Back to notes
• 3 min read

IAM Role for Sync from Git

Sync from Git needs an IAM role that gives CloudFormation permission to create resources in your stack. This role goes into the connection repo from post 2 and is deployed manually alongside the connection. Both the connection and the role are prerequisites that must exist before any Git Sync deployment.

Trust Policy

The role needs two principals in its AssumeRolePolicyDocument. This is a trust policy. It doesn’t define what the role can do, it defines who is allowed to assume it. The permissions come later.

AWSTemplateFormatVersion: '2010-09-09'

Resources:
  CloudFormationGitSyncRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: CloudFormationGitSyncRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - cloudformation.sync.codeconnections.amazonaws.com
                - cloudformation.amazonaws.com
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'aws:SourceAccount': !Sub '${AWS::AccountId}'
  • Service lists both principals in a single statement. cloudformation.sync.codeconnections.amazonaws.com is the Git Sync service that kicks off deployments when your repo changes. cloudformation.amazonaws.com is CloudFormation itself, which assumes the role to create, update, and delete resources in your stack.
  • aws:SourceAccount locks both principals to your own AWS account. Without it, the role is vulnerable to confused deputy attacks where another account’s Git Sync configuration could assume it.

Permissions

The role uses a single inline policy with explicit actions for each service. Four groups cover everything Git Sync and CloudFormation need for the certificate stack.

  • CloudFormation actions let Git Sync create and execute change sets against your stack.
  • EventBridge actions let Git Sync set up event rules that trigger deployments on repo changes. Rule names are generated automatically, so Resource: '*' is standard here.
  • ACM permissions let CloudFormation request, describe, tag, and delete certificates.
  • Route 53 permissions let it write the DNS validation records into your hosted zone.
      Policies:
        - PolicyName: GitSyncPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'cloudformation:CreateChangeSet'
                  - 'cloudformation:DeleteChangeSet'
                  - 'cloudformation:DescribeChangeSet'
                  - 'cloudformation:DescribeStackEvents'
                  - 'cloudformation:DescribeStacks'
                  - 'cloudformation:ExecuteChangeSet'
                  - 'cloudformation:GetTemplate'
                  - 'cloudformation:ListChangeSets'
                  - 'cloudformation:ListStacks'
                  - 'cloudformation:ValidateTemplate'
                Resource: '*'
              - Effect: Allow
                Action:
                  - 'events:PutRule'
                  - 'events:PutTargets'
                  - 'events:DescribeRule'
                Resource: '*'
              - Effect: Allow
                Action:
                  - 'acm:RequestCertificate'
                  - 'acm:DescribeCertificate'
                  - 'acm:DeleteCertificate'
                  - 'acm:AddTagsToCertificate'
                  - 'acm:ListTagsForCertificate'
                  - 'acm:ListCertificates'
                Resource: '*'
              - Effect: Allow
                Action:
                  - 'route53:ChangeResourceRecordSets'
                  - 'route53:GetHostedZone'
                  - 'route53:GetChange'
                  - 'route53:ListResourceRecordSets'
                Resource: '*'

As you add more resources in future posts, you’ll add permissions to this role. The full CloudFormation template is in the repo linked below.

Deploying the Role

Add the role resource to infra.yaml in your connection repo from post 2. You need one last manual stack update to create it. The role must exist before you can use it to set up Git Sync.

Go to CloudFormation > Stacks, select the connection stack, click Update, choose Replace existing template, and upload the updated infra.yaml. CloudFormation creates the role alongside the existing connection.