feat(bootstrap): add --permissions-boundary-all-roles flag #1057
+242
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Implements the feature requested in aws#284 to apply permissions boundary to all bootstrap roles, not just the CloudFormation execution role. Changes: - Add PermissionsBoundaryAllRoles parameter to bootstrap template - Add ApplyPermissionsBoundaryToAllRoles condition - Apply permissions boundary to FilePublishingRole, ImagePublishingRole, LookupRole, and DeploymentActionRole when flag is set - Add --permissions-boundary-all-roles CLI option (default: false) - Display warning when flag is used without --custom-permissions-boundary or --example-permissions-boundary - Update tests to include new parameter Closes aws#284
akazakou
requested a deployment
to
integ-approval
GitHub Actions
Waiting
Moves the --permissions-boundary-all-roles warning from cli.ts to bootstrap-environment.ts to follow the existing parameter validation pattern in the modernBootstrap function.
auto-merge was automatically disabled
January 22, 2026 18:16
Head branch was pushed to by a user without write access
akazakou
requested a deployment
to
integ-approval
GitHub Actions
Waiting
- Test parameter passing (true/false/default) - Test warning when used without permissions boundary - Test no warning with customPermissionsBoundary or examplePermissionsBoundary - Test template contains PermissionsBoundaryAllRoles parameter - Test template contains ApplyPermissionsBoundaryToAllRoles condition - Test PermissionsBoundary on additional roles with condition - Test CloudFormationExecutionRole uses PermissionsBoundarySet condition
akazakou
requested a deployment
to
integ-approval
GitHub Actions
Waiting
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Implements the feature requested in #284 to apply permissions boundary to all bootstrap roles, not just the CloudFormation execution role.
Changes
CloudFormation Bootstrap Template
PermissionsBoundaryAllRolesparameter (default:'false')ApplyPermissionsBoundaryToAllRolesconditionPermissionsBoundaryproperty to 4 roles:FilePublishingRoleImagePublishingRoleLookupRoleDeploymentActionRoleCLI Configuration
--permissions-boundary-all-rolesoption with typebooleanand defaultfalseCLI Logic
--permissions-boundary-all-rolesis used without--custom-permissions-boundaryor--example-permissions-boundaryBootstrap Props & Environment
permissionsBoundaryAllRoles?: booleantoBootstrappingParametersinterfacePermissionsBoundaryAllRolesparameter to CloudFormationPublic API
permissionsBoundaryAllRoles?: booleanto publicBootstrapParametersinterface in@aws-cdk/toolkit-libTests
bootstrap2.test.ts:customPermissionsBoundaryorexamplePermissionsBoundaryPermissionsBoundaryAllRolesparameterApplyPermissionsBoundaryToAllRolesconditionPermissionsBoundarypropertyCloudFormationExecutionRolecontinues to usePermissionsBoundarySetcondition (backward compatible)bootstrap.test.tsto include the new parameterUsage
This will apply the permissions boundary to ALL bootstrap roles (FilePublishingRole, ImagePublishingRole, LookupRole, DeploymentActionRole, and CloudFormationExecutionRole) instead of just the CloudFormationExecutionRole.
Testing
yarn nx run aws-cdk:compile)yarn nx run aws-cdk:eslint)Closes #284
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license