# PermissionsBoundary

Apply a permissions boundary to all IAM Roles and Users within a specific scope.

A permissions boundary is typically applied at the `Stage` scope.
This allows setting different permissions boundaries per Stage. For
example, you may _not_ apply a boundary to the `Dev` stage which deploys
to a personal dev account, but you _do_ apply the default boundary to the
`Prod` stage.

It is possible to apply different permissions boundaries to different scopes
within your app. In this case the most specifically applied one wins

- Source: [`core/lib/permissions-boundary.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/core/lib/permissions-boundary.ts#L39)
- Type last changed: v2.54.0 · 7 Dec 2022

## Example

```ts
// no permissions boundary for dev stage
new Stage(app, 'DevStage');

// default boundary for prod stage
const prodStage = new Stage(app, 'ProdStage', {
  permissionsBoundary: PermissionsBoundary.fromName('prod-pb'),
});

// overriding the pb applied for this stack
new Stack(prodStage, 'ProdStack1', {
  permissionsBoundary: PermissionsBoundary.fromName('stack-pb'),
});

// will inherit the permissions boundary from the stage
new Stack(prodStage, 'ProdStack2');
```

## Methods

- `fromArn(arn: string): PermissionsBoundary // chainable` (static) — Apply a permissions boundary with the given ARN to all IAM Roles and Users created within a scope.

  The arn can include placeholders for the partition, region, qualifier, and account
  These placeholders will be replaced with the actual values if available. This requires
  that the Stack has the environment specified, it does not work with environment
  agnostic stacks.

  - '${AWS::Partition}'
  - '${AWS::Region}'
  - '${AWS::AccountId}'
  - '${Qualifier}'

  **Parameters**

  - `arn` — the ARN of the permissions boundary policy.

  ```ts
  new Stage(app, 'ProdStage', {
    permissionsBoundary: PermissionsBoundary.fromArn('arn:aws:iam::${AWS::AccountId}:policy/my-custom-permissions-boundary'),
  });
  ```

- `fromName(name: string): PermissionsBoundary // chainable` (static) — Apply a permissions boundary with the given name to all IAM Roles and Users created within a scope.

  The name can include placeholders for the partition, region, qualifier, and account
  These placeholders will be replaced with the actual values if available. This requires
  that the Stack has the environment specified, it does not work with environment
  agnostic stacks.

  - '${AWS::Partition}'
  - '${AWS::Region}'
  - '${AWS::AccountId}'
  - '${Qualifier}'

  **Parameters**

  - `name` — the name of the permissions boundary policy.

  ```ts
  new Stage(app, 'ProdStage', {
    permissionsBoundary: PermissionsBoundary.fromName('my-custom-permissions-boundary'),
  });
  ```