search

org-formation / aws-resource-providers

A community driven repository where you can find AWS Resource Type Providers for different purposes (including org-formation ones).
MIT License
88 stars 21 forks source link

Community::SSO::AssignmentGroup needs iam:ListRolePolicies permission #143

Closed logicata-jon closed 7 months ago

logicata-jon commented 7 months ago

If you need to attach a customer managed policy to a permissionset, this permission is required, but is absent from the role created by deploying this type:

 "handlers": {
        "create": {
            "permissions": [
                "sso:CreateAccountAssignment",
                "sso:DescribeAccountAssignmentCreationStatus",
                "sso:ListAccountAssignments",
                "iam:GetSAMLProvider",
                "iam:CreateRole"
            ]
        },
        "read": {
            "permissions": [
            ]
        },
        "update": {
            "permissions": [
                "sso:CreateAccountAssignment",
                "sso:DescribeAccountAssignmentCreationStatus",
                "sso:DeleteAccountAssignment",
                "sso:DescribeAccountAssignmentDeletionStatus",
                "sso:ListAccountAssignments",
                "iam:GetSAMLProvider",
                "iam:CreateRole"
            ]
        },
        "delete": {
            "permissions": [
                "sso:DeleteAccountAssignment",
                "sso:DescribeAccountAssignmentDeletionStatus",
                "sso:ListAccountAssignments",
                "iam:GetSAMLProvider"
            ]
        }
}

Should be updated to:

 "handlers": {
        "create": {
            "permissions": [
                "sso:CreateAccountAssignment",
                "sso:DescribeAccountAssignmentCreationStatus",
                "sso:ListAccountAssignments",
                "iam:GetSAMLProvider",
                "iam:CreateRole",
                "iam:ListRolePolicies"
            ]
        },
        "read": {
            "permissions": [
            ]
        },
        "update": {
            "permissions": [
                "sso:CreateAccountAssignment",
                "sso:DescribeAccountAssignmentCreationStatus",
                "sso:DeleteAccountAssignment",
                "sso:DescribeAccountAssignmentDeletionStatus",
                "sso:ListAccountAssignments",
                "iam:GetSAMLProvider",
                "iam:CreateRole",
                "iam:ListRolePolicies"
            ]
        },
        "delete": {
            "permissions": [
                "sso:DeleteAccountAssignment",
                "sso:DescribeAccountAssignmentDeletionStatus",
                "sso:ListAccountAssignments",
                "iam:GetSAMLProvider"
            ]
        }
}
logicata-jon commented 7 months ago

Just adding that if I get a chance I might try to take this edit on myself, as it looks pretty simple