PR Custody

PRPR Custody

Add IAM Identity Center role model

@acsrujanchecks n/achecks…iam-identity-center-roles → main2 files · +882 −128updated 2d ago

GitHub

▸Description· 1 comment

Summary

import the existing IAM Identity Center permission sets, managed policy attachments, and missing live users/groups/assignments into the aws-org-management stack
add new least-privilege permission sets for break-glass, org admin, security, production, non-prod developer, and database operator workflows
document the current state, target role model, account mapping, and migration order in the stack README

Validation

npx tsc --noEmit -p stacks/aws-org-management/tsconfig.json
AWS_PROFILE=srujan@composio-org-management pulumi preview --stack dev --diff (fails on pre-existing unrelated drift: missing DatadogIntegration Lambda resources and missing ConnectToVantage cross-account role; SSO imports render with valid import IDs)

@groovyBugify2d ago

Reviewed this from a security lens — the role model and the least-privilege split (especially isolating rds-db:connect to DBA, short session durations, and the consistent iam/org/billing/sso denies) look well thought through. Trusting your call on the overall design.

The existing SCPs cover the audit/security-control teardown verbs, so no concern there.

One thing I'd just confirm before/with the migration: that our existing Config/GuardDuty detective controls for RDS-public and S3-public apply to these accounts — so nothing in these roles can accidentally expose a DB or bucket publicly. If that's already covered, no changes needed from me. 👍

loading diff…