feat: add permission boundary as optional input to all modules (#415)

Author: xuezhma

CHANGELOG.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### **Added**
 
+- added permission boundary as optional input to all modules 
+
 ### **Changed**
 
 ## v3.2.2

modules/eks/ray-cluster/README.md

@@ -68,6 +68,7 @@ This module creates a Ray cluster in AWS EKS Kubernetes cluster. It deploys a Ra
 ```
 - `pvc_name` - Persistent volume claim name. Empty by defeault. If no PVC is provided, the volume will not be mounted.
 - `dra_export_path` - Persistent volume mount path. Defaults to `/ray/export/`. Must start with a `/`.
+- `permissions_boundary_name` - IAM Policy Name to attach to all roles as permissions boundary. Empty by default.
 - `tags` - List of additional tags to apply to all resources
 
 ## User Guide

modules/eks/ray-cluster/app.py

@@ -42,6 +42,7 @@
     worker_labels=app_settings.parameters.worker_labels,
     pvc_name=app_settings.parameters.pvc_name,
     dra_export_path=app_settings.parameters.dra_export_path,
+    permissions_boundary_name=app_settings.parameters.permissions_boundary_name,
     env=env,
 )
 

modules/eks/ray-cluster/ray_cluster_stack.py

@@ -44,6 +44,7 @@ def __init__(
         worker_labels: Dict[str, str],
         pvc_name: Optional[str],
         dra_export_path: str,
+        permissions_boundary_name: Optional[str] = None,
         **kwargs: Any,
     ) -> None:
         self.project_name = project_name
@@ -56,6 +57,13 @@ def __init__(
             **kwargs,
         )
 
+        # Apply permissions boundary to all roles in this stack if provided
+        if permissions_boundary_name:
+            permissions_boundary_policy = iam.ManagedPolicy.from_managed_policy_name(
+                self, "PermBoundary", permissions_boundary_name
+            )
+            iam.PermissionsBoundary.of(self).apply(permissions_boundary_policy)
+
         dep_mod = f"{project_name}-{deployment_name}-{module_name}"
         # used to tag AWS resources. Tag Value length can't exceed 256 characters
         full_dep_mod = dep_mod[:256] if len(dep_mod) > 256 else dep_mod

modules/eks/ray-cluster/settings.py

@@ -60,6 +60,7 @@ class SeedFarmerParameters(CdkBaseSettings):
     worker_resources: Dict[str, Dict[str, str]] = Field(default=DEFAULT_POD_RESOURCES)
     worker_tolerations: List[Dict[str, str]] = Field(default=[])
     worker_labels: Dict[str, str] = Field(default={})
+    permissions_boundary_name: Optional[str] = Field(default=None)
     tags: Optional[Dict[str, str]] = Field(default=None)
 
 

modules/eks/ray-cluster/tests/test_stack.py

@@ -53,6 +53,7 @@ def ray_cluster_stack(stack_defaults) -> cdk.Stack:
     worker_labels = {}
     pvc_name = "pvc"
     dra_export_path = "/ray/export"
+    permissions_boundary_name = None
 
     return ray_cluster_stack.RayCluster(
         scope=app,
@@ -82,6 +83,7 @@ def ray_cluster_stack(stack_defaults) -> cdk.Stack:
         worker_labels=worker_labels,
         pvc_name=pvc_name,
         dra_export_path=dra_export_path,
+        permissions_boundary_name=permissions_boundary_name,
         env=cdk.Environment(
             account=os.environ["CDK_DEFAULT_ACCOUNT"],
             region=os.environ["CDK_DEFAULT_REGION"],

modules/eks/ray-operator/README.md

@@ -25,6 +25,7 @@ This module runs Ray Operator in AWS EKS Kubernetes cluster. It deploys a KubeRa
 #### Optional
 
 - `data_bucket_name` - Name of the bucket to grant service account permissions to
+- `permissions_boundary_name` - IAM Policy Name to attach to all roles as permissions boundary. Empty by default.
 - `tags` - List of additional tags to apply to all resources
 
 ### Sample manifest declaration
@@ -78,6 +79,8 @@ parameters:
   - name: Namespace
     valueFrom:
       parameterValue: rayNamespaceName
+  - name: permissions-boundary-name
+    value: my-permissions-boundary
 ```
 
 ### Module Metadata Outputs

modules/eks/ray-operator/app.py

@@ -28,6 +28,7 @@
     eks_openid_issuer=app_settings.parameters.eks_openid_issuer,
     namespace_name=app_settings.parameters.namespace,
     data_bucket_name=app_settings.parameters.data_bucket_name,
+    permissions_boundary_name=app_settings.parameters.permissions_boundary_name,
     env=env,
 )
 
@@ -46,6 +47,7 @@
     namespace_name=app_settings.parameters.namespace,
     service_account_name=rbac_stack.service_account.service_account_name,
     service_account_role=rbac_stack.service_account.role,
+    permissions_boundary_name=app_settings.parameters.permissions_boundary_name,
     env=env,
 )
 

modules/eks/ray-operator/ray_stack.py

@@ -31,6 +31,7 @@ def __init__(
         namespace_name: str,
         service_account_name: str,
         service_account_role: iam.IRole,
+        permissions_boundary_name: str | None = None,
         **kwargs: Any,
     ) -> None:
         self.project_name = project_name
@@ -43,6 +44,13 @@ def __init__(
             **kwargs,
         )
 
+        # Apply permissions boundary to all roles in this stack if provided
+        if permissions_boundary_name:
+            permissions_boundary_policy = iam.ManagedPolicy.from_managed_policy_name(
+                self, "PermBoundary", permissions_boundary_name
+            )
+            iam.PermissionsBoundary.of(self).apply(permissions_boundary_policy)
+
         dep_mod = f"{project_name}-{deployment_name}-{module_name}"
         # used to tag AWS resources. Tag Value length can't exceed 256 characters
         full_dep_mod = dep_mod[:256] if len(dep_mod) > 256 else dep_mod

modules/eks/ray-operator/rbac_stack.py

@@ -29,6 +29,7 @@ def __init__(
         eks_handler_role_arn: str,
         namespace_name: str,
         data_bucket_name: Optional[str],
+        permissions_boundary_name: str | None = None,
         **kwargs: Any,
     ) -> None:
         self.project_name = project_name
@@ -43,6 +44,13 @@ def __init__(
             **kwargs,
         )
 
+        # Apply permissions boundary to all roles in this stack if provided
+        if permissions_boundary_name:
+            permissions_boundary_policy = iam.ManagedPolicy.from_managed_policy_name(
+                self, "PermBoundary", permissions_boundary_name
+            )
+            iam.PermissionsBoundary.of(self).apply(permissions_boundary_policy)
+
         dep_mod = f"{project_name}-{deployment_name}-{module_name}"
         # used to tag AWS resources. Tag Value length can't exceed 256 characters
         full_dep_mod = dep_mod[:256] if len(dep_mod) > 256 else dep_mod