Home / server / Questions / 965306
In Process
Bruno Bronosky
Asked: 2019-05-01 09:45:53 +0800 CST

How to limit the permissions AWS IAM RoleA can grant to a role (Role B) it creates

  • 772

In order to allow my developers to use the Serverless Framework to deploy new AWS Lambda functions, they have to be able to create roles. I'd like to give them permissions to create roles that can only do a limited number of things. For example s3:, dynamodb:, cloudfront:Update*

But I don't want them (RoleA) to be able to create roles (RoleB) that can do anything with EC2, IAM, etc. How might you limit this permission?

amazon-web-services

1 Answers

  1. I also had the same problem; the only solution I found was to create the role to be used with Lambdas before they actually made the deployment, and provide them the Role ARN to be passed to Serverless for the Lambda deployment.

    In this way, they always used the same role(s) I gave them, and on the roles I attached custom policies with only the required permission for the Lambdas to work.

    You only need to grant their user permission to list and attach roles if I remember correctly, instead of the CreateRole one.

    • 0