Skip to content

Commit ae2b824

Browse files
michaelwittigclaytondaley
michaelwittig
and
claytondaley
authored
[Improvement] * - Support permission boundaries (widdix#465) (widdix#473)
Co-authored-by: Clayton Daley <[email protected]>
1 parent c2d4d62 commit ae2b824

27 files changed

+297
-0
lines changed

Diff for: ‎ec2/al2-mutable-private.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ Metadata:
4545
- KeyName
4646
- IAMUserSSHAccess
4747
- ManagedPolicyArns
48+
- PermissionsBoundary
4849
- Label:
4950
default: 'EC2 Parameters'
5051
Parameters:
@@ -163,6 +164,10 @@ Parameters:
163164
Description: 'Optional comma-delimited list of IAM managed policy ARNs to attach to the instance''s IAM role.'
164165
Type: String
165166
Default: ''
167+
PermissionsBoundary:
168+
Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
169+
Type: String
170+
Default: ''
166171
RootVolumeSize:
167172
Description: 'The root volume size, in Gibibytes (GiB) (if RestoreImageId is set, value must be >= snapshot of AMI).'
168173
Type: Number
@@ -446,6 +451,7 @@ Mappings:
446451
'us-west-2':
447452
AMI: 'ami-04590e7389a6e577c'
448453
Conditions:
454+
HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
449455
HasKmsKey: !Not [!Equals [!Ref ParentKmsKeyStack, '']]
450456
HasKeyName: !Not [!Equals [!Ref KeyName, '']]
451457
HasIAMUserSSHAccess: !Equals [!Ref IAMUserSSHAccess, 'true']
@@ -561,6 +567,7 @@ Resources:
561567
Service: 'ec2.amazonaws.com'
562568
Action: 'sts:AssumeRole'
563569
ManagedPolicyArns: !If [HasManagedPolicyArns, !Split [',', !Ref ManagedPolicyArns], !Ref 'AWS::NoValue']
570+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
564571
Policies:
565572
- PolicyName: ssm
566573
PolicyDocument:
@@ -1060,6 +1067,7 @@ Resources:
10601067
Principal:
10611068
Service: 'backup.amazonaws.com'
10621069
Action: 'sts:AssumeRole'
1070+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
10631071
Policies:
10641072
- PolicyName: backup
10651073
PolicyDocument:

Diff for: ‎ec2/al2-mutable-public.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ Metadata:
4545
- KeyName
4646
- IAMUserSSHAccess
4747
- ManagedPolicyArns
48+
- PermissionsBoundary
4849
- Label:
4950
default: 'EC2 Parameters'
5051
Parameters:
@@ -163,6 +164,10 @@ Parameters:
163164
Description: 'Optional comma-delimited list of IAM managed policy ARNs to attach to the instance''s IAM role.'
164165
Type: String
165166
Default: ''
167+
PermissionsBoundary:
168+
Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
169+
Type: String
170+
Default: ''
166171
RootVolumeSize:
167172
Description: 'The root volume size, in Gibibytes (GiB) (if RestoreImageId is set, value must be >= snapshot of AMI).'
168173
Type: Number
@@ -446,6 +451,7 @@ Mappings:
446451
'us-west-2':
447452
AMI: 'ami-04590e7389a6e577c'
448453
Conditions:
454+
HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
449455
HasKmsKey: !Not [!Equals [!Ref ParentKmsKeyStack, '']]
450456
HasKeyName: !Not [!Equals [!Ref KeyName, '']]
451457
HasIAMUserSSHAccess: !Equals [!Ref IAMUserSSHAccess, 'true']
@@ -570,6 +576,7 @@ Resources:
570576
Service: 'ec2.amazonaws.com'
571577
Action: 'sts:AssumeRole'
572578
ManagedPolicyArns: !If [HasManagedPolicyArns, !Split [',', !Ref ManagedPolicyArns], !Ref 'AWS::NoValue']
579+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
573580
Policies:
574581
- PolicyName: ssm
575582
PolicyDocument:
@@ -1070,6 +1077,7 @@ Resources:
10701077
Principal:
10711078
Service: 'backup.amazonaws.com'
10721079
Action: 'sts:AssumeRole'
1080+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
10731081
Policies:
10741082
- PolicyName: backup
10751083
PolicyDocument:

