Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(iam): grantAssumeRole silently fails with service and account principals #29452

Merged
merged 12 commits into from
Apr 2, 2024

Conversation

kishiel
Copy link
Contributor

@kishiel kishiel commented Mar 11, 2024

Issue #24507

Reason for this change

grantAssumeRole silently fails if a Service Principal or Account Principal is used which led me to a false assumption about the correctness of a role's permission scope

Description of changes

This change will throw an error if a Service Principal is used. I was unable to find a way to accomplish the same behavior for Account Principals.

Documentation was updated to help guide a user to the appropriate function usage for Service and Account Principals.

Description of how you validated changes

  • Added a unit test
  • This change required me to re-run two unrelated snapshot tests which were throwing errors outside of the scope of this change.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@github-actions github-actions bot added beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK p2 labels Mar 11, 2024
@aws-cdk-automation aws-cdk-automation requested a review from a team March 11, 2024 20:45
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@kishiel kishiel changed the title fix(iam): Throw error if grantAssumeRole uses a Service Principal fix(iam): throw error if grantAssumeRole uses a Service Principal Mar 11, 2024
@aws-cdk-automation aws-cdk-automation dismissed their stale review March 11, 2024 20:53

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@aws-cdk-automation aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 11, 2024
@@ -369,6 +369,37 @@ new iam.Role(this, 'Role', {
});
```

### Granting assume role permission from a role

Principals can be granted permission to assume a role using `grantAssumeRole`. Note that this does not apply to Service Principals or Account Principals as they must be added to the role Trust Policy.
Copy link
Contributor

@msambol msambol Mar 20, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -369,6 +369,37 @@ new iam.Role(this, 'Role', {
});
```

### Granting assume role permission from a role
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"From a role" is confusing here. Can you change this to "Granting principals permission to assume a role"

role.grantAssumeRole(user);
```

### Giving Service Principals and Account Principals assume role permission from a role
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"Granting service and account principals permission to assume a role"


### Giving Service Principals and Account Principals assume role permission from a role

Service Principals and Account Principals can be granted permission to assume a role using `assumeRolePolicy` which modifies the role Trust Policy.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lowercase

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trust Policy should be lowercase too.

// Service Principals must use assumeRolePolicy
if (identity.policyFragment.principalJson.Service) {
throw new Error('Cannot use a Service Principal with grantAssumeRole, use assumeRolePolicy instead.');
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this would work?

    if (identity instanceof ServicePrincipal || identity instanceof AccountPrincipal) {
      throw new Error('Cannot use a service or account principal with grantAssumeRole, use assumeRolePolicy instead.');
    }

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call, this appears to have worked. Added another test for account principal.

@msambol
Copy link
Contributor

msambol commented Mar 20, 2024

Can you change the title? It should reflect the bug. Maybe:

fix(iam): grantAssumeRole silently fails with service and account principals

Copy link
Contributor

@msambol msambol left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See inline. Great start!

@aws-cdk-automation aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 20, 2024
@kishiel kishiel changed the title fix(iam): throw error if grantAssumeRole uses a Service Principal fix(iam): grantAssumeRole silently fails with service and account principals Mar 20, 2024
@kishiel
Copy link
Contributor Author

kishiel commented Mar 20, 2024

Incorporated all feedback and updated title

@@ -369,6 +369,39 @@ new iam.Role(this, 'Role', {
});
```

### Granting an identity permission to assume a role
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you change this to "Granting a principal...". That's the more common verbiage.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, I forgot I'd modified this. I changed this to identity based on this section of the readme but I think I'm just misreading it. Will change

@@ -369,6 +369,39 @@ new iam.Role(this, 'Role', {
});
```

### Granting an identity permission to assume a role

An identity can be granted permission to assume a role using `grantAssumeRole`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Likewise here, "a principal."


An identity can be granted permission to assume a role using `grantAssumeRole`.

Note that this does not apply to service principals or account principals as they must be added to the role trust policy.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add via assumeRolePolicy.

Copy link
Contributor

@msambol msambol left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Few more comments then we're good to go.

@kishiel
Copy link
Contributor Author

kishiel commented Mar 20, 2024

Incorporated feedback

Copy link
Contributor

@msambol msambol left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Thanks!

@aws-cdk-automation aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 20, 2024
Copy link
Contributor

@GavinZZ GavinZZ left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally LGTM, just a question for clarification before approving.

@@ -369,6 +369,39 @@ new iam.Role(this, 'Role', {
});
```

### Granting a principal permission to assume a role
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this clear documentation update.

GavinZZ
GavinZZ previously approved these changes Apr 2, 2024
Copy link
Contributor

mergify bot commented Apr 2, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot dismissed GavinZZ’s stale review April 2, 2024 20:20

Pull request has been modified.

@aws-cdk-automation aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Apr 2, 2024
Copy link
Contributor

mergify bot commented Apr 2, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 18771f4
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit 36fd79d into aws:main Apr 2, 2024
9 checks passed
Copy link
Contributor

mergify bot commented Apr 2, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK p2
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants