Attach a Permissions Boundary to Workload Discovery Roles

source/cfn/templates/account-import-templates-resolvers.template

@@ -14,6 +14,18 @@ Parameters:
   PerspectiveAppSyncApiId:
     Type: String
 
+  AttachPermissionsBoundary:
+    Description: Attach Permissions Boundary
+    Type: String
+
+  PermissionsBoundaryName:
+    Description: Name of optional Permissions Boundary
+    Type: String
+
+Conditions:
+  AttachPermissionsBoundary:
+    !Equals [!Ref AttachPermissionsBoundary, 'Yes']
+
 Resources:
 
   AccountImportTemplatesApiLambdaFunctionRole:
@@ -30,6 +42,8 @@ Resources:
               Service:
                 - lambda.amazonaws.com
             Action: sts:AssumeRole
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   AccountImportTemplatesApiFunction:
     Metadata:
@@ -77,6 +91,8 @@ Resources:
                 Action:
                   - lambda:InvokeFunction
                 Resource: !GetAtt AccountImportTemplatesApiFunction.Arn
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   AccountImportTemplatesApiLambdaDataSource:
     Type: AWS::AppSync::DataSource

source/cfn/templates/appsync-api.template

@@ -15,6 +15,18 @@ Parameters:
   CognitoUserPoolId:
     Type: String
 
+  AttachPermissionsBoundary:
+    Description: Attach Permissions Boundary
+    Type: String
+
+  PermissionsBoundaryName:
+    Description: Name of optional Permissions Boundary
+    Type: String
+
+Conditions:
+  AttachPermissionsBoundary:
+    !Equals [!Ref AttachPermissionsBoundary, 'Yes']
+
 Resources:
 
   PerspectiveAppSyncLoggingRole:
@@ -48,6 +60,8 @@ Resources:
                 Action:
                   - logs:PutLogEvents
                 Resource: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*'
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   PerspectiveAppSyncApi:
     Type: AWS::AppSync::GraphQLApi
@@ -76,4 +90,4 @@ Outputs:
   AppSyncApiArn:
     Value: !GetAtt PerspectiveAppSyncApi.Arn
   AppSyncApiUrl:
-    Value: !GetAtt PerspectiveAppSyncApi.GraphQLUrl
+    Value: !GetAtt PerspectiveAppSyncApi.GraphQLUrl

source/cfn/templates/athena-glue-crawler.template

@@ -17,6 +17,16 @@ Parameters:
   DeploymentBucketKey:
     Type: String
     Description: "The key to the deployment code for Perspective"
+  AttachPermissionsBoundary:
+    Description: Attach Permissions Boundary
+    Type: String
+  PermissionsBoundaryName:
+    Description: Name of optional Permissions Boundary
+    Type: String
+
+Conditions:
+  AttachPermissionsBoundary:
+    !Equals [!Ref AttachPermissionsBoundary, 'Yes']
 
 Resources:
   AWSCURDatabase:
@@ -70,6 +80,8 @@ Resources:
                   - 's3:GetObject'
                   - 's3:PutObject'
                 Resource: !Sub 'arn:${AWS::Partition}:s3:::${CostAndUsageBucket}/${CURCrawlerKey}/*'
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   AWSCURCrawlerLambdaExecutor:
     Metadata:
@@ -113,6 +125,8 @@ Resources:
                 Action:
                   - 'glue:StartCrawler'
                 Resource: '*'
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   AWSCURCrawler:
     Type: 'AWS::Glue::Crawler'
@@ -202,6 +216,8 @@ Resources:
                 Action:
                   - 's3:PutBucketNotification'
                 Resource: !Sub 'arn:${AWS::Partition}:s3:::${CostAndUsageBucket}'
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   AWSS3CURNotification:
     Metadata:

source/cfn/templates/buckets.template

@@ -29,10 +29,20 @@ Parameters:
   S3CleanupBucket:
     Type: String
 
+  AttachPermissionsBoundary:
+    Description: Attach Permissions Boundary
+    Type: String
+
+  PermissionsBoundaryName:
+    Description: Name of optional Permissions Boundary
+    Type: String
+
 Conditions:
   CreateConfigBucket: !Equals
     - Ref: CreateConfigBucket
     - "true"
+  AttachPermissionsBoundary:
+    !Equals [!Ref AttachPermissionsBoundary, 'Yes']
 
