support custom permission boundaries

[josefaidt]

Environment information

n/a

Description

When bootstrapping an account and region with a custom permissions boundary, it would be nice if the boundary was applied to Amplify-created stacks and resources

cdk bootstrap --custom-permissions-boundary <iam-policy-name>

As a workaround, we can apply this manually to resources in the backend

import { defineBackend } from '@aws-amplify/backend';
import { auth } from './auth/resource';
import { data } from './data/resource';
import { Aspects, CfnResource, Stack } from "aws-cdk-lib";
import { IConstruct } from "constructs";

/**
 * @see https://docs.amplify.aws/react/build-a-backend/ to add storage, functions, and more
 */
const backend = defineBackend({
  auth,
  data,
});

const rootScope = Stack.of(backend.auth.resources.userPool).node.scope

if (rootScope) {
  Aspects.of(rootScope).add({
    visit(node: IConstruct) {
      if (
          CfnResource.isCfnResource(node) &&
          (node.cfnResourceType == 'AWS::IAM::Role' || node.cfnResourceType == 'AWS::IAM::User')
      ) {
        node.addPropertyOverride('PermissionsBoundary', 'arn:aws:iam::<REDACTED ACCOUNT ID>:policy/product-pb');
      }
    },
  });
}

[ykethan]

Marking as feature request for further evaluation.