search

aws-solutions / aws-waf-security-automations

This solution automatically deploys a single web access control list (web ACL) with a set of AWS WAF rules designed to filter common web-based attacks.
https://aws.amazon.com/solutions/aws-waf-security-automations
Apache License 2.0
837 stars 359 forks source link

allow a permission boundary for roles #176

Closed pkennedyvt closed 1 year ago

pkennedyvt commented 3 years ago

Issue #, if available: 161

Description of changes:

This adds a yes/no parameter for using permissions boundary in role creation and accepts the arn if needed.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

aijunpeng commented 3 years ago

Thanks for submitting the PR. We have added it to our backlog and it will be considered in future releases.

mfcze commented 3 years ago

Hi there, would you pls provide an update where we are with this little tweak required which would be highly appreciated by many customers where permission boundaries are in use. pkennedyvt has made the code adjustment ready.

Thanks for your feedback.

aijunpeng commented 3 years ago

Thanks for your inquiry. This is in our backlog and will be evaluated for future releases.

ryancabrera commented 1 year ago

Rather than create a new Feature Request or Issue, I was wondering if I could advocate for the implementation of the feature again? With the increasing adoption of permission boundaries as a means to limit permissions (especially in conjunction with federated users) I can see this becoming an increasingly desired feature.

In addition to the two files committed there would also need to be a change to aws-waf-security-automations-firehose-athena.template as well

aijunpeng commented 1 year ago

Thanks for the comment. This is on our roadmap but hasn't been prioritized yet. It is a more broad conversation for all our solutions on if permission management for users or roles should be in the scope of the solutions. For now customers are responsible to manage these permissions.

rakshb commented 1 year ago

Thanks for the pull request. Enabling permission management/boundary for users and roles is not within the scope of our solutions and we do not plan to add this in the near future.