How to create a condition which allows only resources created in the same CloudFormation stack to assume IAM role?

Question

I'm creating a CloudFormation stack that has a CodeBuild and an IAM role as a resource. I'd like to know if is there a condition that allows only resources created in the same stack to assume the role.

Currently, my stack is defined this way:

  CodeBuildProjectIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole

  CodeBuildProject:
    Type: AWS::CodeBuild::Project

The problem is that any CodeBuild project can assume the role above.

When I try to add a condition specifying that only principals with aws:cloudformation:stack-name equal stack name can assume the role:

  CodeBuildProjectIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:PrincipalTag/aws:cloudformation:stack-name: !Ref 'AWS::StackName'

, I get this error:

Condition can contain only one colon. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument)

I think this is just a syntax error. Try adding ', something like: 'aws:PrincipalTag/aws:cloudformation:stack-name:'. — lexicore
@lexicore I've tried 'aws:PrincipalTag/aws:cloudformation:stack-name:' (got Template format error: YAML not well-formed) and 'aws:PrincipalTag/aws:cloudformation:stack-name': (got Condition can contain only one colon) — Pedro Arantes

maafk maafk · Accepted Answer · 2019-12-30T19:28:58

Based on these docs I don't believe what you're trying to do is possible a this time.

Specifically:

You cannot limit permissions to pass a role based on tags attached to that role using the ResourceTag/key-name condition key

How to create a condition which allows only resources created in the same CloudFormation stack to assume IAM role?

1 Answers