AWS IAM role creation for serverless framework - Best Practice

Question

I manage the AWS security in my company.

We by default do not provide IAM role creation permissions to our developers.

But here is the problem, how should we handle this for developers who are using serverless framework to deploy their workloads?

Should we allow them to create IAM roles and have serverless framework to manage the permissions for those roles? or should we precreate the custom roles for this and ask developers to use that Role ARN in serverless.yml or should we use IAM permissions boundary?

Can some one please help ?

Answer 1

It's really hard to tailor the permissions needed by the serverless. In my opinion, the developers should have full AWS access at least to test environments in order to learn and experiment. If you are worried about accidental damage to production resources, you can only make changes to production via CICD tools. You may still have to temporarily grant permission to developers to do the initial configurations.

Answer 2

What you would want to do is use the Permissions Boundary feature provided by AWS. With this feature, the effective permissions the devs / serverless stacks would have is the intersection of the policies defined in the IAM role and the permissions boundary.

For example, lets say that you have allowed your devs to create IAM roles and policies for Lambda functions. You also have defined a permissions boundary with only S3 read access. Now if the devs were to create a serverless stack with Lambda permissions with the AdministratorAccess policy, they would have to include the permissions boundary in the role and the effective permissions that your Lambda functions would have is just S3 read access.

There is a good blog post explaining this implementation in CloudFormation you can modify it to work with Serverless templates. Hope this helps.