CI with the administrator role

The pipeline can apply this stack. What else can it do?

resource "aws_iam_role_policy_attachment" "ci" {
  role       = aws_iam_role.ci.name
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}

Next puzzle in --:--:-- UTC

One try. The first answer sticks.

How to fix it

AdministratorAccess is the whole account. Replace it with a policy that lists the APIs this stack uses, and protect the role with a permission boundary.

Attaching AdministratorAccess makes the pipeline an owner of the account. A poisoned plan, a stolen GITHUB_TOKEN that can start the workflow, or a bad module can create users, turn off CloudTrail, or copy data. "The apply needs it" usually means nobody listed the actual calls.

Generate the policy from a staging apply with CloudTrail, or from terraform plan plus the AWS provider's documented actions. Expect to iterate. A denied call in a pull request is the feedback you want.

Fix

resource "aws_iam_role_policy_attachment" "ci" {
  role       = aws_iam_role.ci.name
  policy_arn = aws_iam_policy.ci_apply.arn
}

Write aws_iam_policy.ci_apply with the actions this state file uses. Deny iam:AttachUserPolicy and CloudTrail changes unless this stack is the account baseline, and even then put that in a different role with a different workflow. Require the OIDC subject to be the deploy environment, not every branch.

Sponsor this spot

Put your tool on the puzzle

One labeled card, in front of engineers who show up every day from YouTube, TikTok, and Instagram.

Advertise