Diff for: ‎ec2/ec2-auto-recovery.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@ Metadata:
4646
- IngressTcpPort3
4747
- IngressTcpParentClientStack3
4848
- ManagedPolicyArns
49+
- Label:
50+
default: 'Permission Parameters'
51+
Parameters:
52+
- PermissionsBoundary
4953
Parameters:
5054
ParentVPCStack:
5155
Description: 'Stack name of parent VPC stack based on vpc/vpc-*azs.yaml template.'
@@ -74,6 +78,10 @@ Parameters:
7478
Description: 'Optional stack name of parent Client Security Group stack based on state/client-sg.yaml template to allow network access from the EC2 instance to whatever uses the client security group.'
7579
Type: String
7680
Default: ''
81+
PermissionsBoundary:
82+
Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
83+
Type: String
84+
Default: ''
7785
KeyName:
7886
Description: 'Optional key pair of the ec2-user to establish a SSH connection to the EC2 instance.'
7987
Type: String
@@ -197,6 +205,7 @@ Mappings:
197205
'us-west-2':
198206
AMI: 'ami-0873b46c45c11058d'
199207
Conditions:
208+
HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
200209
HasKeyName: !Not [!Equals [!Ref KeyName, '']]
201210
HasIAMUserSSHAccess: !Equals [!Ref IAMUserSSHAccess, 'true']
202211
HasSystemsManagerAccess: !Equals [!Ref SystemsManagerAccess, 'true']
@@ -319,6 +328,7 @@ Resources:
319328
Service: 'ec2.amazonaws.com'
320329
Action: 'sts:AssumeRole'
321330
ManagedPolicyArns: !If [HasManagedPolicyArns, !Split [',', !Ref ManagedPolicyArns], !Ref 'AWS::NoValue']
331+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
322332
Policies:
323333
- !If
324334
- HasSystemsManagerAccess

Diff for: ‎ecs/cluster-cost-optimized.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,10 @@ Metadata:
5151
- MinSize
5252
- DrainingTimeoutInSeconds
5353
- StopContainerTimeoutInSeconds
54+
- Label:
55+
default: 'Permission Parameters'
56+
Parameters:
57+
- PermissionsBoundary
5458
Parameters:
5559
ParentVPCStack:
5660
Description: 'Stack name of parent VPC stack based on vpc/vpc-*azs.yaml template.'
@@ -83,6 +87,10 @@ Parameters:
8387
Description: 'Optional stack name of parent Client Security Group stack based on state/client-sg.yaml template to allow network access from the cluster to whatever uses the client security group.'
8488
Type: String
8589
Default: ''
90+
PermissionsBoundary:
91+
Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
92+
Type: String
93+
Default: ''
8694
KeyName:
8795
Description: 'Optional key pair of the ec2-user to establish a SSH connection to the EC2 instances of the ECS cluster.'
8896
Type: String
@@ -207,6 +215,7 @@ Mappings:
207215
'us-west-2':
208216
ECSAMI: 'ami-01e1d12a048e67ed2'
209217
Conditions:
218+
HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
210219
HasKeyName: !Not [!Equals [!Ref KeyName, '']]
211220
HasIAMUserSSHAccess: !Equals [!Ref IAMUserSSHAccess, 'true']
212221
HasSystemsManagerAccess: !Equals [!Ref SystemsManagerAccess, 'true']
@@ -248,6 +257,7 @@ Resources:
248257
Service: 'ec2.amazonaws.com'
249258
Action: 'sts:AssumeRole'
250259
ManagedPolicyArns: !If [HasManagedPolicyArns, !Split [',', !Ref ManagedPolicyArns], !Ref 'AWS::NoValue']
260+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
251261
Policies:
252262
- !If
253263
- HasSystemsManagerAccess
@@ -917,6 +927,7 @@ Resources:
917927
Principal:
918928
Service: 'autoscaling.amazonaws.com'
919929
Action: 'sts:AssumeRole'
930+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
920931
Policies:
921932
- PolicyName: sqs
922933
PolicyDocument:
@@ -1107,6 +1118,7 @@ Resources:
11071118
Principal:
11081119
Service: 'lambda.amazonaws.com'
11091120
Action: 'sts:AssumeRole'
1121+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
11101122
Policies:
11111123
- PolicyName: autoscaling
11121124
PolicyDocument:
@@ -1207,6 +1219,7 @@ Resources:
12071219
Principal:
12081220
Service: 'lambda.amazonaws.com'
12091221
Action: 'sts:AssumeRole'
1222+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
12101223
Policies:
12111224
- PolicyName: draininstance
12121225
PolicyDocument:

