Proposal: IAM role path's

[jplock]

Description:

I'd like to be able to specify the IAM role Path on either a function or globals.

Observed result:

Able to specify Path on a Function or Globals

Expected result:

Path is set on the implicitly created IAM roles

[jplock]

Would you accept a PR for this?

[keetonian]

@jplock just to confirm: you'd like to expose this path property from the implicit AWS::IAM::Role resource?

And for our curiosity- what is your use case for wanting this property exposed?

[jplock]

@keetonian yes, correct. We have policies in place to allow teams to only create IAM roles via CloudFormation templates if they provide a specific CF service role. The service role only allows managing IAM policies with a specific Path and a PermissionBoundary must also be applied. The Path allows us to restrict the IAM roles developers can manage to only the ones they’ve created themselves within the Path.

Hopefully that makes sense.

With out this change, we have to define explicit roles in SAM to set both the Path and PermissionBoundary (although PermissionsBoundary is already supported).

[keetonian]

Ok, this could be a good addition then. I think we should add this property to the AWS::Serverless::Function spec like we have for PermissionsBoundary, and what do you think about calling it RolePath?

To add this property:

Add RolePath as a new property here: https://github.com/awslabs/serverless-application-model/blob/develop/samtranslator/model/sam_resources.py#L68

Do the translation to an AWS::IAM::Role here: https://github.com/awslabs/serverless-application-model/blob/develop/samtranslator/model/sam_resources.py#L528

Update tests as appropriate

[jplock]

Great, happy to work on that.

[jplock]

Created #1567 for this change.

[mattjhill]

Is there any plan to implement this? I have a similar use case as described above and need to be able to specify a RolePath to continue using my current SAM templates.