AWS CDK Reference

Appearance

v2.274.0

PermissionsBoundary Class ​

Apply a permissions boundary to all IAM Roles and Users within a specific scope.

A permissions boundary is typically applied at the Stage scope. This allows setting different permissions boundaries per Stage. For example, you may not apply a boundary to the Dev stage which deploys to a personal dev account, but you do apply the default boundary to the Prod stage.

It is possible to apply different permissions boundaries to different scopes within your app. In this case the most specifically applied one wins

Source
core/lib/permissions-boundary.ts
Type last changed
v2.54.0 · 7 Dec 2022

Example ​

ts
// no permissions boundary for dev stage
new Stage(app, 'DevStage');

// default boundary for prod stage
const prodStage = new Stage(app, 'ProdStage', {
  permissionsBoundary: PermissionsBoundary.fromName('prod-pb'),
});

// overriding the pb applied for this stack
new Stack(prodStage, 'ProdStack1', {
  permissionsBoundary: PermissionsBoundary.fromName('stack-pb'),
});

// will inherit the permissions boundary from the stage
new Stack(prodStage, 'ProdStack2');

Methods ​

fromArn(arn: string): PermissionsBoundary // chainable@staticmethod def from_arn(arn: str) -> PermissionsBoundarypublic static PermissionsBoundary fromArn(String arn)public static PermissionsBoundary FromArn(string arn)func FromArn(Arn *string) PermissionsBoundarystatic#
Apply a permissions boundary with the given ARN to all IAM Roles and Users created within a scope.
notes · 1 parameter · example

The arn can include placeholders for the partition, region, qualifier, and account These placeholders will be replaced with the actual values if available. This requires that the Stack has the environment specified, it does not work with environment agnostic stacks.

  • '${AWS::Partition}'
  • '${AWS::Region}'
  • '${AWS::AccountId}'
  • '${Qualifier}'

Parameters

  • arnarnarnarnArn — the ARN of the permissions boundary policy.
ts
new Stage(app, 'ProdStage', {
  permissionsBoundary: PermissionsBoundary.fromArn('arn:aws:iam::${AWS::AccountId}:policy/my-custom-permissions-boundary'),
});
fromName(name: string): PermissionsBoundary // chainable@staticmethod def from_name(name: str) -> PermissionsBoundarypublic static PermissionsBoundary fromName(String name)public static PermissionsBoundary FromName(string name)func FromName(Name *string) PermissionsBoundarystatic#
Apply a permissions boundary with the given name to all IAM Roles and Users created within a scope.
notes · 1 parameter · example

The name can include placeholders for the partition, region, qualifier, and account These placeholders will be replaced with the actual values if available. This requires that the Stack has the environment specified, it does not work with environment agnostic stacks.

  • '${AWS::Partition}'
  • '${AWS::Region}'
  • '${AWS::AccountId}'
  • '${Qualifier}'

Parameters

  • namenamenamenameName — the name of the permissions boundary policy.
ts
new Stage(app, 'ProdStage', {
  permissionsBoundary: PermissionsBoundary.fromName('my-custom-permissions-boundary'),
});