search

aws-solutions / aws-control-tower-customizations

The Customizations for AWS Control Tower solution combines AWS Control Tower and other highly-available, trusted AWS services to help customers more quickly set up a secure, multi-account AWS environment using AWS best practices.
https://docs.aws.amazon.com/controltower/latest/userguide/cfct-overview.html
Apache License 2.0
360 stars 205 forks source link

"AWS CloudFormation StackSets update to permission model" #143

Closed akefirad closed 1 year ago

akefirad commented 1 year ago

Is your feature request related to a problem? Please describe. It's more of a question, apologies in advance if this is not the right place to ask this.

Recently I received an email from AWS regarding the change in the required permissions to maintain "self-managed AWS CloudFormation StackSets". I'm not fully sure if this is relevant to CfCT or not.

As far as I can tell, there's no such role in my stack. The main part of the email reads:

We have updated our back-end permissions policy to simplify on-boarding to self-managed AWS CloudFormation StackSets. Starting October 31, 2022, AWS CloudFormation StackSets no longer requires sns* permissions in AWSCloudFormationStackSetExecutionRole as a prerequisite for getting started with self-managed StackSets.

Customers not planning to use any SNS resources can safely remove their existing sns* permissions from their AWSCloudFormationStackSetExecutionRole. These are only required when provisioning Amazon SNS resources.

StackSets requires you to create a service role named AWSCloudFormationStackSetExecutionRole that trusts the customized administration role for each target account. Previously, you needed to provide sns:, s3:, and cloudformation: permissions to AWSCloudFormationStackSetExecutionRole as prerequisites to allow StackSets to manage and provision resources on your behalf. Now, StackSets has removed the explicit need for sns: permissions as prerequisites in AWSCloudFormationStackSetExecutionRole. Please note, you will still need to provide s3: and cloudformation: permissions in AWSCloudFormationStackSetExecutionRole.

Would you please comment if this is relevant to CfCT or if we need to take any action on this. Thanks.

stumins commented 1 year ago

Hi @akefirad,

This is a general email sent to all StackSets users, which includes accounts that have deployed CFCT (because CFCT leverages StackSets).

CFCT uses the AWSControlTowerExecutionRole in member accounts to deploy resources, and no action is required from customers.