How does one add an iam:PermissionsBoundary to a role created via CloudFormation template

user_10380523 0
Viewed 1590

I have a user who can create roles iff there is an attached permission boundary. The user can execute this function via the AWS console and via API calls from the API. However, there does not seem to be a way to automate the process in CloudFormation. Is it possible to create a role in a CFT and attach a permissions boundary to it?

amazon-cloudformation amazon-web-services
1 Answers

Permissions Boundary is now supported by the CloudFormation's schema https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html. 

{
  "Type" : "AWS::IAM::Role",
  "Properties" : {
      "AssumeRolePolicyDocument" : Json,
      "ManagedPolicyArns" : [ String, ... ],
      "MaxSessionDuration" : Integer,
      "Path" : String,
      "PermissionsBoundary" : String,
      "Policies" : [ Policy, ... ],
      "RoleName" : String
    }
}

YAML
Type: AWS::IAM::Role
Properties : 
  AssumeRolePolicyDocument : Json
  ManagedPolicyArns : 
    - String
  MaxSessionDuration : Integer
  Path : String
  PermissionsBoundary : String
  Policies : 
    - Policy
  RoleName : String

As an aside, the support for it was available in Terraform before it was in CFT.

user_103805230
Related