# IAM permissions boundary support

**URL:** <https://forum.serverless.com/t/iam-permissions-boundary-support/6835>\
**Category:** Serverless Framework\
**Tags:** aws, security, cloudformation, iam\
**Created:** [December 27, 2018, 9:14pm UTC](https://forum.serverless.com/t/iam-permissions-boundary-support/6835 "2018-12-27T21:14:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![doanian](https://avatars.discourse-cdn.com/v4/letter/d/c68b51/32.png) [@doanian](https://forum.serverless.com/u/doanian)\
**Post date:** [December 27, 2018, 9:14pm UTC](https://forum.serverless.com/t/iam-permissions-boundary-support/6835/1 "2018-12-27T21:14:33Z")

</div>

Does Serverless support an easy way to add an IAM permission boundary to the lambda execution roles? I’d love to be able to specify it in the provider similar to `iamRoleStatements` or on a per function level. Currently I’m having to create my execution role manually in the Resources and link it to each function do to the fact that I’m required to provide a permission boundary on my roles.

---

<div class="post-metadata">

**Author:** ![cedric.menec](https://avatars.discourse-cdn.com/v4/letter/c/aca169/32.png) [@cedric.menec](https://forum.serverless.com/u/cedric.menec)\
**Post date:** [January 25, 2019, 2:06pm UTC](https://forum.serverless.com/t/iam-permissions-boundary-support/6835/2 "2019-01-25T14:06:11Z")

</div>

Like you, I would like to be able to add my `PermissionBoundary` property directly in my `iamRoleStatements` but, as a temporary workaround, I have simply **extended** my IAM Role in the Resources section.

```
resources:
  Resources:
    MyFunctionIamRoleLambdaExecution:
        Properties:
            PermissionsBoundary: !Sub "arn:aws:iam::#{AWS::AccountId}:policy/my_policy_name"

```

`MyFunctionIamRoleLambdaExecution` is automatically created by Serverless Framework for my function `MyFunction`.

---

<div class="post-metadata">

**Author:** ![pda](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@pda](https://forum.serverless.com/u/pda)\
**Post date:** [May 29, 2019, 1:44pm UTC](https://forum.serverless.com/t/iam-permissions-boundary-support/6835/3 "2019-05-29T13:44:07Z")

</div>

I would also like this feature. I think adding another element to the iamRoleStatements would be easiest. Writing a plugin to do this is also possible rather than adding an extension for every function in the Resources section. Thanks for the example.

---

<div class="post-metadata">

**Author:** ![codycode](https://avatars.discourse-cdn.com/v4/letter/c/e36b37/32.png) [@codycode](https://forum.serverless.com/u/codycode)\
**Post date:** [August 30, 2020, 8:36pm UTC](https://forum.serverless.com/t/iam-permissions-boundary-support/6835/4 "2020-08-30T20:36:18Z")

</div>

The complete example would be this

```
service:
  name: one5
provider:
  name: aws
  runtime: python3.8
  region: us-west-2

functions:
  importFPGroupDataToGA3:
    handler: handler.hello1
    role:
      Fn::GetAtt:
        - myDefaultRole
        - Arn

resources:
  Resources:
    myDefaultRole:
      Type: 'AWS::IAM::Role'
      Properties:
        RoleName: myrole
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: 'sts:AssumeRole'
  extensions:
    myDefaultRole:
      Properties:
        PermissionsBoundary: 'arn:aws:iam::xxxxxxxxxxxx:policy/PermissionBoundary'
```