Skip to content

Commit 3866964

Browse files
aws-sdk-dotnet-automationaws-sdk-dotnet-automation
authored
chore: update CDK bootstrap template to version 29 (#975)
1 parent e439af7 commit 3866964

File tree

2 files changed

+140
-14
lines changed

2 files changed

+140
-14
lines changed

‎.autover/changes/fbb29339-2144-451d-af2a-65656b4bf748.json‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"Projects": [
3+
{
4+
"Name": "AWS.Deploy.CLI",
5+
"Type": "Patch",
6+
"ChangelogMessages": [
7+
"Update CDK Bootstrap template to version 29"
8+
]
9+
}
10+
]
11+
}

‎src/AWS.Deploy.Orchestration/CDK/CDKBootstrapTemplate.yaml‎

Lines changed: 129 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,13 @@ Parameters:
5151
Type: String
5252
Default: "AWS CDK: Default Resources"
5353
Description: Describe the provenance of the resources in this bootstrap stack. Change this when you customize the template. To prevent accidents, the CDK CLI will not overwrite bootstrap stacks with a different variant.
54+
DenyExternalId:
55+
Type: String
56+
Default: "true"
57+
AllowedValues:
58+
- "true"
59+
- "false"
60+
Description: Whether to deny AssumeRole calls with an ExternalId. This prevents calls that are intended to be deputized from accidentally assuming CDK Roles.
5461
Conditions:
5562
HasTrustedAccounts:
5663
Fn::Not:
@@ -104,6 +111,10 @@ Conditions:
104111
Fn::Equals:
105112
- "true"
106113
- Ref: PublicAccessBlockConfiguration
114+
ShouldDenyExternalId:
115+
Fn::Equals:
116+
- "true"
117+
- Ref: DenyExternalId
107118
Resources:
108119
FileAssetsBucketEncryptionKey:
109120
Type: AWS::KMS::Key
@@ -288,19 +299,41 @@ Resources:
288299
Properties:
289300
AssumeRolePolicyDocument:
290301
Statement:
291-
- Action: sts:TagSession
302+
- Action: sts:AssumeRole
292303
Effect: Allow
293304
Principal:
294305
AWS:
295306
Ref: AWS::AccountId
296-
- Action: sts:AssumeRole
307+
Condition:
308+
Fn::If:
309+
- ShouldDenyExternalId
310+
- "Null":
311+
sts:ExternalId: "true"
312+
- Ref: AWS::NoValue
313+
- Action: sts:TagSession
297314
Effect: Allow
298315
Principal:
299316
AWS:
300317
Ref: AWS::AccountId
301318
- Fn::If:
302319
- HasTrustedAccounts
303-
- Action: sts:AssumeRole
320+
- Action:
321+
- sts:AssumeRole
322+
Effect: Allow
323+
Principal:
324+
AWS:
325+
Ref: TrustedAccounts
326+
Condition:
327+
Fn::If:
328+
- ShouldDenyExternalId
329+
- "Null":
330+
sts:ExternalId: "true"
331+
- Ref: AWS::NoValue
332+
- Ref: AWS::NoValue
333+
- Fn::If:
334+
- HasTrustedAccounts
335+
- Action:
336+
- sts:TagSession
304337
Effect: Allow
305338
Principal:
306339
AWS:
@@ -316,19 +349,41 @@ Resources:
316349
Properties:
317350
AssumeRolePolicyDocument:
318351
Statement:
319-
- Action: sts:TagSession
352+
- Action: sts:AssumeRole
320353
Effect: Allow
321354
Principal:
322355
AWS:
323356
Ref: AWS::AccountId
324-
- Action: sts:AssumeRole
357+
Condition:
358+
Fn::If:
359+
- ShouldDenyExternalId
360+
- "Null":
361+
sts:ExternalId: "true"
362+
- Ref: AWS::NoValue
363+
- Action: sts:TagSession
325364
Effect: Allow
326365
Principal:
327366
AWS:
328367
Ref: AWS::AccountId
329368
- Fn::If:
330369
- HasTrustedAccounts
331-
- Action: sts:AssumeRole
370+