 Resources:
   # The custom resource disables access logging because otherwise logs will be
@@ -412,6 +422,8 @@ Resources:
                     - Ref: "AWS::NoValue"
       Runtime: python3.8
       Timeout: 60
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   CleanupAccessLogsBucket:
     Type: "Custom::S3BucketCleanup"
@@ -501,4 +513,4 @@ Outputs:
     Value: !Ref WebUIBucket
 
   WebUIBucketRegionalDomainName:
-    Value: !GetAtt WebUIBucket.RegionalDomainName
+    Value: !GetAtt WebUIBucket.RegionalDomainName

source/cfn/templates/codebuild.template

@@ -32,6 +32,18 @@ Parameters:
   SolutionVersion:
     Type: String
 
+  AttachPermissionsBoundary:
+    Description: Attach Permissions Boundary
+    Type: String
+
+  PermissionsBoundaryName:
+    Description: Name of optional Permissions Boundary
+    Type: String
+
+Conditions:
+  AttachPermissionsBoundary:
+    !Equals [!Ref AttachPermissionsBoundary, 'Yes']
+
 Resources:
 
   CodeBuildRole:
@@ -91,6 +103,8 @@ Resources:
                   - s3:PutObject
                 Resource:
                   - !Sub "arn:aws:s3:::${WebUIBucket}/*"
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   CodeBuildProject:
     Type: AWS::CodeBuild::Project
@@ -182,4 +196,6 @@ Resources:
               Resource: !GetAtt CodeBuildProject.Arn
       Runtime: python3.8
       ReservedConcurrentExecutions: 1
-      Timeout: 900
+      Timeout: 900
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]

source/cfn/templates/cognito.template

@@ -13,6 +13,18 @@ Parameters:
   WebUiUrl:
     Type: String
 
+  AttachPermissionsBoundary:
+    Description: Attach Permissions Boundary
+    Type: String
+
+  PermissionsBoundaryName:
+    Description: Name of optional Permissions Boundary
+    Type: String
+
+Conditions:
+  AttachPermissionsBoundary:
+    !Equals [!Ref AttachPermissionsBoundary, 'Yes']
+
 Resources:
 
   CognitoAuthRole:
@@ -70,6 +82,8 @@ Resources:
               - Action: s3:ListBucket
                 Resource: !Sub "arn:aws:s3:::${AmplifyStorageBucket}"
                 Effect: "Allow"
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   IdentityPoolRoleMap:
     Type: AWS::Cognito::IdentityPoolRoleAttachment
@@ -144,4 +158,4 @@ Outputs:
   UserPoolARN:
     Value: !GetAtt WDCognitoUserPool.Arn
   WebClientId:
-    Value: !Ref UserPoolClient
+    Value: !Ref UserPoolClient

source/cfn/templates/config-aggregator.template

@@ -10,8 +10,18 @@ Parameters:
   ConfigBucket:
     Type: String
 
+  AttachPermissionsBoundary:
+    Description: Attach Permissions Boundary
+    Type: String
+
+  PermissionsBoundaryName:
+    Description: Name of optional Permissions Boundary
+    Type: String
+
 Conditions:
   SetUpConfig: !Equals [!Ref ExistingConfigInstallation, 'No']
+  AttachPermissionsBoundary:
+    !Equals [!Ref AttachPermissionsBoundary, 'Yes']
 
 Resources:
 
@@ -78,6 +88,8 @@ Resources:
                 Condition:
                   StringEquals:
                     s3:x-amz-acl: bucket-owner-full-control
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
 Outputs:
 

source/cfn/templates/cost-resolvers.template

@@ -36,6 +36,18 @@ Parameters:
   CustomUserAgent: 
     Type: String
 
+  AttachPermissionsBoundary:
+    Description: Attach Permissions Boundary
+    Type: String
+
+  PermissionsBoundaryName:
+    Description: Name of optional Permissions Boundary
+    Type: String
+
+Conditions:
+  AttachPermissionsBoundary:
+    !Equals [!Ref AttachPermissionsBoundary, 'Yes']
+
 Resources:
 
   PerspectiveCostLambdaRole:
@@ -111,6 +123,8 @@ Resources:
                   - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:catalog
                   - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:database/${AthenaDatabaseName}
                   - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:table/${AthenaDatabaseName}/${AthenaTableName}
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   PerspectiveCostFunction:
     Metadata:
@@ -161,6 +175,8 @@ Resources:
                 Action:
                   - lambda:InvokeFunction
                 Resource: !GetAtt PerspectiveCostFunction.Arn
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   PerspectiveAppSyncCostLambdaDataSource:
     Type: AWS::AppSync::DataSource

source/cfn/templates/discovery-crawler.template

@@ -91,6 +91,18 @@ Parameters:
     Type: String
     Default: 'AwsSolution/SO0075/1.1.0'
 
+  AttachPermissionsBoundary:
+    Description: Attach Permissions Boundary
+    Type: String
+
+  PermissionsBoundaryName:
+    Description: Name of optional Permissions Boundary
+    Type: String
+
+Conditions:
+  AttachPermissionsBoundary:
+    !Equals [!Ref AttachPermissionsBoundary, 'Yes']
+
 Resources:
   PerspectiveContainerRepo:
     Type: AWS::ECR::Repository
@@ -164,6 +176,8 @@ Resources:
       Environment:
         Variables:
           CustomUserAgent: !Ref CustomUserAgent
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   CleanupECRRepository:
     Type: Custom::Setup
@@ -197,6 +211,8 @@ Resources:
       ManagedPolicyArns:
         - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceEventsRole
         - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   PerspectiveDiscoveryTaskRole:
     Type: AWS::IAM::Role
@@ -260,6 +276,8 @@ Resources:
                 Action:
                   - appsync:GraphQL
                 Resource: !Sub ${AppSyncArn}/*
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   TaskDefinition:
     Type: AWS::ECS::TaskDefinition

source/cfn/templates/draw-io-resolvers.template

@@ -14,6 +14,18 @@ Parameters:
   PerspectiveAppSyncApiId:
     Type: String
 
+  AttachPermissionsBoundary:
+    Description: Attach Permissions Boundary
+    Type: String
+
+  PermissionsBoundaryName:
+    Description: Name of optional Permissions Boundary
+    Type: String
+
+Conditions:
+  AttachPermissionsBoundary:
+    !Equals [!Ref AttachPermissionsBoundary, 'Yes']
+
 Resources:
 
   DrawIoLambdaFunctionRole:
@@ -30,6 +42,8 @@ Resources:
               Service:
                 - lambda.amazonaws.com
             Action: sts:AssumeRole
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   DrawIoFunction:
     Type: AWS::Serverless::Function
@@ -48,6 +62,8 @@ Resources:
       Timeout: 5
       MemorySize: 256
       ReservedConcurrentExecutions: 5
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   DrawIoInvokeRole:
     Type: AWS::IAM::Role
@@ -70,6 +86,8 @@ Resources:
                 Action:
                   - lambda:InvokeFunction
                 Resource: !GetAtt DrawIoFunction.Arn
+      PermissionsBoundary:
+        !If [AttachPermissionsBoundary, !Ref PermissionsBoundaryName, !Ref "AWS::NoValue"]
 
   DrawIoExportLambdaDataSource:
     Type: AWS::AppSync::DataSource