Skip to content

Commit

Permalink
chore: add condition to bootstrap file publish role (#30823)
Browse files Browse the repository at this point in the history
Adds a condition to restrict s3 permissions on the file publish role.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
  • Loading branch information
scanlonp authored Jul 12, 2024
1 parent 8d55d86 commit 5ef3be5
Showing 1 changed file with 5 additions and 1 deletion.
6 changes: 5 additions & 1 deletion packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -377,6 +377,10 @@ Resources:
Resource:
- Fn::Sub: "${StagingBucket.Arn}"
- Fn::Sub: "${StagingBucket.Arn}/*"
Condition:
StringEquals:
aws:ResourceAccount:
- Fn::Sub: ${AWS::AccountId}
Effect: Allow
- Action:
- kms:Decrypt
Expand Down Expand Up @@ -619,7 +623,7 @@ Resources:
Type: String
Name:
Fn::Sub: '/cdk-bootstrap/${Qualifier}/version'
Value: '20'
Value: '21'
Outputs:
BucketName:
Description: The name of the S3 bucket owned by the CDK toolkit stack
Expand Down

0 comments on commit 5ef3be5

Please sign in to comment.