search

aws / aws-parallelcluster-ui

Apache License 2.0
31 stars 18 forks source link

[Infrastructure] Add support for permissions boundary and IAM prefixes #286

Closed gmarciani closed 8 months ago

gmarciani commented 8 months ago

Changes

  1. Add support for permissions boundary: now the user can optionally specify the IAM policies to be used as permissions boundaries for the PCUI infrastructure and the PCAPI infrastructure, separately.
  2. Add support for IAM roles and policies prefix: now the user can optionally specify a prefix to be added to every IAM role and policy name created as part of both PCUI and PCAPI infrastructure.

Note about Customer Experience When a permissions boundary is specified for the PCAPI infrastructure, such boundary is also set as condition for iam:CreateRole/PutRolePolicy/DeleteRolePolicy/AttachRolePolicyDetachRolePolicy (this behaviour is part of the product since Jan 2023 see commit). This implies that when such boundary is specified, only clusters with the configuration Iam/PermissionsBoundary equal to that boundary can succeed.

How Has This Been Tested?

  1. PCUI deployed as default without prefix and boundary.
    1. verified that resources do not have prefix and boundaries.
    2. Created and deleted a cluster.
  2. PCUI deployed with prefix and boundary:
    1. Verified that resources have the expected prefix and boundary.
    2. Creation of a cluster without Iam/Permissions boundary fails as expected because of the condition on iam:CreateRole
    3. Created and deleted a cluster with Iam/PermissionsBoundary equal to the one set for PCAPI
    4. Created and deleted a cluster with Iam/PermissionsBoundary and prefix equal to the ones set for PCAPI

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.