Skip to content
Jai
Back to blog
•
3 min read

IAM Role for Sync from Git

Last post you built a CloudFormation stack for an SSL certificate. To deploy it with Sync from Git, CloudFormation needs an IAM role with permission to create those resources. Here’s the role scoped to that certificate stack.

Trust Policy

The role needs two principals in its AssumeRolePolicyDocument. This is a trust policy. It doesn’t define what the role can do, it defines who is allowed to assume it. The permissions come later.

AWSTemplateFormatVersion: '2010-09-09'

Resources:
  CloudFormationGitSyncRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: CloudFormationGitSyncRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.sync.codeconnections.amazonaws.com
            Action: 'sts:AssumeRole'
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action: 'sts:AssumeRole'
  • cloudformation.sync.codeconnections.amazonaws.com is the service principal for Sync from Git. It assumes this role to kick off deployments when your repo changes.
  • cloudformation.amazonaws.com is CloudFormation itself. It assumes the role to actually create, update, and delete resources in your stack.

Permissions

A role gets its permissions from everything attached to it. This role has two separate sources that combine additively.

ManagedPolicyArns attaches a standalone, AWS-maintained policy. AWS manages it for you and updates it if new actions are added. Policies defines an inline policy directly on the role. You manage this yourself because only you know which resources your stacks create.

      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AWSCloudFormationFullAccess'
      Policies:
        - PolicyName: DomainCertStackPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'acm:RequestCertificate'
                  - 'acm:DescribeCertificate'
                  - 'acm:DeleteCertificate'
                  - 'acm:AddTagsToCertificate'
                  - 'acm:ListCertificates'
                Resource: '*'
              - Effect: Allow
                Action:
                  - 'route53:ChangeResourceRecordSets'
                  - 'route53:GetHostedZone'
                  - 'route53:GetChange'
                Resource: '*'
  • ACM permissions let CloudFormation request, describe, tag, and delete certificates.
  • Route 53 permissions let it write the DNS validation records into your hosted zone.

As you add more resources in future posts, you’ll add permissions to this role.