Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(aws-cloudformation): add permission management to CreateUpdate and Delete Stack CodePipeline Actions #880

Merged
merged 1 commit into from
Oct 11, 2018
Merged

feat(aws-cloudformation): add permission management to CreateUpdate and Delete Stack CodePipeline Actions #880

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 30 additions & 4 deletions packages/@aws-cdk/aws-cloudformation/lib/pipeline-actions.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,12 @@ export abstract class PipelineCloudFormationDeployAction extends PipelineCloudFo
this.role.addToPolicy(new iam.PolicyStatement().addAction('*').addAllResources());
}
}

// Allow the pipeline to pass this actions' role to CloudFormation
// Required by all Actions that perform CFN deployments
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add a comment explaining why this is needed

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't reckon that's needed for all actions (you need this only to CreateReplaceChangeSet, but not to ExecuteChangeSet, for example). Factoring this here violates the principle of least privilege to me. Since this allows passing a role with permissions to do "everything" (via CloudFormation), I would argue we need this to be as tight as possible.

Copy link
Contributor Author

@skinny85 skinny85 Oct 10, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not needed for all Actions. This code has been moved to PipelineCloudFormationDeployAction, of which all subclasses need it. ExecuteChangeSet extends a different class (PipelineCloudFormationAction), and thus does not have this permission.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add a comment explaining why this is needed

Done.

.addAction('iam:PassRole')
.addResource(this.role.roleArn));
}

/**
Expand Down Expand Up @@ -265,10 +271,6 @@ export class PipelineCreateReplaceChangeSetAction extends PipelineCloudFormation
.addActions('cloudformation:CreateChangeSet', 'cloudformation:DeleteChangeSet', 'cloudformation:DescribeChangeSet')
.addResource(stackArn)
.addCondition('StringEquals', { 'cloudformation:ChangeSetName': props.changeSetName }));
// Allow the pipeline to pass this actions' role to CloudFormation
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
.addAction('iam:PassRole')
.addResource(this.role.roleArn));
}
}

Expand Down Expand Up @@ -318,6 +320,23 @@ export class PipelineCreateUpdateStackAction extends PipelineCloudFormationDeplo
TemplatePath: props.templatePath.location
});
this.addInputArtifact(props.templatePath.artifact);

// permissions are based on best-guess from
// https://docs.aws.amazon.com/codepipeline/latest/userguide/how-to-custom-role.html
// and https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloudformation.html
const stackArn = stackArnFromName(props.stackName);
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
.addActions(
'cloudformation:DescribeStack*',
'cloudformation:CreateStack',
'cloudformation:UpdateStack',
'cloudformation:DeleteStack', // needed when props.replaceOnFailure is true
'cloudformation:GetTemplate*',
'cloudformation:ValidateTemplate',
'cloudformation:GetStackPolicy',
'cloudformation:SetStackPolicy',
)
.addResource(stackArn));
}
}

Expand All @@ -339,6 +358,13 @@ export class PipelineDeleteStackAction extends PipelineCloudFormationDeployActio
super(parent, id, props, {
ActionMode: 'DELETE_ONLY',
});
const stackArn = stackArnFromName(props.stackName);
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
.addActions(
'cloudformation:DescribeStack*',
'cloudformation:DeleteStack',
)
.addResource(stackArn));
}
}

Expand Down
65 changes: 51 additions & 14 deletions packages/@aws-cdk/aws-cloudformation/test/test.pipeline-actions.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ import nodeunit = require('nodeunit');
import cloudformation = require('../lib');

export = nodeunit.testCase({
CreateReplaceChangeSet: {
'CreateReplaceChangeSet': {
works(test: nodeunit.Test) {
const stack = new cdk.Stack();
const pipelineRole = new RoleDouble(stack, 'PipelineRole');
Expand All @@ -21,11 +21,7 @@ export = nodeunit.testCase({

_assertPermissionGranted(test, pipelineRole.statements, 'iam:PassRole', action.role.roleArn);

const stackArn = cdk.ArnUtils.fromComponents({
service: 'cloudformation',
resource: 'stack',
resourceName: 'MyStack/*'
});
const stackArn = _stackArn('MyStack');
const changeSetCondition = { StringEquals: { 'cloudformation:ChangeSetName': 'MyChangeSet' } };
_assertPermissionGranted(test, pipelineRole.statements, 'cloudformation:DescribeStacks', stackArn);
_assertPermissionGranted(test, pipelineRole.statements, 'cloudformation:DescribeChangeSet', stackArn, changeSetCondition);
Expand All @@ -44,7 +40,7 @@ export = nodeunit.testCase({
test.done();
}
},
ExecuteChangeSet: {
'ExecuteChangeSet': {
works(test: nodeunit.Test) {
const stack = new cdk.Stack();
const pipelineRole = new RoleDouble(stack, 'PipelineRole');
Expand All @@ -55,11 +51,7 @@ export = nodeunit.testCase({
stackName: 'MyStack',
});

const stackArn = cdk.ArnUtils.fromComponents({
service: 'cloudformation',
resource: 'stack',
resourceName: 'MyStack/*'
});
const stackArn = _stackArn('MyStack');
_assertPermissionGranted(test, pipelineRole.statements, 'cloudformation:ExecuteChangeSet', stackArn,
{ StringEquals: { 'cloudformation:ChangeSetName': 'MyChangeSet' } });

