Hello all. I'm trying to reduce the set of AWS permissions given to the sst user and doing so using the policy generator to analyze what's being used. The one thing that troubles me is that SST seems to require things like iam:PutRolePolicy and iam:AttachRolePolicy and I believe I can't restrict the resources it needs that on since roles are being created for every lambda etc... Therefore I imagine that if that user gets breached then someone ill-intended could escalate their own privileges. Any recommendations or documented approach to best handling the policy given to the SST user ?

Hey @Erik Robertson, if you go into CloudTrail, can you check who is making the

iam:PutRolePolicy

and

iam:AttachRolePolicy

API call?

@Frank Indeed it is CloudFormation. Is the process document for assigning a separate role to CF and using it ? I'm guesing I should manually create a servicerole and assign it to the various SST CF stacks ?

I noticed you are using the

--role-arn

flag in another thread. Yeah, that’s the way to go! I will follow up in that thread.