Removing usage of IAM AWS Managed Policies in L2+ constructs

[dontirun]

I think it would be ultimately beneficial to replace AWS Managed Policies in L2+ constructs with Customer Managed Policies/Inline Policies and would like to hear other people's thoughts on the matter

Background

I've had many cases where I've been asked to remove AWS Managed Policies from L2+ constructs. While this can be done through Aspects and Overrides this is both tedious and not friendly.

Rationale

There are 2 main problems using AWS managed policies

1. When AWS updates the policies, the permissions granted to services using those policies change without customer knowledge and outside of deployment
2. Generally aren't designed for least privileged access

Pros

1. User control over permission changes
2. Better scoped privileges

Cons

1. Increased template size

[niebloomj]

Cdknag is always complaining about this. I definitely agree with the approach here. We need to be building with least privilege in mind by default! 🚀🥳🚀

[maafk]

In the AWS Solutions nag pack, AwsSolutions-IAM4 errors due to AWS Managed Policies being used

An AWS managed policy is a standalone policy that is created and administered by AWS. Currently, many AWS managed policies do not restrict resource scope. Replace AWS managed policies with system specific (customer) managed policies. This is a granular rule that returns individual findings that can be suppressed with appliesTo. The findings are in the format Policy:: for AWS managed policies. Example: appliesTo: ['Policy::arn:AWS::Partition:iam::aws:policy/foo'].

Since AWS managed policies are used in many L2/3 constructs (example), I end up adding dozens of suppressions for AwsSolutions-IAM4.

[niebloomj]

Same over here. I would love to stop having to code the suppressions into every single one of my projects

[dontirun]

I do want to make to note that cdk-nag isn't part of the CDK or maintained by the CDK team. I think not having to suppress the rule is a side benefit to fixing the actual problem

[niebloomj]

Right. It's definitely a side benefit. But the reason it's part of CDK nag is that it has a security smell. I definitely think that whatever our defaults are for using CDK should be at the highest security bar. Secure by default.