Setting up Lambda to Create AWS CloudFormation without IAM Policy

Question

What are the best practices for CloudFormation stacks that create IAM users? I'm creating an API that will automatically add clients to one of our services, i.e., it uses a CloudFormation template to create buckets, dynamo db entries, IAM user, etc.

You send a POST call to a route with specific parameters in the call, and it will create the client and everything that's needed for them; however, due to security concerns, I'm hesitant to allow a lambda role to have IAM permissions. We take IAM user creation extremely seriously, as this could always have a negative connotation.

Is there a way that I could create a CloudFormation stack, but require an Admin's manual approval to create it? I noticed there isn't a way to "delay" a stack for approval from another entity who has the correct permissions, since, for stacks to be created in the first place, proper policies must be in place for the entity creating it.

So, in summary, send a POST request to a URL that creates a stack needing Admin approval with proper permissions to activate the creation.

I'm starting to believe this isn't possible, so what are some recommendations?

We have thought about some other methods:

API call uploads the generated CloudFormation template to an s3, then admins manually create the stack with object url
Modify the CloudFormation template to remove the IAM section, and have Admins create that portion manually

Either way, it kinda takes away from the "automation" aspect.

Any thoughts?

So the person, or process, that is making the POST request is not an admin with the appropriate permissions needed to create the stack? — Mark B
Exactly. It's an API call made from a front-end from another department. — ThomasTaylor
Then that sounds like a HORRIBLE idea from a security perspective to completely automate that. You want that to go into a manual approval queue of some sort. — Mark B
I completely agree with you, that's exactly what we're asking. Is there a way to essentially "queue" cloudformation templates pending our approval? — ThomasTaylor
To add to my previous comment, the front end is also through a federated SAML auth which only provides access to specific people within that department. — ThomasTaylor

Milan Cermak Milan Cermak · Accepted Answer · 2019-01-11T17:47:39

I would suggest to use AWS Step Functions to create a state machine (a codified process) around the approval mechanism. The POST request would then trigger a new Step Function execution with the specific CFN template. I imagine you would need to build a simple frontend to list all the pending Step Function executions (i.e. pending approvals).

An alternative solution could be built on top of CodePipeline. A pipeline execution can have a manual approval action and it can be configured in a way that it would creating the stack by itself.

Setting up Lambda to Create AWS CloudFormation without IAM Policy

2 Answers