feat: bootstrap arguments for permissions boundary #22792

Naumel · 2022-11-04T20:23:31Z

Users can now specify in the CDK CLI a (permissions boundary) policy to be applied on the Execution Role and all subsequent IAM users and roles of their app.

If you want to try out the feature, a good starting point is having the--example-permissions-boundary(or --epb) parameter for the cdk botstrap:

cdk boostrap --epb

This achieves a couple of things: a new policy will be created (if not already present) in the account being bootstrapped (cdk-${qualifier}-permissions-boundary) and it will be referenced in the bootstrap template. In order for the bootstrap to be successful, the credentials use must include iam:getPolicy and iam:createPolicy permissions.
This works pairs with #22913, as permissions boundary needs propagation.
You can inspect the policy via the console, retrieve it via aws cli or sdk and you can copy the structure to use on your own from packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml: Resources.CdkBoostrapPermissionsBoundaryPolicy

At this point you can edit the policy, add restrictions and see what scope would match your requirements.

For non-dev work, the suggestion is to use --custom-permissions-boundary (or --cpb):

cdk bootstrap --cpb "custom-policy-name"

The policy must be created and accessible for the credentials used to perform the bootstrap.

All Submissions:

Have you followed the guidelines in our Contributing guide?

Adding new Unconventional Dependencies:

This PR adds new unconventional dependencies following the process described here

New Features

Have you added the new feature to an integration test?
- Did you use yarn integ to deploy the infrastructure and generate the snapshot (i.e. yarn integ without --dry-run)?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

#22744

gitpod-io · 2022-11-04T20:23:38Z

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

corymhall

Couple of comments

packages/aws-cdk/README.md

packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml

Co-authored-by: Cory Hall <43035978+corymhall@users.noreply.github.com>

packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml

Naumel · 2022-11-15T09:12:11Z

@Mergifyio update

Inbound execution ID: c68ef47b-c8a2-463a-8935-46febfe89681

mergify · 2022-11-15T09:12:47Z

update

✅ Branch has been successfully updated

mergify · 2022-11-15T10:38:41Z

update

☑️ Nothing to do

#commits-behind>0 [:pushpin: update requirement]
-closed [:pushpin: update requirement]

Naumel · 2022-11-21T16:47:07Z

@Mergifyio update

mergify · 2022-11-21T16:47:43Z

update

✅ Branch has been successfully updated

Missed one 😅

corymhall

This is looking really good! I only have a couple of minor comments and then I
think we are good to go!

packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts

packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml

packages/aws-cdk/README.md

Co-authored-by: Cory Hall <43035978+corymhall@users.noreply.github.com>

…cy call

corymhall

I found a couple of issues in my testing.

packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts

corymhall · 2022-11-21T21:15:45Z

packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts

+      return arn;
+    }
+
+    const policyDoc = JSON.parse(serializeStructure(template, true)).CdkBoostrapPermissionsBoundaryPolicy;


Suggested change

const policyDoc = JSON.parse(serializeStructure(template, true)).CdkBoostrapPermissionsBoundaryPolicy;

const policyDoc = JSON.parse(serializeStructure(template, true)).Resources.CdkBoostrapPermissionsBoundaryPolicy.Properties.PolicyDocument;

Also, looks like the policy is valid from CloudFormations perspective because it
contains CloudFormation intrinsics which doesn't work with the IAM API. Not sure
if it would be easier to do a Regex replacement or just manage the policy in two
places? I would be fine managing it in two places if that is easier.

do a Regex replacement

sounds more heavy-duty -- can I open a follow-up for that POC and switch back to the policy doc as string for now?

sounds more heavy-duty -- can I open a follow-up for that POC and switch back to the policy doc as string for now?

Yeah sounds good to me

corymhall

Couple of small things

packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts

Co-authored-by: Cory Hall <43035978+corymhall@users.noreply.github.com>

Naumel · 2022-11-23T13:29:05Z

@Mergifyio update

mergify · 2022-11-23T13:29:39Z

update

✅ Branch has been successfully updated

aws-cdk-automation · 2022-11-23T14:06:58Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 7669755
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2022-11-23T14:07:13Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aamielsan · 2023-01-18T19:47:54Z

packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml

+      Description: "Bootstrap Permission Boundary"
+      ManagedPolicyName:
+        Fn::Sub: cdk-${Qualifier}-permissions-boundary-${AWS::AccountId}-${AWS::Region}
+      Path: /
  # The SSM parameter is used in pipeline-deployed templates to verify the version
  # of the bootstrap resources.
  CdkBootstrapVersion:


Hi @Naumel @corymhall just curious, should the CdkBootstrapVersion be also updated as part of this change? (i.e. When do we increment this version?)

We're currently encountering an issue in our bootstrap stacks where:

developers with CDK toolkit v.2.54.0 are creating changesets to our toolkit stack and updating the template; and

developers with CDK toolkit less than v.2.54.0 creating changesets to our toolkit stack and downgrading the template.

Previously, we would encounter a warning:

Not downgrading existing bootstrap stack from version 'X+n' to version 'X'

that would prevent developers using an outdated CDK toolkit from downgrading the toolkit stack.

Wondering if this was the cause

feat: bootstrap arguments for permissions boundary

e2db370

#22744

aws-cdk-automation requested a review from a team November 4, 2022 20:23

github-actions bot added the p2 label Nov 4, 2022

mergify bot added the contribution/core This is a PR that came from AWS. label Nov 4, 2022

aws-cdk-automation previously requested changes Nov 4, 2022

View reviewed changes

Naumel and others added 10 commits November 4, 2022 21:28

Update cdk.ts

2353ce9

Collapsing old commits

302d4dc

Integ tests

8cea87e

Conditional permissions boundary

3749a90

Proper string used in the test for default permissions boundary

767755b

Split template cases based on th supplied argument.

efc8653

Typo fix

074450b

String-ify permissionsboundary

09c2bff

AWS::NoValue for no param permissions boundary

82101af

yaml is super fun

35f922a

corymhall suggested changes Nov 9, 2022

View reviewed changes

Update packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml

c102960

Co-authored-by: Cory Hall <43035978+corymhall@users.noreply.github.com>

corymhall added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Nov 10, 2022

Incorporating feedback

defeea8

Naumel commented Nov 14, 2022

View reviewed changes

packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml Outdated Show resolved Hide resolved

Naumel added 2 commits November 14, 2022 15:42

README rephrase

8961c3b

Added policy name validation

d47e3b5

corymhall mentioned this pull request Nov 14, 2022

feat(iam): apply permissions boundary to a Stage #22913

Merged

4 tasks

Adjusted param name and policy name input validation

9d5e667

Merge branch 'main' into perm-bound

ee95f76

Naumel added the pr-linter/cli-integ-tested Assert that any CLI changes have been integ tested label Nov 15, 2022

Merge branch 'main' into perm-bound

3823e1e

Update packages/aws-cdk/README.md

2fa9d19

Missed one 😅

corymhall suggested changes Nov 21, 2022

View reviewed changes

Naumel and others added 3 commits November 21, 2022 20:07

Apply suggestions from code review

bd7fbc2

Co-authored-by: Cory Hall <43035978+corymhall@users.noreply.github.com>

Partition must be part of the IAM policy arn for a successful getPoli…

0745549

…cy call

Swapped the two error throwing points

dbf096c

corymhall suggested changes Nov 21, 2022

View reviewed changes

Naumel and others added 4 commits November 21, 2022 22:54

Have dual policy definition for the time being

3a660ee

Fixed the param name for the template

0b994a0

adjusted the test for the input param name

1e7d1bd

renaming remaining

8e29fb7

corymhall suggested changes Nov 22, 2022

View reviewed changes

packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts Show resolved Hide resolved

packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts Outdated Show resolved Hide resolved

packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts Outdated Show resolved Hide resolved

