Is FullAccess Role secure? about aws-sam-cli

[hawflau]

Hey @fade2black thanks for raising the issue.

The role is created for the pipeline to deploy resources of your application through CloudFormation. As the pipeline does not have any knowledge about your application (e.g. what resources will be created/updated), the role gives CloudFormation full access. In other words, it ensures CloudFormation to be able to deploy any change from your application template.

The risk thus lies in the application template - if an attacker adds a malicious resource in your application template (e.g. an IAM Role with admin access), the piepline will deploy it. Mitigation of this risk is to make sure only authorized persons can commit to your application template, and have a thorough review process before any change can be merged.

Alternatively, you can create your own CloudFormation Execution Role with limited scope for your application and supply that role when you create your pipeline.

Please let me know if you have any further question.

[fade2black]

@hawflau Clear now. Thank you for reply.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.