Spoke stack custom role path

[mdgm88]

Is your feature request related to a problem? Please describe.

There can be security roles protecting roles starting with a particular name and/or in a particular path from being modified by non-privileged users/roles.

CDK supports creating roles with custom paths. It would be great if the solution was updated to allow specifying a custom role path for the remote/spoke stack deployed to each member account as currently not all roles are created with the namespace at the start of the name.

Describe the feature you'd like

New parameter for remote stack to specify IAM role path
New parameter for hub stack to specify IAM role path used in remote stack (must match the one used for the remote stack)

Additional context

[shujacks]

Thanks for reaching out, we will evaluate and respond shortly.

[CrypticCabub]

hi @mdgm88

Could you help me understand your use-case a little more? Are you trying to protect the roles used by EventBridge for forwarding events from the spoke to the hub accounts? What other roles are you looking to add extra protection to?

I am hesitant to add an additional prefix on-top of the name space due to the potential of running into max name length issues appending the various components together, but I could see potentially adding the namespace as a prefix to other roles in the solution.

[mdgm88]

Hi @CrypticCabub, I am not that bothered about protecting resources in the central/hub account.

Basically want to protect most/all resources in the spoke account (roles, event rules, event buses, lambda functions etc.) deployed to the accounts with EC2, RDS, ASGs etc. so that they can only be modified/deleted by authorised privileged principals. These controls are much easier to manage when most/all resources start with a consistent name or alternatively in the case of IAM roles an optional role path is used.

With roles the namespace is at the start for some already, which is great. Another option for roles is to specify an optional role path e.g. "/privileged/" and if you wish don't specify the role name and let one automatically be generated for you. If a role path is not provided or set to the default "/" there would be no change for those that don't want to customise this.

It would be easier for me to stay up to date with the solution if I don't need to make as many modifications to the remote template.

I want to avoid privilege escalation and also users deleting resources needed for instance scheduler to work, not realising their importance.

CFN does now have drift detection for detective rather than preventative controls up to a point, but the Instance Scheduler solution still uses AWS::IAM::Policy, which doesn't support drift detection. I raised an issue about AWS::IAM::Policy: #624