- Action:
371+
- sts:AssumeRole
372+
Effect: Allow
373+
Principal:
374+
AWS:
375+
Ref: TrustedAccounts
376+
Condition:
377+
Fn::If:
378+
- ShouldDenyExternalId
379+
- "Null":
380+
sts:ExternalId: "true"
381+
- Ref: AWS::NoValue
382+
- Ref: AWS::NoValue
383+
- Fn::If:
384+
- HasTrustedAccounts
385+
- Action:
386+
- sts:TagSession
332387
Effect: Allow
333388
Principal:
334389
AWS:
@@ -344,27 +399,65 @@ Resources:
344399
Properties:
345400
AssumeRolePolicyDocument:
346401
Statement:
347-
- Action: sts:TagSession
402+
- Action: sts:AssumeRole
348403
Effect: Allow
349404
Principal:
350405
AWS:
351406
Ref: AWS::AccountId
352-
- Action: sts:AssumeRole
407+
Condition:
408+
Fn::If:
409+
- ShouldDenyExternalId
410+
- "Null":
411+
sts:ExternalId: "true"
412+
- Ref: AWS::NoValue
413+
- Action: sts:TagSession
353414
Effect: Allow
354415
Principal:
355416
AWS:
356417
Ref: AWS::AccountId
357418
- Fn::If:
358419
- HasTrustedAccountsForLookup
359-
- Action: sts:AssumeRole
420+
- Action:
421+
- sts:AssumeRole
422+
Effect: Allow
423+
Principal:
424+
AWS:
425+
Ref: TrustedAccountsForLookup
426+
Condition:
427+
Fn::If:
428+
- ShouldDenyExternalId
429+
- "Null":
430+
sts:ExternalId: "true"
431+
- Ref: AWS::NoValue
432+
- Ref: AWS::NoValue
433+
- Fn::If:
434+
- HasTrustedAccountsForLookup
435+
- Action:
436+
- sts:TagSession
360437
Effect: Allow
361438
Principal:
362439
AWS:
363440
Ref: TrustedAccountsForLookup
364441
- Ref: AWS::NoValue
365442
- Fn::If:
366443
- HasTrustedAccounts
367-
- Action: sts:AssumeRole
444+
- Action:
445+
- sts:AssumeRole
446+
Effect: Allow
447+
Principal:
448+
AWS:
449+
Ref: TrustedAccounts
450+
Condition:
451+
Fn::If:
452+
- ShouldDenyExternalId
453+
- "Null":
454+
sts:ExternalId: "true"
455+
- Ref: AWS::NoValue
456+
- Ref: AWS::NoValue
457+
- Fn::If:
458+
- HasTrustedAccounts
459+
- Action:
460+
- sts:TagSession
368461
Effect: Allow
369462
Principal:
370463
AWS:
@@ -457,19 +550,41 @@ Resources:
457550
Properties:
458551
AssumeRolePolicyDocument:
459552
Statement:
460-
- Action: sts:TagSession
553+
- Action: sts:AssumeRole
461554
Effect: Allow
462555
Principal:
463556
AWS:
464557
Ref: AWS::AccountId
465-
- Action: sts:AssumeRole
558+
Condition:
559+
Fn::If:
560+
- ShouldDenyExternalId
561+
- "Null":
562+
sts:ExternalId: "true"
563+
- Ref: AWS::NoValue
564+
- Action: sts:TagSession
466565
Effect: Allow
467566
Principal:
468567
AWS:
469568
Ref: AWS::AccountId
470569
- Fn::If:
471570
- HasTrustedAccounts
472-
- Action: sts:AssumeRole
571+
- Action:
572+
- sts:AssumeRole
573+
Effect: Allow
574+
Principal:
575+
AWS:
576+
Ref: TrustedAccounts
577+
Condition:
578+
Fn::If:
579+
- ShouldDenyExternalId
580+
- "Null":
581+
sts:ExternalId: "true"
582+
- Ref: AWS::NoValue
583+
- Ref: AWS::NoValue
584+
- Fn::If:
585+
- HasTrustedAccounts
586+
- Action:
587+
- sts:TagSession
473588
Effect: Allow
474589
Principal:
475590
AWS:
@@ -639,7 +754,7 @@ Resources:
639754
Type: String
640755
Name:
641756
Fn::Sub: /cdk-bootstrap/${Qualifier}/version
642-
Value: "28"
757+
Value: "29"
643758
Outputs:
644759
BucketName:
645760
Description: The name of the S3 bucket owned by the CDK toolkit stack

0 commit comments

Comments
 (0)