From ee1f61de243835e05d7f56d465adc7c45f90e858 Mon Sep 17 00:00:00 2001 From: Darrell Pappa Date: Thu, 9 Jul 2026 15:11:42 -0400 Subject: [PATCH] feat(vendor-access): allow read-only CloudTrail in the permission boundary Add read-only CloudTrail actions to StreamNativeCloudPermissionBoundary so StreamNative's vendor-access roles (which already attach AWS-managed ReadOnlyAccess) can query CloudTrail management events: cloudtrail:LookupEvents, DescribeTrails, GetTrailStatus, GetEventSelectors, ListTrails Motivation: in a BYOC incident (all EKS nodes NotReady), the EKS cluster IAM role had AmazonEKSClusterPolicy / AmazonEKSVPCResourceController detached out-of-band. Attributing the change requires CloudTrail LookupEvents, which the boundary currently blocks (ReadOnlyAccess grants it on the role, but the boundary is the gate) -- so StreamNative cannot self-diagnose who/what detached a StreamNative-managed IAM policy. All added actions are read-only; no Start/Stop/Delete/Put trail mutations. SECURITY REVIEW REQUESTED: this widens StreamNative's standing access in every BYOC account that applies the new version. cloudtrail:LookupEvents is account-wide (Resource "*", not resource-scopable), so it grants read of the account's full management-event history. Please confirm this is acceptable before merge/release. Co-Authored-By: Claude Opus 4.8 (1M context) --- modules/aws/vendor-access/README.md | 1 + .../files/permission_boundary_iam_policy.json.tpl | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/modules/aws/vendor-access/README.md b/modules/aws/vendor-access/README.md index 1220a33..5d9cf4a 100644 --- a/modules/aws/vendor-access/README.md +++ b/modules/aws/vendor-access/README.md @@ -33,6 +33,7 @@ This module creates the following resources within your AWS account: - `role/StreamNativeCloudBootstrapRole` & `policy/StreamNativeCloudBootstrapPolicy`: These IAM resources are used for provisioning, deprovisioning, and regular or emergency maintenance. This role and policy have the following characteristics: - Have the ability to create, delete, manage, and read (within the limits of the permission boundary) EC2, EKS, IAM, DynamoDB, Route53, and KMS resources + - Have **read-only** access to CloudTrail management events (`cloudtrail:LookupEvents`, `DescribeTrails`, `GetTrailStatus`, `GetEventSelectors`, `ListTrails`) so StreamNative can diagnose out-of-band changes to StreamNative-managed IAM resources during incidents. These are read-only and cannot start, stop, delete, or modify trails. - Cannot create or modify IAM policies (but are allowed to work with IAM policies specified by this module) - Can only work with resources that have specific tags associated or certain expected patterns in the resource's friendly name. diff --git a/modules/aws/vendor-access/files/permission_boundary_iam_policy.json.tpl b/modules/aws/vendor-access/files/permission_boundary_iam_policy.json.tpl index 6214666..faac367 100644 --- a/modules/aws/vendor-access/files/permission_boundary_iam_policy.json.tpl +++ b/modules/aws/vendor-access/files/permission_boundary_iam_policy.json.tpl @@ -7,6 +7,11 @@ "Action": [ "acm:*", "autoscaling:*", + "cloudtrail:DescribeTrails", + "cloudtrail:GetEventSelectors", + "cloudtrail:GetTrailStatus", + "cloudtrail:ListTrails", + "cloudtrail:LookupEvents", "cloudwatch:*", "cognito-idp:*", "dynamodb:*",