I was able to get permission boundaries to work with SST but I'm wondering if anybody has thought about a way to add them to the debug stack? We have the same permission boundaries in our dev environments we do in prod, thereby to encounter any problems ASAP. That means we can't deploy the debug stack.

Hey @Matt Morgan, you can add this block to ur

index.js/ts

export function debugStack(
  app: <http://cdk.App|cdk.App>,
  stack: cdk.Stack,
  props: sst.DebugStackProps
): void {
  const boundary = new iam.ManagedPolicy(this, 'Boundary', {
    statements: [
      new iam.PolicyStatement({
        effect: iam.Effect.DENY,
        actions: ['iam:*'],
        resources: ['*'],
      }),
    ],
  });

  iam.PermissionsBoundary.of(this).apply(boundary);
}

Cool! I'll try that. Thanks for the reply.