Using CDK with the Control Tower-provided AWSPowerUserAccess role

Question

Hi all,

I recently switched to Control Tower but now run into an issue when running cdk bootstrap, whilst using a profile with the AWSPowerUserAccess role. I'm using SSO  token provider configuration. e.g.

`cdk bootstrap --profile dev aws://123456789012/eu-west-3`

returns,

```
 ⏳  Bootstrapping environment aws://123456789012/eu-west-3...
Trusted accounts for deployment: (none)
Trusted accounts for lookup: (none)
Using default execution policy of 'arn:aws:iam::aws:policy/AdministratorAccess'. Pass '--cloudformation-execution-policies' to customize.
CDKToolkit: creating CloudFormation changeset...
11:46:04 | CREATE_FAILED        | AWS::IAM::Role          | FilePublishingRole
API: iam:GetRole User: arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_AWSPowerUserAccess_1243765abc961fa/my.email@address.com is not authorized to perform: iam:GetRole on resource:
role cdk-hnh864has-file-publishing-role-123456789012-eu-west-3 because no identity-based policy allows the iam:GetRole action
```

I cannot modify permissions for the AWSPowerUserAccess role, so I'm wondering if I should be using this role at all for CDK. Should my bootstrap command include more arguments? Should I create a CDKUserAccess role? Should I create a custom stack synthesizer? Any thoughts on the 'right' way to proceed would be welcome.

Thanks
Gary

Accepted Answer

Hi. Gary.

>  I bootstrapped this environment with my admin profile, and then cdk deployed with the dev profile. This approach worked for me, but was it the right thing to do?

It seems fine.
According to CDK Security and Safety Dev Guide[1], it recommends to use `AdministratorAccess` priviledges to execute cdk bootstrap.

> Bootstrapping itself is a one-time operation performed by AWS account administrators, and we recommend executing it using AdministratorAccess privileges. This makes sure you are safe against future changes, and since the bootstrapping process will—by design—create new Roles with arbitrary policies anyway, there is no real benefit to restricting the permissions.

And when deploying, Guide[1] recommends to use deny listing permission.  You know,`PowerUserAccess` policy is deny listing permission, so it looks fine.

> As you can see, allow listing permissions for infrastructure deployments is a tricky process and we do not recommend using this strategy.

The best practice about CDK security will mentioned in Guide[1]. So please check it.

[1] https://github.com/aws/aws-cdk/wiki/Security-And-Safety-Dev-Guide

Using CDK with the Control Tower-provided AWSPowerUserAccess role

Relevant content