Feature Request: Support IAM Permissions Boundaries

[Clete2]

Hello! I am the owner of a few AWS accounts. We require all deployments to have a specific permissions boundary attached to all IAM roles created in the account.

Can you add support for me to pass a permissions boundary into the stack?

[alexcasalboni]

Thanks for requesting this, @Clete2!

It should be fairly easy, I'd add a new PermissionsBoundary CloudFormation parameter applied to all functions (if given).

I can't think of a use case where you'd need different boundaries for each function.

I'll be working on a PR later today.

[Clete2]

Sweet @alexcasalboni; I appreciate it!

I agree, no need to have different for each IAM role.

[alexcasalboni]

Implemented and merged :)

Do you need this on SAR asap? Or you are deploying via SAM CLI?

[Clete2]

Awesome! I am using it on SAR but I wouldn’t say it’s needed ASAP. Up to you when you’d like to update it. You also could publish a test version and I’ll try it out if you like.

[alexcasalboni]

No worries, I've just published version 3.4.1 on SAR.

Let me know if you encounter any issue :)

[Clete2]

@alexcasalboni am I looking at the wrong place? Latest I see is 3.4.0.

https://console.aws.amazon.com/lambda/home?region=us-east-1#/create/app?applicationId=arn:aws:serverlessrepo:us-east-1:451282441545:applications/aws-lambda-power-tuning

[alexcasalboni]

Sorry, somehow I didn't save & commit the most important file (template.yml) 🙏

It should be updated within minutes.

[Clete2]

@alexcasalboni I think it's not being applied to the IAM roles properly. I see it is applied to the Lambda functions but not IAM roles. I didn't even know you could add a permissions boundary to the Lambda function.

Error: error waiting for Serverless Application Repository CloudFormation Stack (arn:aws:cloudformation:us-east-1:XXX:stack/serverlessrepo-sandbox-aws-lambda-power-tuning-shared/BBB) creation: failed to create CloudFormation stack, rollback requested (ROLLBACK_COMPLETE): ["The following resource(s) failed to create: [analyzerRole, initializerRole, cleanerRole, optimizerRole, executorRole, statemachineRole]. Rollback requested by user." "Resource creation cancelled" "Resource creation cancelled" "Resource creation cancelled" "Resource creation cancelled" "Resource creation cancelled" "API: iam:CreateRole User: arn:aws:sts::XXX:assumed-role/YYY/ZZZ is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::XXX:role/serverlessrepo-sandbox-statemachineRole-AAA with an explicit deny"]

[alexcasalboni]

mmm weird, I've tested it and I did see the permissions boundary applied to the IAM Role. The SAM transformation is supposed to apply the PM to the Lambda role.

I think it works only if the role doesn't exist yet, though. I suppose this was a stack update, right?

Could you please delete the existing CloudFormation stack and re-deploy the SAR app from scratch?

[Clete2]

@alexcasalboni Actually I made a new stack with a new name. I'll take a deeper look into it a bit later today.

To be honest I'm not very familiar with SAM or CloudFormation. In fact the error I pasted is from a Terraform deployment (it can deploy SAR apps).

It could be that it adds the permissions boundary after creation, which would cause an issue, since our deployer role is only allowed to create roles with the permissions boundary in the first place.

Like I said I'll take a peek in a little bit at our cloudtrail and see if I can find any more clues as to what is going on.

[alexcasalboni]

Oh, I see. Thanks for sharing!

By the way, I'd be interested in learning more about how you're deploying the SAR app with Terraform - and maybe document it in How to deploy the state machine.

[Clete2]

Once I get it working I will be happy to help with the docs. I probably won't get back to you today on the troubleshooting tho, maybe tomorrow. Thanks!

[Clete2]

@alexcasalboni I think I've figured it out. I think your global default to use the boundary for functions works fine, but that's not applying to the step function policy "statemachineRole". That one I think you'll want to add the permissions boundary to it some other way.

[alexcasalboni]

Thanks @Clete2, that sounds right indeed!

I'll have another look tomorrow (Europe time) and push a bugfix.

In the meantime, have a look at #109 - where Terraform support was already requested a few months ago.

[alexcasalboni]

I've merged and published the bugfix on SAR (version 3.4.2).

[alexcasalboni]

Resolving this for now. Please reopen if you encounter other issues.

[Clete2]

Thanks a ton @alexcasalboni ! It deployed successfully.