Set permission boundary for new AWS intents roles (#337)

otterize · Jan 20, 2024 · f38bc95 · f38bc95
1 parent 6359b4c
commit f38bc95
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/shared/awsagent/roles.go b/src/shared/awsagent/roles.go
@@ -82,7 +82,8 @@ func (a *Agent) CreateOtterizeIAMRole(ctx context.Context, namespaceName, accoun
 					Value: aws.String(a.clusterName),
 				},
 			},
-			Description: aws.String(iamRoleDescription),
+			Description:         aws.String(iamRoleDescription),
+			PermissionsBoundary: aws.String(fmt.Sprintf("arn:aws:iam::%s:policy/%s-limit-iam-permission-boundary", a.accountID, a.clusterName)),
 		})
 
 		if createRoleError != nil {