Expand All @@ -71,7 +63,44 @@ export = nodeunit.testCase({

test.done();
}
}
},

'the CreateUpdateStack Action sets the DescribeStack*, Create/Update/DeleteStack & PassRole permissions'(test: nodeunit.Test) {
const stack = new cdk.Stack();
const pipelineRole = new RoleDouble(stack, 'PipelineRole');
const action = new cloudformation.PipelineCreateUpdateStackAction(stack, 'Action', {
stage: new StageDouble({ pipelineRole }),
templatePath: new cpapi.Artifact(stack as any, 'TestArtifact').atPath('some/file'),
stackName: 'MyStack',
});
const stackArn = _stackArn('MyStack');

_assertPermissionGranted(test, pipelineRole.statements, 'cloudformation:DescribeStack*', stackArn);
_assertPermissionGranted(test, pipelineRole.statements, 'cloudformation:CreateStack', stackArn);
_assertPermissionGranted(test, pipelineRole.statements, 'cloudformation:UpdateStack', stackArn);
_assertPermissionGranted(test, pipelineRole.statements, 'cloudformation:DeleteStack', stackArn);

_assertPermissionGranted(test, pipelineRole.statements, 'iam:PassRole', action.role.roleArn);

test.done();
},

'the DeleteStack Action sets the DescribeStack*, DeleteStack & PassRole permissions'(test: nodeunit.Test) {
const stack = new cdk.Stack();
const pipelineRole = new RoleDouble(stack, 'PipelineRole');
const action = new cloudformation.PipelineDeleteStackAction(stack, 'Action', {
stage: new StageDouble({ pipelineRole }),
stackName: 'MyStack',
});
const stackArn = _stackArn('MyStack');

_assertPermissionGranted(test, pipelineRole.statements, 'cloudformation:DescribeStack*', stackArn);
_assertPermissionGranted(test, pipelineRole.statements, 'cloudformation:DeleteStack', stackArn);

_assertPermissionGranted(test, pipelineRole.statements, 'iam:PassRole', action.role.roleArn);

test.done();
},
});

interface PolicyStatementJson {
Expand Down Expand Up @@ -121,7 +150,7 @@ function _assertPermissionGranted(test: nodeunit.Test, statements: PolicyStateme
: '';
const statementsStr = JSON.stringify(cdk.resolve(statements), null, 2);
test.ok(_grantsPermission(statements, action, resource, conditions),
`Expected to find a statement granting ${action} on ${cdk.resolve(resource)}${conditionStr}, found:\n${statementsStr}`);
`Expected to find a statement granting ${action} on ${JSON.stringify(cdk.resolve(resource))}${conditionStr}, found:\n${statementsStr}`);
}

function _grantsPermission(statements: PolicyStatementJson[], action: string, resource: string, conditions?: any) {
Expand All @@ -145,6 +174,14 @@ function _isOrContains(entity: string | string[], value: string): boolean {
return false;
}

function _stackArn(stackName: string): string {
return cdk.ArnUtils.fromComponents({
service: 'cloudformation',
resource: 'stack',
resourceName: `${stackName}/*`,
});
}

class StageDouble implements cpapi.IStage, cpapi.IInternalStage {
public readonly name: string;
public readonly pipelineArn: string;
Expand Down
20 changes: 10 additions & 10 deletions packages/@aws-cdk/aws-codepipeline/test/integ.cfn-template-from-repo.lit.expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,16 @@
]
}
},
{
"Action": "iam:PassRole",
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineDeployPrepareChangesRoleD28C853C",
"Arn"
]
}
},
{
"Action": "cloudformation:DescribeStacks",
"Effect": "Allow",
Expand Down Expand Up @@ -145,16 +155,6 @@
]
}
},
{
"Action": "iam:PassRole",
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineDeployPrepareChangesRoleD28C853C",
"Arn"
]
}
},
{
"Action": "cloudformation:ExecuteChangeSet",
"Condition": {
Expand Down
20 changes: 10 additions & 10 deletions packages/@aws-cdk/aws-codepipeline/test/integ.pipeline-cfn.expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,16 @@
}
]
},
{
"Action": "iam:PassRole",
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"CfnChangeSetRole6F05F6FC",
"Arn"
]
}
},
{
"Action": "cloudformation:DescribeStacks",
"Effect": "Allow",
Expand Down Expand Up @@ -159,16 +169,6 @@
]
]
}
},
{
"Action": "iam:PassRole",
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"CfnChangeSetRole6F05F6FC",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down