Merge pull request #22 from jplock/main

[fix] Explicitly deny boundary to change boundary
aws-samples · Sep 2, 2024 · 1113d2f · 1113d2f
2 parents 0b2a247 + 4acff62
commit 1113d2f
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/ci_template.yml b/ci_template.yml
@@ -269,7 +269,7 @@ Resources:
       PolicyDocument:
         Version: "2012-10-17"
         Statement:
-          - Sid: AllowModifyIamRolesWithBoundary
+          - Sid: EnforceActionsHaveBoundary
             Effect: Allow
             Action:
               - "iam:AttachRolePolicy"
@@ -282,6 +282,15 @@ Resources:
             Condition:
               ArnEquals:
                 "iam:PermissionsBoundary": !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/${AWS::StackName}-boundary-${AWS::Region}" # references self
+          - Sid: DenyChangesToBoundaryPolicy
+            Effect: Deny
+            Action:
+              - "iam:DeletePolicy"
+              - "iam:CreatePolicyVersion"
+              - "iam:CreatePolicy"
+              - "iam:DeletePolicyVersion"
+              - "iam:SetDefaultPolicyVersion"
+            Resource: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/${AWS::StackName}-boundary-${AWS::Region}" # references self
           - Sid: AllowModifyIamRoles
             Effect: Allow
             Action: