Free tools Windows power users keep installed
One-click scans. No signup required.
A CloudFormation template that appears to deploy resources for one AWS service does not, on its own, show all the authority involved. CloudFormation may use the caller’s credentials or an attached service role; macros can rewrite a template before provisioning; and custom-resource providers can run their own code in response to stack events. Least-privilege review should cover each of these boundaries—not assume that every deployment escapes its stated service boundary.
Start with the credentials CloudFormation uses
The identity that starts a stack operation and the identity that makes resource API calls are not always the same. Which credentials CloudFormation uses depends on whether the stack has an associated service role.
As an Amazon Associate I earn from qualifying purchases.
| Credential model | Who needs permissions | Key review question |
|---|---|---|
| No CloudFormation service role | The invoking principal needs CloudFormation permissions and permissions for the resources being provisioned. | Does each principal allowed to deploy have only the resource permissions its templates require? |
| CloudFormation service role attached | The caller needs stack-operation permissions and permission to pass an allowed role. CloudFormation uses the role’s credentials for stack operations. | Is the role narrowly scoped, and who can pass it or operate the stack that uses it? |
A service role can centralize resource provisioning, but its permissions become part of the stack’s ongoing operating model. AWS says CloudFormation uses the role for all operations on that stack, and the role cannot be removed once associated. Other principals with permission to operate the stack can use the attached role without separately having iam:PassRole. That makes stack-operation access consequential even when an operator cannot pass the role themselves. See AWS guidance on CloudFormation service roles.
Build the role from the templates’ actual needs
For a service-role deployment, derive permissions from the actions and resources the templates actually require. Avoid treating a broad managed policy as a convenient default: an overprivileged persistent role can turn otherwise limited stack-operation permissions into a path to more authority.
#1 Best Overall
- Limit the actions and resources in the service role to what the stack needs.
- Control which roles a caller may pass with the
cloudformation:RoleARNcondition key, and monitor identities that can pass privileged roles. - Review both stack operators and the permissions of the role attached to each stack.
AWS discusses controlling role selection and use in its CloudFormation least-privilege guidance.
Check what happens to the template before provisioning
A macro is a Lambda-backed processor that can transform part of a template or the full template. CloudFormation processes the template before handling its resources, and the processed result can contain resources that were not apparent in the authored version—for example, additional IAM or other resources.
Review the processed change set, not only the source template, before execution. AWS’s macro documentation explains that users need permission to invoke the underlying Lambda function and that CloudFormation impersonates the user while running a macro to prevent potential escalation. Keep that behavior distinct from provisioning: a macro’s ability to rewrite a template is not the same as the role CloudFormation later uses to create the resulting resources.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Include custom-resource providers in the authority review
A custom resource declares a service token, such as an SNS topic ARN or Lambda function ARN, identifying the provider. On create, update, or delete, CloudFormation sends the provider a lifecycle request containing request data and waits for a response. The provider handles that request and may perform work beyond what built-in CloudFormation resource types express.
Rank #3
Review the provider as part of the deployment’s effective authority, rather than treating the custom resource as an opaque template entry. Inspect:
- the provider implementation and what it does with each lifecycle request;
- the provider’s execution role and trust policy; and
- the properties passed to the provider, including any values that affect what it creates or changes.
AWS describes the request-and-response model in its custom resources documentation.
Rank #4
Apply different guardrails to different boundaries
No single IAM control covers every risk in a CloudFormation deployment. Role policies constrain API authority; stack policies protect selected resources from certain stack updates; organization-level controls can restrict accounts or principals. Use controls for the problem they are designed to address.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteConstrain cross-service trust where it applies
For the CloudFormation registry or extension service-principal trust relationships covered by AWS guidance, use aws:SourceArn and aws:SourceAccount conditions in resource policies to restrict which CloudFormation resource or account can exercise access. Prefer a full aws:SourceArn when possible; if it does not include an account ID, pair it with aws:SourceAccount. These conditions address the relevant service-principal trust relationship; they are not a general substitute for scoping IAM permissions. See AWS guidance for resource-type trust policies.
Protect critical resources and reduce excess permissions
- Use stack policies to help prevent unintended updates to critical stack resources. They are not a replacement for a narrowly scoped service role.
- Use IAM Access Analyzer to identify unused permissions on CloudFormation service roles.
- Consider service control policies and permissions boundaries as additional constraints, recognizing that they address different levels of access.
AWS covers these measures in its least-privilege guidance for CloudFormation.
Choose a credential model that fits your governance
Neither credential model is universally safer. Using the caller’s credentials makes each deploying principal’s direct resource permissions central to the review. An attached role can centralize provisioning and separate stack operators from direct resource-service permissions, but its persistence means that role scope and stack-operation access must be governed together.
When deciding between them, compare who receives direct resource permissions, how tightly a service role can be scoped, who can pass it, who can operate the stack after it is attached, and how the team reviews processed template changes. The right choice depends on the workload and the organization’s access model; the key is to inspect the authority at each boundary rather than infer it from the resource names in the authored template.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
