LOWIAMSecurity

IAM Permission Boundary Missing

iam-permission-boundary-missing

What this rule checks

Detects IAM roles without permission boundaries.

How to fix it

1Create a permission boundary policy
2Attach the permission boundary to IAM roles

FlaggedThis role has no permissions boundary. Without one, nothing caps the maximum permissions the role (or anything it creates) can be granted, leaving room for privilege escalation.

import * as iam from 'aws-cdk-lib/aws-iam';

// A role assumable by people (account principal) with no permission
// boundary — nothing caps what delegated access can escalate to.
new iam.CfnRole(this, 'DeveloperRole', {
  assumeRolePolicyDocument: {
    Version: '2012-10-17',
    Statement: [
      {
        Effect: 'Allow',
        Principal: { AWS: 'arn:aws:iam::111122223333:root' },
        Action: 'sts:AssumeRole',
      },
    ],
  },
});

FixedA permissions boundary is attached, so the role's effective permissions can never exceed the intersection of its policies and the boundary. Use a boundary tailored to your organisation rather than PowerUserAccess in production.

import * as iam from 'aws-cdk-lib/aws-iam';

new iam.CfnRole(this, 'DeveloperRole', {
  assumeRolePolicyDocument: {
    Version: '2012-10-17',
    Statement: [
      {
        Effect: 'Allow',
        Principal: { AWS: 'arn:aws:iam::111122223333:root' },
        Action: 'sts:AssumeRole',
      },
    ],
  },
  permissionsBoundary:
    'arn:aws:iam::111122223333:policy/developer-boundary',
});

CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.

Affected resource types

AWS::IAM::Role

Compliance frameworks

SOC2CISNIST

AWS documentation

Read the AWS guidance

Intentional? Suppress this finding

Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss iam-permission-boundary-missing and the reason is kept in the report, not silently hidden.

In .cdk-insights.json:

{
  "ignoreRules": [
    { "id": "iam-permission-boundary-missing", "reason": "Why this is intentional" }
  ]
}

Or inline in your CDK code:

Validations.of(scope).acknowledge({
  id: 'cdk-insights::iam-permission-boundary-missing',
  reason: 'Why this is intentional',
});

Use the rule ID iam-permission-boundary-missing shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →

Catch this in your stack

$ npx cdk-insights scan

CDK Insights runs this and 136+ other rules locally against your synthesised CDK app — free, no account, your code never leaves your machine.

More IAM rules

CRITICALIAM Role Assumable By Any AWS Account HIGHECS Container Secrets Without Execution Role Access HIGHEvent Source Mapping Missing Required IAM Permissions HIGHIAM Overly Permissive Policies HIGHLambda Trigger Missing Resource-Based Permission HIGHStep Functions Integration Without Role Permissions

All rules How static analysis works