Diff for: ‎ecs/cluster.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,10 @@ Metadata:
5858
- ContainerMaxMemory
5959
- ContainerShortageThreshold
6060
- ContainerExcessThreshold
61+
- Label:
62+
default: 'Permission Parameters'
63+
Parameters:
64+
- PermissionsBoundary
6165
Parameters:
6266
ParentVPCStack:
6367
Description: 'Stack name of parent VPC stack based on vpc/vpc-*azs.yaml template.'
@@ -90,6 +94,10 @@ Parameters:
9094
Description: 'Optional stack name of parent Client Security Group stack based on state/client-sg.yaml template to allow network access from the cluster to whatever uses the client security group.'
9195
Type: String
9296
Default: ''
97+
PermissionsBoundary:
98+
Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
99+
Type: String
100+
Default: ''
93101
KeyName:
94102
Description: 'Optional key pair of the ec2-user to establish a SSH connection to the EC2 instances of the ECS cluster.'
95103
Type: String
@@ -234,6 +242,7 @@ Mappings:
234242
'us-west-2':
235243
ECSAMI: 'ami-01e1d12a048e67ed2'
236244
Conditions:
245+
HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
237246
HasKeyName: !Not [!Equals [!Ref KeyName, '']]
238247
HasIAMUserSSHAccess: !Equals [!Ref IAMUserSSHAccess, 'true']
239248
HasSystemsManagerAccess: !Equals [!Ref SystemsManagerAccess, 'true']
@@ -275,6 +284,7 @@ Resources:
275284
Service: 'ec2.amazonaws.com'
276285
Action: 'sts:AssumeRole'
277286
ManagedPolicyArns: !If [HasManagedPolicyArns, !Split [',', !Ref ManagedPolicyArns], !Ref 'AWS::NoValue']
287+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
278288
Policies:
279289
- !If
280290
- HasSystemsManagerAccess
@@ -959,6 +969,7 @@ Resources:
959969
Principal:
960970
Service: 'autoscaling.amazonaws.com'
961971
Action: 'sts:AssumeRole'
972+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
962973
Policies:
963974
- PolicyName: sqs
964975
PolicyDocument:
@@ -1139,6 +1150,7 @@ Resources:
11391150
Principal:
11401151
Service: 'lambda.amazonaws.com'
11411152
Action: 'sts:AssumeRole'
1153+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
11421154
Policies:
11431155
- PolicyName: ecs
11441156
PolicyDocument:
@@ -1303,6 +1315,7 @@ Resources:
13031315
Principal:
13041316
Service: 'lambda.amazonaws.com'
13051317
Action: 'sts:AssumeRole'
1318+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
13061319
Policies:
13071320
- PolicyName: draininstance
13081321
PolicyDocument:

Diff for: ‎ecs/service-cluster-alb.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,10 @@ Metadata:
4444
- MaxCapacity
4545
- MinCapacity
4646
- HealthCheckGracePeriod
47+
- Label:
48+
default: 'Permission Parameters'
49+
Parameters:
50+
- PermissionsBoundary
4751
Parameters:
4852
ParentClusterStack:
4953
Description: 'Stack name of parent Cluster stack based on ecs/cluster.yaml template.'
@@ -56,6 +60,10 @@ Parameters:
5660
Description: 'Optional stack name of parent zone stack based on vpc/zone-*.yaml template.'
5761
Type: String
5862
Default: ''
63+
PermissionsBoundary:
64+
Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
65+
Type: String
66+
Default: ''
5967
LoadBalancerPriority:
6068
Description: 'The priority for the rule. Elastic Load Balancing evaluates rules in priority order, from the lowest value to the highest value. If a request satisfies a rule, Elastic Load Balancing ignores all subsequent rules. A target group can have only one rule with a given priority.'
6169
Type: Number
@@ -126,6 +134,7 @@ Parameters:
126134
MinValue: 0
127135
MaxValue: 1800
128136
Conditions:
137+
HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
129138
HasLoadBalancerHttps: !Equals [!Ref LoadBalancerHttps, 'true']
130139
HasLoadBalancerPath: !Not [!Equals [!Ref LoadBalancerPath, '']]
131140
HasLoadBalancerHostPattern: !Not [!Equals [!Ref LoadBalancerHostPattern, '']]
@@ -302,6 +311,7 @@ Resources:
302311
Principal:
303312
Service: 'ecs.amazonaws.com'
304313
Action: 'sts:AssumeRole'
314+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
305315
Service:
306316
Type: 'AWS::ECS::Service'
307317
Properties:
@@ -371,6 +381,7 @@ Resources:
371381
Principal:
372382
Service: 'application-autoscaling.amazonaws.com'
373383
Action: 'sts:AssumeRole'
384+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
374385
Policies:
375386
- PolicyName: ecs
376387
PolicyDocument:

