mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-10-02 13:13:22 +00:00
b02f52b805
* feat(iam): lock app-owned HCP IAM and add bootstrap SCP (PLAT-143) * fix(iam): pin HCP boundary ARNs and bootstrap trust window (PLAT-143) Null on iam:PermissionsBoundary accepted any ceiling, including AdministratorAccess. Import apply cannot self-mutate hcptf-* while bootstrap trust is iam-bootstrap only; add a time-boxed exact StringEquals workspace grant instead of StringLike.
36 lines
976 B
JSON
36 lines
976 B
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "ProtectPrivilegedRoles",
|
|
"Effect": "Deny",
|
|
"Action": [
|
|
"iam:UpdateAssumeRolePolicy",
|
|
"iam:AttachRolePolicy",
|
|
"iam:DetachRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:DeleteRolePolicy",
|
|
"iam:DeleteRole",
|
|
"iam:UpdateRole",
|
|
"iam:TagRole",
|
|
"iam:UntagRole"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:iam::*:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::*:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::*:role/githubdeploy-*",
|
|
"arn:aws:iam::*:role/seahaven-security-config-*",
|
|
"arn:aws:iam::*:role/aws-service-role/*",
|
|
"arn:aws:iam::*:role/hcptf-bootstrap*"
|
|
],
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::*:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::*:role/cdk-hnb659fds-*"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|