Add permission set -> iam policy relationship - #134
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| resp, err := o.ssoAdminClient.ListManagedPoliciesInPermissionSet(ctx, input) | ||
| if err != nil { | ||
| return nil, nil, wrapAWSError(fmt.Errorf("baton-aws: ssoadmin.ListManagedPoliciesInPermissionSet failed: %w", err)) |
There was a problem hiding this comment.
🟡 Suggestion: This new sso:ListManagedPoliciesInPermissionSet call (and GetInlinePolicyForPermissionSet in inline_policy.go) fails the whole sync on AccessDenied. The existing IAM inline-policy path degrades gracefully (see getInlinePolicyDocument's isAccessDeniedError handling). Existing permission-set-opted-in installs that haven't added the two new SSO scopes will now hard-fail rather than skip. Consider matching the graceful-skip pattern for these new scopes. (medium confidence)
Connector PR Review: Add permission set -> iam policy relationshipBlocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0 Review SummaryThe full PR diff was scanned for security and correctness. This PR makes the Security IssuesNone found. Correctness IssuesNone found. Suggestions
Prompt for AI agents |
d3f483f to
3f29976
Compare
3f29976 to
6f12bd1
Compare
Connector PR Review: Add permission set -> iam policy relationshipBlocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0 Review SummaryScanned the full PR diff for security and correctness. This change adds two Identity Center relationships: permission-set Grants now emit the managed-policy composition against the iam_policy attached entitlement, and the inline-policy builder gains a permission-set parent branch backed by GetInlinePolicyForPermissionSet. Both new SSO calls degrade gracefully on ResourceNotFound and AccessDenied (Warn plus return nil), which resolves the prior review concern about opted-in installs hard-failing on missing scopes. Nil-safety of identityInstance holds because the permission-set builder, and thus any permission-set parent, is only registered under orgsEnabled and ssoEnabled. Pagination in permissionSetResourceType.Grants passes the raw AWS NextToken through and guards against empty tokens, consistent with permission_set_assignment.go. Tests cover both new paths, including pagination and the empty-document case. Security IssuesNone found. Correctness IssuesNone found. Suggestions
Prompt for AI agents |
…XH-1152, CXP-785) (#148) * docs: document IAM policy resources and their required permissions (CXH-1152) The connector has synced IAM managed policies and inline policies as resources with their policy documents since #132 / #134 / #145, but docs/connector.mdx was never updated. README.md carries the new permissions; the customer-facing page does not. Because the document fetch degrades AccessDenied to a warn-and-skip, a customer who builds their IAM role from the published policy gets policy resources with no policy_document and no error — the feature is silently inert for anyone onboarding from the docs. - Add a SyncIAMPolicyDocuments statement to all three setup paths (IAM setup, Identity Center setup, Terraform) covering the 12 IAM actions the policy resource types actually call. - Add "IAM policies as resources" describing both resource types, the policy document attribute, and the degrade-on-missing-permission behaviour. - Add IAM managed policies / Inline policies to the capabilities table. - Add an explanation bullet group in the IAM setup tab, matching the existing style of that section. Not included: sso:ListCustomerManagedPolicyReferencesInPermissionSet is also missing from this page. That gap belongs to CXP-785 and is left alone here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: add sso:ListCustomerManagedPolicyReferencesInPermissionSet (CXP-785) Folds in the one surviving item from CXP-785. Auditing that ticket's five claimed actions against main: - sso:GetInlinePolicyForPermissionSet and sso:ListManagedPoliciesInPermissionSet are already present in this file. - sso:GetPermissionsBoundaryForPermissionSet and sso:DescribePermissionSetProvisioningStatus are not in baton_capabilities.json and are not called by the connector, so they are not required permissions. - sso:ListCustomerManagedPolicyReferencesInPermissionSet is genuinely missing, and is called at permission_set_assignment.go:382. Added to the Identity Center and Terraform read policies. Every sso: action declared in baton_capabilities.json is now present in both. Also note CXP-785's stated impact is stale: that call degrades AccessDenied to a warn-and-skip (permission_set_assignment.go:392-397), so the sync does not fail — customer-managed policy grants on permission sets are silently missing instead, the same failure class as the iam: gaps in this PR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2 participants
No description provided.