Update perm boundary to restrict removing/Updating perm boundary for …

…IAM users
BCDevOps · Oct 25, 2023 · 6ee8843 · 6ee8843
1 parent 04ef86e
commit 6ee8843
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/modules/account-sso/main.tf b/modules/account-sso/main.tf
@@ -71,16 +71,19 @@ resource "aws_iam_policy" "bcgov_perm_boundary" {
           "iam:Update*",
           "iam:Delete*",
           "iam:DetachRolePolicy",
-          "iam:DeleteRolePolicy"
+          "iam:DeleteRolePolicy",
+          "iam:DeleteUserPermissionsBoundary",
+          "iam:PutUserPermissionsBoundary",
+          "iam:DeleteRolePermissionsBoundary"
         ]
         Effect = "Deny"
         Resource = [
           "arn:aws:iam::*:policy/BCGOV*",
           "arn:aws:iam::*:role/CloudCustodian",
           "arn:aws:iam::*:role/AWSCloudFormationStackSetExecutionRole",
           "arn:aws:iam::*:role/*BCGOV*",
-          "arn:aws:iam::*:instance-profile/EC2-Default-SSM-AD-Role-ip"
-
+          "arn:aws:iam::*:instance-profile/EC2-Default-SSM-AD-Role-ip",
+          "arn:aws:iam::*:user/*"
         ]
         Sid = "DenyPermBoundaryBCGovAlteration"
       },