Fix CRLY.01173: Constrain IAM Permissions Management

[curly-review]

Issue Details

ID: CRLY.01173
Severity: MEDIUM
File: pipeline/cfn-deploypipeline-github.yaml

---

Remediation Summary

Description

The security finding indicates that the IAM policy attached to the PipelineExecutionRole allows permissions management without any constraints. This can lead to potential security risks as it permits unrestricted access to IAM permissions.

Steps

1. Identify the Policy: Locate the policy in the IAM role that allows unrestricted permissions management.
2. Modify the Policy: Update the policy to include constraints to limit permissions management capabilities.

Here is an example of how you can modify the policy to restrict permissions management:

PipelineExecutionRole:
    Type: AWS::IAM::Role
    Properties:
        AssumeRolePolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 'sts:AssumeRole'
                Effect: Allow
                Principal:
                  Service:
                    - codepipeline.amazonaws.com
        Path: /
        ManagedPolicyArns:
            - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
            - !Ref CFNPipelinePolicy
        Policies:
            - PolicyName: CodePipelineAccess
              PolicyDocument:
                Version: '2012-10-17'
                Statement:
                    - Action:
                          - 'lambda:InvokeFunction'
                          - 'lambda:ListFunctions'
                          - 'lambda:InvokeAsync'
                      Effect: Allow
                      Resource: '*'
                    - Action:
                          - 'iam:PassRole'
                      Effect: Allow
                      Resource: 
                        - !GetAtt SomeSpecificRole.Arn

In this example, the iam:PassRole action is constrained to a specific role (SomeSpecificRole). You should replace SomeSpecificRole with the actual ARN of the role you want to allow passing to.

Note: Ensure you replace SomeSpecificRole with the actual ARN of the role you want to allow passing to. This is just an example, and you should tailor the constraints to your specific use case and security requirements.