Diff for: ‎ecs/service-dedicated-alb.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@ Metadata:
4646
- MaxCapacity
4747
- MinCapacity
4848
- HealthCheckGracePeriod
49+
- Label:
50+
default: 'Permission Parameters'
51+
Parameters:
52+
- PermissionsBoundary
4953
Parameters:
5054
ParentVPCStack:
5155
Description: 'Stack name of parent VPC stack based on vpc/vpc-*azs.yaml template.'
@@ -69,6 +73,10 @@ Parameters:
6973
Description: 'Optional stack name of parent s3 stack based on state/s3.yaml template (with Access set to ElbAccessLogWrite) to store access logs.'
7074
Type: String
7175
Default: ''
76+
PermissionsBoundary:
77+
Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
78+
Type: String
79+
Default: ''
7280
LoadBalancerScheme:
7381
Description: 'Indicates whether the load balancer in front of the ECS service is internet-facing or internal.'
7482
Type: String
@@ -130,6 +138,7 @@ Parameters:
130138
MinValue: 0
131139
MaxValue: 1800
132140
Conditions:
141+
HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
133142
HasAuthProxySecurityGroup: !Not [!Equals [!Ref ParentAuthProxyStack, '']]
134143
HasNotAuthProxySecurityGroup: !Equals [!Ref ParentAuthProxyStack, '']
135144
HasLoadBalancerSchemeInternetFacing: !Equals [!Ref LoadBalancerScheme, 'internet-facing']
@@ -397,6 +406,7 @@ Resources:
397406
Principal:
398407
Service: 'ecs.amazonaws.com'
399408
Action: 'sts:AssumeRole'
409+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
400410
Service:
401411
Type: 'AWS::ECS::Service'
402412
DependsOn: HttpListener
@@ -467,6 +477,7 @@ Resources:
467477
Principal:
468478
Service: 'application-autoscaling.amazonaws.com'
469479
Action: 'sts:AssumeRole'
480+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
470481
Policies:
471482
- PolicyName: ecs
472483
PolicyDocument:

Diff for: ‎fargate/service-cloudmap.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,10 @@ Metadata:
7272
- MaxCapacity
7373
- MinCapacity
7474
- LogsRetentionInDays
75+
- Label:
76+
default: 'Permission Parameters'
77+
Parameters:
78+
- PermissionsBoundary
7579
Parameters:
7680
ParentVPCStack:
7781
Description: 'Stack name of parent VPC stack based on vpc/vpc-*azs.yaml template.'
@@ -105,6 +109,10 @@ Parameters:
105109
Description: 'Optional but recommended stack name of parent SSH bastion host/instance stack based on vpc/vpc-*-bastion.yaml template.'
106110
Type: String
107111
Default: ''
112+
PermissionsBoundary:
113+
Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
114+
Type: String
115+
Default: ''
108116
TaskPolicies:
109117
Description: 'Comma-delimited list of IAM managed policy ARNs to attach to the task IAM role'
110118
Type: String
@@ -347,6 +355,7 @@ Mappings:
347355
'30':
348356
Memory: 30720
349357
Conditions:
358+
HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
350359
HasAlertTopic: !Not [!Equals [!Ref ParentAlertStack, '']]
351360
HasSubnetsReachPublic: !Equals [!Ref SubnetsReach, Public]
352361
HasAutoScaling: !Equals [!Ref AutoScaling, 'true']
@@ -395,6 +404,7 @@ Resources:
395404
Principal:
396405
Service: 'ecs-tasks.amazonaws.com'
397406
Action: 'sts:AssumeRole'
407+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
398408
Policies:
399409
- PolicyName: AmazonECSTaskExecutionRolePolicy # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html
400410
PolicyDocument:
@@ -421,6 +431,7 @@ Resources:
421431
Service: 'ecs-tasks.amazonaws.com'
422432
Action: 'sts:AssumeRole'
423433
ManagedPolicyArns: !If [HasTaskPolicies, !Split [',', !Ref TaskPolicies], !Ref 'AWS::NoValue']
434+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
424435
TaskDefinition:
425436
Type: 'AWS::ECS::TaskDefinition'
426437
Properties:
@@ -584,6 +595,7 @@ Resources:
584595
Principal:
585596
Service: 'application-autoscaling.amazonaws.com'
586597
Action: 'sts:AssumeRole'
598+
PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
587599
Policies:
588600
- PolicyName: AmazonEC2ContainerServiceAutoscaleRole
589601
PolicyDocument:

0 commit comments

Comments
 (0)