Proposal: IAM role path's

[jplock]

Description:

I'd like to be able to specify the IAM role Path on either a function or globals.

Observed result:

Able to specify Path on a Function or Globals

Expected result:

Path is set on the implicitly created IAM roles

[jplock]

Would you accept a PR for this?

[keetonian]

@jplock just to confirm: you'd like to expose this path property from the implicit AWS::IAM::Role resource?

And for our curiosity- what is your use case for wanting this property exposed?

[jplock]

@keetonian yes, correct. We have policies in place to allow teams to only create IAM roles via CloudFormation templates if they provide a specific CF service role. The service role only allows managing IAM policies with a specific Path and a PermissionBoundary must also be applied. The Path allows us to restrict the IAM roles developers can manage to only the ones they’ve created themselves within the Path.

Hopefully that makes sense.

With out this change, we have to define explicit roles in SAM to set both the Path and PermissionBoundary (although PermissionsBoundary is already supported).

[keetonian]

Ok, this could be a good addition then. I think we should add this property to the AWS::Serverless::Function spec like we have for PermissionsBoundary, and what do you think about calling it RolePath?

To add this property:

Add RolePath as a new property here: https://github.com/awslabs/serverless-application-model/blob/develop/samtranslator/model/sam_resources.py#L68

Do the translation to an AWS::IAM::Role here: https://github.com/awslabs/serverless-application-model/blob/develop/samtranslator/model/sam_resources.py#L528

Update tests as appropriate

[jplock]

Great, happy to work on that.

[jplock]

Created https://github.com/awslabs/serverless-application-model/pull/1567 for this change.

[mattjhill]

Is there any plan to implement this? I have a similar use case as described above and need to be able to specify a RolePath to continue using my current SAM templates.

[jfalkenstein]

Agreed on this. I really would like to see this. I also have a case where a permissions boundary only permits creating roles on a certain path.

[GavinZZ]

RolePath implementation for SAM Function is merged. (Pending release). RolePath for SAM StateMachine is under implementation.

[GavinZZ]

Both SAM Function and StateMachine support are completed last week. Waiting for release. SAM Function RolePath PR: https://github.com/aws/serverless-application-model/pull/2659 SAM StateMachine RolePath PR: https://github.com/aws/serverless-application-model/pull/2684

[aahung]

Released in v1.56.0

[jplock]

Yay! Thank you!

[bakosa]

@aahung Thank you! trying to use the new RolePath property as well.

However, using the latest sam cli release v1.68.0 I am getting InvalidResourceException property RolePath not defined for resource of type AWS::Serverless::Function

Sorry for my ignorance, have not dug into this code enough but how does the CLI pick up this change?

EDIT: see this PR. guessing need to cut new release

[aahung]

@bakosa yes it will be available in next release of SAM CLI