fix(eks): overly permissive trust policies #25473
Conversation
|
|
|
@comcalvi The EKS tests finally pass! :) But looks like there are a bunch of step-functions tests that need updating as well. |
aws-cdk-automation
added
the
pr/needs-community-review
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
iliapolo
added
the
pr-linter/exempt-breaking-change
aws-cdk-automation
dismissed
their stale review
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
iliapolo
force-pushed
the
epolon/eks-creation-role-trust-policy
branch
from
f3b633d to
3242e99
Compare
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
1 similar comment
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Backporting #25473 ---- The *CreationRole* and the *default MastersRole* use the account root principal in their trust policy, which is overly permissive. Instead, use the specific lambda handler roles that need it, and remove the default masters role. BREAKING CHANGE: A masters role is no longer provisioned by default. Use the `mastersRole` property to explicitly pass a role that needs cluster access. In addition, the creation role no longer allows any identity (with the appropriate `sts:AssumeRole` permissions) to assume it. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
The CreationRole and the default MastersRole use the account root principal in their trust policy, which is overly permissive. Instead, use the specific lambda handler roles that need it, and remove the default masters role.
BREAKING CHANGE: A masters role is no longer provisioned by default. Use the
mastersRoleproperty to explicitly pass a role that needs cluster access. In addition, the creation role no longer allows any identity (with the appropriatests:AssumeRolepermissions) to assume it.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license