(pipelines/bootstrap): add Permission Boundary to bootstrap resources

The cdk bootstrap command will be able to be invoked as follows:

$ cdk bootstrap --permissions-boundary=arn:aws:iam::account-id:policy/policy-name-with-path

This sets the CloudFormation Execution Role up to enforce its use.

When users add:

{
  "context": {
    "@aws-cdk/core.permissionsBoundary": "arn:aws:iam::account-id:policy/policy-name-with-path"
  }
}

To their cdk.json, all Roles in all stacks will be provisioned with that permission boundary automatically.

---

This is a 🚀 Feature Request

[patrickmryan]

Yes, that’s mine.

pat

On Mon, Feb 7, 2022 at 12:05 PM Kevin Johnson @.***> wrote:

@patrickmryan https://github.com/patrickmryan this is your blog post correct?

@.***/bootstrapping-aws-cdk-in-a-secure-environment-9bc778ea6d94

— Reply to this email directly, view it on GitHub https://github.com/aws/aws-cdk/issues/12207#issuecomment-1031702187, or unsubscribe https://github.com/notifications/unsubscribe-auth/ADEHXMGFTUFBJTODGJ3JXEDUZ73VBANCNFSM4VGYVZLA . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

You are receiving this because you were mentioned.Message ID: @.***>

– @.*** @.*** https://www.facebook.com/patrick.m.ryan1 http://www.imageryan.com

[viktorchukhantsev]

@patrickmryan Thank you. Can you also please attach example policy for boundary in GH repo? I have issues with defining that policy due to lack of knowledge about AWS policies and boundary permissions.