feat: add permission boundary as optional input to all modules

CHANGELOG.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### **Added**
 
+- added permission boundary as optional input to all modules 
+
 ### **Changed**
 
 ## v3.2.2

modules/eks/ray-cluster/README.md

@@ -68,6 +68,7 @@ This module creates a Ray cluster in AWS EKS Kubernetes cluster. It deploys a Ra
 ```
 - `pvc_name` - Persistent volume claim name. Empty by defeault. If no PVC is provided, the volume will not be mounted.
 - `dra_export_path` - Persistent volume mount path. Defaults to `/ray/export/`. Must start with a `/`.
+- `permissions_boundary_name` - IAM Policy Name to attach to all roles as permissions boundary. Empty by default.
 - `tags` - List of additional tags to apply to all resources
 
 ## User Guide

modules/eks/ray-cluster/app.py

@@ -42,6 +42,7 @@
     worker_labels=app_settings.parameters.worker_labels,
     pvc_name=app_settings.parameters.pvc_name,
     dra_export_path=app_settings.parameters.dra_export_path,
+    permissions_boundary_name=app_settings.parameters.permissions_boundary_name,
     env=env,
 )
 

modules/eks/ray-cluster/ray_cluster_stack.py

@@ -44,6 +44,7 @@ def __init__(
         worker_labels: Dict[str, str],
         pvc_name: Optional[str],
         dra_export_path: str,
+        permissions_boundary_name: Optional[str] = None,
         **kwargs: Any,
     ) -> None:
         self.project_name = project_name
@@ -56,6 +57,13 @@ def __init__(
             **kwargs,
         )
 
+        # Apply permissions boundary to all roles in this stack if provided
+        if permissions_boundary_name:
+            permissions_boundary_policy = iam.ManagedPolicy.from_managed_policy_name(
+                self, "PermBoundary", permissions_boundary_name
+            )
+            iam.PermissionsBoundary.of(self).apply(permissions_boundary_policy)
+
         dep_mod = f"{project_name}-{deployment_name}-{module_name}"
         # used to tag AWS resources. Tag Value length can't exceed 256 characters
         full_dep_mod = dep_mod[:256] if len(dep_mod) > 256 else dep_mod

modules/eks/ray-cluster/settings.py

@@ -60,6 +60,7 @@ class SeedFarmerParameters(CdkBaseSettings):
     worker_resources: Dict[str, Dict[str, str]] = Field(default=DEFAULT_POD_RESOURCES)
     worker_tolerations: List[Dict[str, str]] = Field(default=[])
     worker_labels: Dict[str, str] = Field(default={})
+    permissions_boundary_name: Optional[str] = Field(default=None)
     tags: Optional[Dict[str, str]] = Field(default=None)
 
 

modules/eks/ray-cluster/tests/test_stack.py

@@ -53,6 +53,7 @@ def ray_cluster_stack(stack_defaults) -> cdk.Stack:
     worker_labels = {}
     pvc_name = "pvc"
     dra_export_path = "/ray/export"
+    permissions_boundary_name = None
 
     return ray_cluster_stack.RayCluster(
         scope=app,
@@ -82,6 +83,7 @@ def ray_cluster_stack(stack_defaults) -> cdk.Stack:
         worker_labels=worker_labels,
         pvc_name=pvc_name,
         dra_export_path=dra_export_path,
+        permissions_boundary_name=permissions_boundary_name,
         env=cdk.Environment(
             account=os.environ["CDK_DEFAULT_ACCOUNT"],
             region=os.environ["CDK_DEFAULT_REGION"],

modules/eks/ray-operator/README.md

@@ -25,6 +25,7 @@ This module runs Ray Operator in AWS EKS Kubernetes cluster. It deploys a KubeRa
 #### Optional
 
 - `data_bucket_name` - Name of the bucket to grant service account permissions to
+- `permissions_boundary_name` - IAM Policy Name to attach to all roles as permissions boundary. Empty by default.
 - `tags` - List of additional tags to apply to all resources
 
 ### Sample manifest declaration
@@ -78,6 +79,8 @@ parameters:
   - name: Namespace
     valueFrom:
       parameterValue: rayNamespaceName
+  - name: permissions-boundary-name
+    value: my-permissions-boundary
 ```
 
 ### Module Metadata Outputs

modules/eks/ray-operator/app.py

@@ -28,6 +28,7 @@
     eks_openid_issuer=app_settings.parameters.eks_openid_issuer,
     namespace_name=app_settings.parameters.namespace,
     data_bucket_name=app_settings.parameters.data_bucket_name,
+    permissions_boundary_name=app_settings.parameters.permissions_boundary_name,
     env=env,
 )
 
