fix: Change assume role policies to new org and roles #1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
📝 WalkthroughWalkthrough
Sequence Diagram(s)sequenceDiagram
autonumber
participant UserA as User (acct 978928340082)
participant UserB as User (acct 318911662267)
participant STS as AWS STS
participant IAM as IAM Role (engineer_role / admin_role)
rect rgb(245,245,255)
note left of IAM: assume_role_policy contains two trust blocks\n- trust for root 978928340082\n- trust for root 318911662267 with ArnLike conditions
end
UserA->>STS: AssumeRole(RoleArn)
STS->>IAM: Evaluate assume_role_policy
IAM-->>STS: Check Principal == 978928340082 root
alt Conditions pass (978...)
STS-->>UserA: Temporary credentials
else
STS-->>UserA: AccessDenied
end
UserB->>STS: AssumeRole(RoleArn)
STS->>IAM: Evaluate assume_role_policy
IAM-->>STS: Check Principal == 318911662267 root
IAM-->>STS: Check ArnLike PrincipalArn conditions\n- engineer_role: ProductionEngineer_81bae8be82beff06*, ProductionAdmin_e7ae0d41f57593ac*\n- admin_role: ProductionAdmin_e7ae0d41f57593ac*
alt Conditions pass (3189... + ArnLike)
STS-->>UserB: Temporary credentials
else
STS-->>UserB: AccessDenied
end
Pre-merge checks✅ Passed checks (3 passed)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: ASSERTIVE Plan: Pro Disabled knowledge base sources:
📒 Files selected for processing (1)
🧰 Additional context used🧠 Learnings (1)📚 Learning: 2025-09-19T15:47:05.573ZApplied to files:
🔇 Additional comments (2)
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
main.tf (1)
189-203: Mirror the hardening for admin trust policy.Use name‑based wildcards and bind the principal account.
Condition = { - ArnLike = { - "aws:PrincipalArn" = [ - "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_ProductionAdmin_e7ae0d41f57593ac*", - "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_ProductionAdmin_e7ae0d41f57593ac*" - ] - } + ArnLike = { + "aws:PrincipalArn" = [ + "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_ProductionAdmin_*", + "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_ProductionAdmin_*" + ] + } + StringEquals = { + "aws:PrincipalAccount" = "318911662267" + } }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
main.tf(2 hunks)
🔇 Additional comments (1)
main.tf (1)
151-170: Harden engineer trust policy — wildcard SSO permission‑set names & bind account.Use name wildcards (avoid fragile GUID prefixes) and add aws:PrincipalAccount for defense‑in‑depth. aws CLI is unavailable here — verify actual ARNs in account 318911662267 and apply the change below.
File: main.tf Lines: 151-170
Condition = { - ArnLike = { - "aws:PrincipalArn" = [ - "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_ProductionEngineer_81bae8be82beff06*", - "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_ProductionEngineer_81bae8be82beff06*", - "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_ProductionAdmin_e7ae0d41f57593ac*", - "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_ProductionAdmin_e7ae0d41f57593ac*" - ] - } + ArnLike = { + "aws:PrincipalArn" = [ + "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_ProductionEngineer_*", + "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_ProductionEngineer_*", + "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_ProductionAdmin_*", + "arn:aws:iam::318911662267:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_ProductionAdmin_*" + ] + } + StringEquals = { + "aws:PrincipalAccount" = "318911662267" + } }Verify actual ARNs in the account (run where aws CLI is installed/configured for 318911662267):
aws iam list-roles \ --query 'Roles[?starts_with(RoleName, `AWSReservedSSO_Production`)].{Name:RoleName,Arn:Arn}' \ --output table
m1so
approved these changes
Sep 24, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Since the AWS organization will be dissolved soon we will lose SSO access via the old account and roles. LabLabs already created new roles in the prod account.
These changes should be shared with all customers and ensured they ran successfully, before the old org can be dissolved.
Summary by CodeRabbit