Back to notes
• 3 min read

IAM Role for Sync from Git

Last post you built a CloudFormation stack for an SSL certificate. To deploy it with Sync from Git, CloudFormation needs an IAM role with permission to create those resources. Here’s the role scoped to that certificate stack.

Trust Policy

The role needs two principals in its AssumeRolePolicyDocument. This is a trust policy. It doesn’t define what the role can do, it defines who is allowed to assume it. The permissions come later.

AWSTemplateFormatVersion: '2010-09-09'

Resources:
  CloudFormationGitSyncRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: CloudFormationGitSyncRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - cloudformation.sync.codeconnections.amazonaws.com
                - cloudformation.amazonaws.com
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'aws:SourceAccount': !Sub '${AWS::AccountId}'
  • Service lists both principals in a single statement. cloudformation.sync.codeconnections.amazonaws.com is the Git Sync service that kicks off deployments when your repo changes. cloudformation.amazonaws.com is CloudFormation itself, which assumes the role to create, update, and delete resources in your stack.
  • aws:SourceAccount locks both principals to your own AWS account. Without it, the role is vulnerable to confused deputy attacks where another account’s Git Sync configuration could assume it.

Permissions

The role uses a single inline policy with explicit actions for each service. Four groups cover everything Git Sync and CloudFormation need for the certificate stack.

  • CloudFormation actions let Git Sync create and execute change sets against your stack.
  • EventBridge actions let Git Sync set up event rules that trigger deployments on repo changes. Rule names are generated automatically, so Resource: '*' is standard here.
  • ACM permissions let CloudFormation request, describe, tag, and delete certificates.
  • Route 53 permissions let it write the DNS validation records into your hosted zone.
      Policies:
        - PolicyName: GitSyncPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'cloudformation:CreateChangeSet'
                  - 'cloudformation:DeleteChangeSet'
                  - 'cloudformation:DescribeChangeSet'
                  - 'cloudformation:DescribeStackEvents'
                  - 'cloudformation:DescribeStacks'
                  - 'cloudformation:ExecuteChangeSet'
                  - 'cloudformation:GetTemplate'
                  - 'cloudformation:ListChangeSets'
                  - 'cloudformation:ListStacks'
                  - 'cloudformation:ValidateTemplate'
                Resource: '*'
              - Effect: Allow
                Action:
                  - 'events:PutRule'
                  - 'events:PutTargets'
                  - 'events:DescribeRule'
                Resource: '*'
              - Effect: Allow
                Action:
                  - 'acm:RequestCertificate'
                  - 'acm:DescribeCertificate'
                  - 'acm:DeleteCertificate'
                  - 'acm:AddTagsToCertificate'
                  - 'acm:ListTagsForCertificate'
                  - 'acm:ListCertificates'
                Resource: '*'
              - Effect: Allow
                Action:
                  - 'route53:ChangeResourceRecordSets'
                  - 'route53:GetHostedZone'
                  - 'route53:GetChange'
                  - 'route53:ListResourceRecordSets'
                Resource: '*'

As you add more resources in future posts, you’ll add permissions to this role. The full CloudFormation template is in the repo linked below.