@@ -46,6 +47,7 @@
     namespace_name=app_settings.parameters.namespace,
     service_account_name=rbac_stack.service_account.service_account_name,
     service_account_role=rbac_stack.service_account.role,
+    permissions_boundary_name=app_settings.parameters.permissions_boundary_name,
     env=env,
 )
 

modules/eks/ray-operator/ray_stack.py

@@ -31,6 +31,7 @@ def __init__(
         namespace_name: str,
         service_account_name: str,
         service_account_role: iam.IRole,
+        permissions_boundary_name: str | None = None,
         **kwargs: Any,
     ) -> None:
         self.project_name = project_name
@@ -43,6 +44,13 @@ def __init__(
             **kwargs,
         )
 
+        # Apply permissions boundary to all roles in this stack if provided
+        if permissions_boundary_name:
+            permissions_boundary_policy = iam.ManagedPolicy.from_managed_policy_name(
+                self, "PermBoundary", permissions_boundary_name
+            )
+            iam.PermissionsBoundary.of(self).apply(permissions_boundary_policy)
+
         dep_mod = f"{project_name}-{deployment_name}-{module_name}"
         # used to tag AWS resources. Tag Value length can't exceed 256 characters
         full_dep_mod = dep_mod[:256] if len(dep_mod) > 256 else dep_mod

modules/eks/ray-operator/rbac_stack.py

@@ -29,6 +29,7 @@ def __init__(
         eks_handler_role_arn: str,
         namespace_name: str,
         data_bucket_name: Optional[str],
+        permissions_boundary_name: str | None = None,
         **kwargs: Any,
     ) -> None:
         self.project_name = project_name
@@ -43,6 +44,13 @@ def __init__(
             **kwargs,
         )
 
+        # Apply permissions boundary to all roles in this stack if provided
+        if permissions_boundary_name:
+            permissions_boundary_policy = iam.ManagedPolicy.from_managed_policy_name(
+                self, "PermBoundary", permissions_boundary_name
+            )
+            iam.PermissionsBoundary.of(self).apply(permissions_boundary_policy)
+
         dep_mod = f"{project_name}-{deployment_name}-{module_name}"
         # used to tag AWS resources. Tag Value length can't exceed 256 characters
         full_dep_mod = dep_mod[:256] if len(dep_mod) > 256 else dep_mod

modules/eks/ray-operator/settings.py

@@ -36,6 +36,7 @@ class SeedFarmerParameters(CdkBaseSettings):
     eks_cert_auth_data: str
     eks_handler_role_arn: str
     data_bucket_name: Optional[str] = Field(default=None)
+    permissions_boundary_name: Optional[str] = Field(default=None)
     tags: Optional[Dict[str, str]] = Field(default=None)
 
 

modules/eks/ray-operator/tests/test_stack.py

@@ -38,6 +38,7 @@ def rbac_stack(stack_defaults) -> cdk.Stack:
     eks_handler_role_arn = "arn:aws:iam::123456789012:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/YYYYYYYY"
     namespace = "namespace"
     data_bucket_name = "bucket"
+    permissions_boundary_name = None
 
     return rbac_stack.RbacStack(
         scope=app,
@@ -52,6 +53,7 @@ def rbac_stack(stack_defaults) -> cdk.Stack:
         eks_handler_role_arn=eks_handler_role_arn,
         namespace_name=namespace,
         data_bucket_name=data_bucket_name,
+        permissions_boundary_name=permissions_boundary_name,
         env=cdk.Environment(
             account=os.environ["CDK_DEFAULT_ACCOUNT"],
             region=os.environ["CDK_DEFAULT_REGION"],
@@ -77,6 +79,7 @@ def ray_stack(rbac_stack, stack_defaults) -> cdk.Stack:
     eks_cluster_endpoint = "oidc.eks.us-west-2.amazonaws.com/id/XXXXXXXXXX"
     eks_cert_auth_data = "auth"
     namespace = "namespace"
+    permissions_boundary_name = None
 
     return ray_stack.RayOnEKS(
         scope=app,
@@ -93,6 +96,7 @@ def ray_stack(rbac_stack, stack_defaults) -> cdk.Stack:
         namespace_name=namespace,
         service_account_name=rbac_stack.service_account.service_account_name,
         service_account_role=rbac_stack.service_account.role,
+        permissions_boundary_name=permissions_boundary_name,
         env=cdk.Environment(
             account=os.environ["CDK_DEFAULT_ACCOUNT"],
             region=os.environ["CDK_DEFAULT_REGION"],

modules/eks/ray-orchestrator/README.md

@@ -24,6 +24,7 @@ This module orchestrates submission of a Ray training job to the Ray Cluster and
 - `data_bucket_name` - Name of the bucket to grant service account permissions to
 - `pvc_name` - Persistent volume claim name. Empty by defeault. If no PVC is provided, the volume will not be mounted.
 - `dra_export_path` - Persistent volume mount path. Defaults to `/ray/export/`. Must start with a `/`.
+- `permissions_boundary_name` - IAM Policy Name to attach to all roles as permissions boundary. Empty by default.
 - `tags` - A dictionary of additional tags to apply to all resources. Defaults to None
 
 ## User Guide

modules/eks/ray-orchestrator/app.py

@@ -48,6 +48,7 @@
     service_account_role_arn=rbac_stack.service_account.role.role_arn,
     pvc_name=app_settings.parameters.pvc_name,
     dra_export_path=app_settings.parameters.dra_export_path,
+    permissions_boundary_name=app_settings.parameters.permissions_boundary_name,
     env=env,
 )
 

modules/eks/ray-orchestrator/ray_orchestrator_stack.py

@@ -39,6 +39,7 @@ def __init__(
         service_account_role_arn: str,
         pvc_name: Optional[str],
         dra_export_path: str,
+        permissions_boundary_name: Optional[str] = None,
         **kwargs: Any,
     ) -> None:
         self.project_name = project_name
@@ -51,6 +52,13 @@ def __init__(
             **kwargs,
         )
 
+        # Apply permissions boundary to all roles in this stack if provided
+        if permissions_boundary_name:
+            permissions_boundary_policy = iam.ManagedPolicy.from_managed_policy_name(
+                self, "PermBoundary", permissions_boundary_name
+            )
+            iam.PermissionsBoundary.of(self).apply(permissions_boundary_policy)
+
         dep_mod = f"{project_name}-{deployment_name}-{module_name}"
         # used to tag AWS resources. Tag Value length can't exceed 256 characters
         full_dep_mod = dep_mod[:256] if len(dep_mod) > 256 else dep_mod

modules/eks/ray-orchestrator/rbac_stack.py

@@ -28,6 +28,7 @@ def __init__(
         eks_handler_role_arn: str,
         namespace_name: str,
         data_bucket_name: Optional[str],
+        permissions_boundary_name: Optional[str] = None,
         **kwargs: Any,
     ) -> None:
         self.project_name = project_name
@@ -42,6 +43,13 @@ def __init__(
             **kwargs,
         )
 
+        # Apply permissions boundary to all roles in this stack if provided
+        if permissions_boundary_name:
+            permissions_boundary_policy = iam.ManagedPolicy.from_managed_policy_name(
+                self, "PermBoundary", permissions_boundary_name
+            )
+            iam.PermissionsBoundary.of(self).apply(permissions_boundary_policy)
+
         dep_mod = f"{project_name}-{deployment_name}-{module_name}"
         # used to tag AWS resources. Tag Value length can't exceed 256 characters
         full_dep_mod = dep_mod[:256] if len(dep_mod) > 256 else dep_mod

modules/eks/ray-orchestrator/settings.py

@@ -38,6 +38,7 @@ class SeedFarmerParameters(CdkBaseSettings):
     data_bucket_name: Optional[str] = Field(default=None)
     pvc_name: Optional[str] = Field(default=None)
     dra_export_path: str = Field(default="/ray/export/")
+    permissions_boundary_name: Optional[str] = Field(default=None)
     tags: Optional[Dict[str, str]] = Field(default=None)
 
 

modules/eks/ray-orchestrator/tests/test_stack.py

@@ -37,6 +37,7 @@ def rbac_stack(stack_defaults) -> cdk.Stack:
     eks_handler_role_arn = "arn:aws:iam::123456789012:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/YYYYYYYY"
     namespace = "namespace"
     data_bucket_name = "bucket"
+    permissions_boundary_name = None
 
     return rbac_stack.RbacStack(
         scope=app,
@@ -50,6 +51,7 @@ def rbac_stack(stack_defaults) -> cdk.Stack:
         eks_oidc_arn=eks_oidc_arn,
         namespace_name=namespace,
         data_bucket_name=data_bucket_name,
+        permissions_boundary_name=permissions_boundary_name,
         env=cdk.Environment(
             account=os.environ["CDK_DEFAULT_ACCOUNT"],
             region=os.environ["CDK_DEFAULT_REGION"],
@@ -80,6 +82,7 @@ def ray_orchestrator_stack(rbac_stack, stack_defaults) -> cdk.Stack:
     service_account_role_arn = "arn:aws:iam::123456789012:role/XXXXXXXX"
     pvc_name = "pvc"
     dra_export_path = "/ray/export"
+    permissions_boundary_name = None
 