Naumel and others added 4 commits November 22, 2022 14:56

Fixing bootstrap prompt when using example policy

58510fc

previous commit redo

7f03db2

Apply missed partition in arn

16cf026

Co-authored-by: Cory Hall <43035978+corymhall@users.noreply.github.com>

Bubble up any IAM call error

79ecf77

corymhall added the pr/do-not-merge This PR should not be merged at this time. label Nov 22, 2022

corymhall approved these changes Nov 22, 2022

View reviewed changes

Naumel removed the pr/do-not-merge This PR should not be merged at this time. label Nov 23, 2022

Merge branch 'main' into perm-bound

7669755

mergify bot merged commit 6224b6d into main Nov 23, 2022

mergify bot deleted the perm-bound branch November 23, 2022 14:07

aamielsan reviewed Jan 18, 2023

View reviewed changes

aamielsan mentioned this pull request Jan 18, 2023

(cli): Detect when attempting to bootstrap with older bootstrap version #23739

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: bootstrap arguments for permissions boundary #22792

feat: bootstrap arguments for permissions boundary #22792

Naumel commented Nov 4, 2022 •

edited

gitpod-io bot commented Nov 4, 2022

aws-cdk-automation left a comment

corymhall left a comment

Naumel commented Nov 15, 2022 •

edited

mergify bot commented Nov 15, 2022

mergify bot commented Nov 15, 2022

Naumel commented Nov 21, 2022

mergify bot commented Nov 21, 2022

corymhall left a comment

corymhall left a comment

corymhall Nov 21, 2022

Naumel Nov 21, 2022

corymhall Nov 22, 2022

corymhall left a comment

Naumel commented Nov 23, 2022

mergify bot commented Nov 23, 2022

aws-cdk-automation commented Nov 23, 2022

mergify bot commented Nov 23, 2022

aamielsan Jan 18, 2023

	const policyDoc = JSON.parse(serializeStructure(template, true)).CdkBoostrapPermissionsBoundaryPolicy;
	const policyDoc = JSON.parse(serializeStructure(template, true)).Resources.CdkBoostrapPermissionsBoundaryPolicy.Properties.PolicyDocument;

feat: bootstrap arguments for permissions boundary #22792

feat: bootstrap arguments for permissions boundary #22792

Conversation

Naumel commented Nov 4, 2022 • edited

All Submissions:

Adding new Unconventional Dependencies:

New Features

gitpod-io bot commented Nov 4, 2022

aws-cdk-automation left a comment

Choose a reason for hiding this comment

corymhall left a comment

Choose a reason for hiding this comment

Naumel commented Nov 15, 2022 • edited

mergify bot commented Nov 15, 2022

✅ Branch has been successfully updated

mergify bot commented Nov 15, 2022

☑️ Nothing to do

Naumel commented Nov 21, 2022

mergify bot commented Nov 21, 2022

✅ Branch has been successfully updated

corymhall left a comment

Choose a reason for hiding this comment

corymhall left a comment

Choose a reason for hiding this comment

corymhall Nov 21, 2022

Choose a reason for hiding this comment

Naumel Nov 21, 2022

Choose a reason for hiding this comment

corymhall Nov 22, 2022

Choose a reason for hiding this comment

corymhall left a comment

Choose a reason for hiding this comment

Naumel commented Nov 23, 2022

mergify bot commented Nov 23, 2022

✅ Branch has been successfully updated

aws-cdk-automation commented Nov 23, 2022

AWS CodeBuild CI Report

mergify bot commented Nov 23, 2022

aamielsan Jan 18, 2023

Choose a reason for hiding this comment

Naumel commented Nov 4, 2022 •

edited

Naumel commented Nov 15, 2022 •

edited