kandeshwarath
commented
3 years ago See below the cloudformation template generated for the role that failed created. The role created for the Lambda works fine since it does have the boundary policy. I am attaching it
"ApigatewayToStepFunctionsRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "Service": "apigateway.amazonaws.com" }, "Action": "sts:AssumeRole" }] }, "Policies": [{ "PolicyName": "ApigatewayToStepFunctionsRole", "PolicyDocument": { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["states:StartExecution"], "Resource": "*" }] } }] } } }
The lamda role succeeds and has the boundary policy "IamRoleLambdaExecution": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "Service": ["lambda.amazonaws.com"] }, "Action": ["sts:AssumeRole"] }] }, "Policies": [{ "PolicyName": { "Fn::Join": ["-", ["bulk-server", "dev", "lambda"]] }, "PolicyDocument": { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["logs:CreateLogStream", "logs:CreateLogGroup"], "Resource": [{ "Fn::Sub": "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/bulk-server-dev:" }] }, { "Effect": "Allow", "Action": ["logs:PutLogEvents"], "Resource": [{ "Fn::Sub": "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/bulk-server-dev::*" }] }] } }], "Path": "/", "RoleName": { "Fn::Join": ["-", ["bulk-server", "dev", { "Ref": "AWS::Region" }, "lambdaRole"]] }, "PermissionsBoundary": { "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:policy/DeveloperBoundaryPolicy" } } },
cqcmdwym
clawsl
This is a (Bug Report)
Description
For bug reports:
When creating iam role ApigatewayToStepFunctionsRole the plugin is not using the permissionsBoundary specified in provider as a result creation of the role fails
The expected behavior was that like IAM role created for lambda functions it would use the permissions Boundary specified
What was the config you used? service: bulk-server frameworkVersion: 2
plugins:
provider: name: aws runtime: nodejs12.x rolePermissionsBoundary: arn:aws:iam::#{AWS::AccountId}:policy/DeveloperBoundaryPolicy iamRoleStatements:
functions: writejob: handler: src/handlers.writejob events:
stepFunctions: stateMachines: jobProcessor: name: JobProcessor events:
http: method: GET path: processjob
definition: StartAt: writejob States: writejob: Type: Pass End: true
API: iam:CreateRole User: arn:aws:sts::myacct:assumed-role/MYASSUMEDROLE/MYSUSERNAME is not authorized to perform: iam:CreateRole on resource:
Additional Data
To work around the issue i created an iamRole and referenced it in the step function resources: Resources: myDefaultRole: ApigatewayToStepFunctionsRole: Type: 'AWS::IAM::Role' Properties: PermissionsBoundary: arn:aws:iam::#{AWS::AccountId}:policy/DeveloperBoundaryPolicy RoleName: myrole AssumeRolePolicyDocument: Version: '2012-10-17' Statement: