mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-09-30 06:53:17 +00:00
8cbc98d927
* feat(scp): deny iam changes on role/platform unless the platform principal (PLAT-233) Adds ProtectPlatformPath beside the existing name denies in the prod/nonprod SCP and the security OU copy. New hcptf-bootstrap creates use /platform/. Existing roles are not recreated. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com> * fix(scp): use live bootstrap ARNs and close the platform path gaps (PLAT-233) Resolve simulate and printed role ARNs from iam:GetRole so a /platform/ create is not reported as an unpathed role. Deny boundary changes on role/platform/*, and match both Identity Center SSO role ARN shapes. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com> * fix(scp): deny platform-path changes in bootstrap simulate (PLAT-233) Add a simulate case for role/platform/hcptf-example and fail when CreateRole, PutRolePolicy, or DeleteRole is allowed. The unpathed hcptf-* import check stays. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
63 lines
1.7 KiB
JSON
63 lines
1.7 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "ProtectPrivilegedRoles",
|
|
"Effect": "Deny",
|
|
"Action": [
|
|
"iam:UpdateAssumeRolePolicy",
|
|
"iam:AttachRolePolicy",
|
|
"iam:DetachRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:DeleteRolePolicy",
|
|
"iam:DeleteRole",
|
|
"iam:UpdateRole",
|
|
"iam:TagRole",
|
|
"iam:UntagRole"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:iam::*:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::*:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::*:role/githubdeploy-*",
|
|
"arn:aws:iam::*:role/seahaven-security-config-*",
|
|
"arn:aws:iam::*:role/aws-service-role/*",
|
|
"arn:aws:iam::*:role/hcptf-bootstrap*"
|
|
],
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::*:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::*:role/cdk-hnb659fds-*"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "ProtectPlatformPath",
|
|
"Effect": "Deny",
|
|
"Action": [
|
|
"iam:CreateRole",
|
|
"iam:UpdateAssumeRolePolicy",
|
|
"iam:AttachRolePolicy",
|
|
"iam:DetachRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:DeleteRolePolicy",
|
|
"iam:DeleteRole",
|
|
"iam:UpdateRole",
|
|
"iam:PutRolePermissionsBoundary",
|
|
"iam:DeleteRolePermissionsBoundary",
|
|
"iam:TagRole",
|
|
"iam:UntagRole"
|
|
],
|
|
"Resource": "arn:aws:iam::*:role/platform/*",
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::*:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_Platform_*"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|