     return ray_orchestrator_stack.RayOrchestrator(
         scope=app,
@@ -99,6 +102,7 @@ def ray_orchestrator_stack(rbac_stack, stack_defaults) -> cdk.Stack:
         service_account_role_arn=service_account_role_arn,
         pvc_name=pvc_name,
         dra_export_path=dra_export_path,
+        permissions_boundary_name=permissions_boundary_name,
         env=cdk.Environment(
             account=os.environ["CDK_DEFAULT_ACCOUNT"],
             region=os.environ["CDK_DEFAULT_REGION"],

modules/fmops/bedrock-finetuning/README.md

@@ -24,6 +24,7 @@ The module creates a finetuning job for Amazon Bedrock model of choice (you prov
 - `removal-policy`: the retention policy for the S3 bucket (if one is created)
   - defaults to `RETAIN`
   - supports `DESTROY` and `RETAIN` only
+- `permissions-boundary-name`: IAM Policy Name to attach to all roles as permissions boundary. Empty by default.
 
 #### Input Example
 
@@ -50,4 +51,6 @@ parameters:
         group: networking
         name: networking
         key: PrivateSubnetIds
+  - name: permissions-boundary-name
+    value: my-permissions-boundary
 ```

modules/fmops/bedrock-finetuning/bin/bedrock-finetuning.ts

@@ -27,6 +27,9 @@ if (removalPolicy != "RETAIN" && removalPolicy != "DESTROY") {
   throw new Error("Invalid removal policy for resources");
 }
 
+const permissionsBoundaryName: string | undefined =
+  process.env.SEEDFARMER_PARAMETER_PERMISSIONS_BOUNDARY_NAME;
+
 const app = new cdk.App();
 const stack = new AmazonBedrockFinetuningStack(
   app,
@@ -40,6 +43,7 @@ const stack = new AmazonBedrockFinetuningStack(
     moduleName,
     bucketName,
     removalPolicy,
+    permissionsBoundaryName,
     env: { account, region },
   },
 );

modules/fmops/bedrock-finetuning/lib/bedrock-finetuning-stack.ts

@@ -21,6 +21,7 @@ interface AmazonBedrockFinetuningStackProps extends cdk.StackProps {
   bedrockBaseModelID: string;
   vpcId?: string;
   subnetIds: string[];
+  permissionsBoundaryName?: string;
 }
 
 export class AmazonBedrockFinetuningStack extends cdk.Stack {
@@ -33,6 +34,16 @@ export class AmazonBedrockFinetuningStack extends cdk.Stack {
   ) {
     super(scope, id, props);
 
+    // Apply permissions boundary to all roles in this stack if provided
+    if (props.permissionsBoundaryName) {
+      const permissionsBoundaryPolicy = iam.ManagedPolicy.fromManagedPolicyName(
+        this,
+        "PermBoundary",
+        props.permissionsBoundaryName,
+      );
+      iam.PermissionsBoundary.of(this).apply(permissionsBoundaryPolicy);
+    }
+
     // create S3 bucket
     const inputBucket = this.getBucket(props);
     this.bucketName = inputBucket.bucketName;

modules/fmops/bedrock-finetuning/test/bedrock-finetuning.test.ts

@@ -14,6 +14,7 @@ describe("Bedrock Finetuning Stack", () => {
   const subnetIds = ["sub1", "sub2"];
   const account = "123456789";
   const region = "us-east-1";
+  const permissionsBoundaryName = undefined;
 
   const stack = new AmazonBedrockFinetuningStack(
     app,
@@ -26,6 +27,7 @@ describe("Bedrock Finetuning Stack", () => {
       deploymentName,
       moduleName,
       removalPolicy,
+      permissionsBoundaryName,
       env: { account, region },
     },
   );

modules/fmops/qna-rag/README.md

@@ -27,6 +27,7 @@ Question and Answering using RAG Architecture
 #### Optional
 
 - `input-asset-bucket` - Input asset bucket that is used to store input documents
+- `permissions-boundary-name`: IAM Policy Name to attach to all roles as permissions boundary. Empty by default.
 
 ### Module Metadata Outputs
 

modules/fmops/qna-rag/app.py

@@ -27,6 +27,7 @@
     os_security_group_id=app_settings.module_settings.os_security_group_id,
     os_index_name="rag-index",
     input_asset_bucket_name=app_settings.module_settings.input_asset_bucket_name,
+    permissions_boundary_name=app_settings.module_settings.permissions_boundary_name,
     env=aws_cdk.Environment(
         account=app_settings.cdk_settings.account,
         region=app_settings.cdk_settings.region,

modules/fmops/qna-rag/settings.py

@@ -35,6 +35,7 @@ class ModuleSettings(CdkBaseSettings):
     os_security_group_id: str
 
     input_asset_bucket_name: Optional[str] = Field(default=None)
+    permissions_boundary_name: Optional[str] = Field(default=None)
 
     tags: Optional[Dict[str, str]] = Field(default=None)