AWS permissions boundary
On AWS, Alien's management access can no longer turn into admin access to the customer's account. Initial setup now creates a permissions boundary for each deployment, and every IAM role the management identity creates or changes must carry it.
The boundary caps those roles at non-IAM actions on the deployment's own resources, plus a few account-level actions the deployment needs. It denies sharing and public exposure: bucket policies and ACLs, snapshot and image sharing, resource shares, and resource policies on Lambda, SQS, SNS, and other services.
The management identity can't edit the boundary or remove it. Even a role it creates with an admin policy attached stays inside the boundary. To see the boundary your stack produces:
alien render --format cloudformation --stack .alien/build/aws/stack.json > template.yamlIt's the ManagementPermissionsBoundary resource.
- Every setup method: CloudFormation, Terraform, and the setup CLI all create it
- Existing deployments: keep working unchanged, and get the boundary when the customer's admin reruns initial setup