Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

IAM Policy Updates #516

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

IAM Policy Updates #516

wants to merge 4 commits into from

Commits on Jul 11, 2023

  1. Remove StateBucketPolicy. This policy does not have any effect becaus… 

    …e it grants permission to account bucket is owned by. Access to this bucket is actually managed via identity policies.
    @k-paulius
    k-paulius committed Jul 11, 2023
    Configuration menu
    Copy the full SHA
    d78800b View commit details
    Browse the repository at this point in the history

  2. Perform "aws:SourceArn" condition checks on OrgBuildRole and OrgPipel… 

    …ineEventRuleRole trust policies to mitigate confused deputy attacks.

Note: CodePipeline does not support "aws:SourceArn" condition as of this time.
    @k-paulius
    k-paulius committed Jul 11, 2023
    Configuration menu
    Copy the full SHA
    6e43e92 View commit details
    Browse the repository at this point in the history

  3. OrgBuildRole needs following permissions to function without Administ… 

    …ratorAccess policy:

- ec2:DescribeRegions
- assume role "OrganizationFormationBuildAccessRole" in all organization accounts
    @k-paulius
    k-paulius committed Jul 11, 2023
    Configuration menu
    Copy the full SHA
    6e88d7d View commit details
    Browse the repository at this point in the history

  4. OrgBuildRole needs permission to post events when it updates organiza… 

    …tion e.g.: removes SCP
    @k-paulius
    k-paulius committed Jul 11, 2023
    Configuration menu
    Copy the full SHA
    b942e56 View commit details
    Browse the repository at this point in the history