundary as well. In the documentation above, the default

Allow

is to all actions on all resource, but it could as well be restricted to whatever CI needs to do in this case

Take a look at CDK Aspects. You can try iterating thru all resources, and attach the ScopePermissions to each IAM role?

hmmm I think the issue with that is that our CI user wouldn’t even be able to create iam roles without the scoping policy attached to them.

Oh you meant the IAM roles created inside the

CDKToolkit

stack?

it seems we’re creating IAM Roles when our stack is being deployed.

yes! @Frank

Hey @José Ribeiro, if you take a look at the bootstrapping doc here - https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html

So what I will probably do right now is adding a policy for permission boundaries manually. Then using the

--cloudformation-execution-policies

flag and also define a permission boundaries using the same policy using this: https://docs.aws.amazon.com/cdk/api/latest/docs/aws-iam-readme.html#permissions-boundaries, which seems to be a bit more straightforward than aspects. Let’s see how that goes.