fix(iam): add validation for OrganizationPrincipal IDs#33968
fix(iam): add validation for OrganizationPrincipal IDs#33968mergify[bot] merged 3 commits intoaws:mainfrom
Conversation
The OrganizationPrincipal class now validates that organization IDs match the required pattern (^o-[a-z0-9]{10,32}$) when they are literal strings. This prevents security risks that could occur when using empty or invalid organization IDs, which would grant permissions to any AWS principal without properly applying the organization condition.
Key changes:
- Added token-aware validation in OrganizationPrincipal constructor
- Only validates literal strings, not tokens (using Token.isUnresolved)
- Added comprehensive unit tests for validation logic
- Updated existing tests to use valid organization IDs
Fixes: aws#32756
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #33968 +/- ##
=======================================
Coverage 83.98% 83.98%
=======================================
Files 120 120
Lines 6976 6976
Branches 1178 1178
=======================================
Hits 5859 5859
Misses 1005 1005
Partials 112 112
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
QuantumNeuralCoder
left a comment
There was a problem hiding this comment.
Reviewed as previously. Additional check for cdk token prevents the regression issue. Ship ITTT
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
Comments on closed issues and PRs are hard for our team to see. |
Issue # (if applicable)
Closes #32756.
Reason for this change
There's a security issue with the
OrganizationPrincipalclass in AWS CDK. When usingiam.OrganizationPrincipalwith an empty or invalid organization ID, it still grants access to AWS resources but without properly applying the organization condition. This creates a security risk because:A previous fix (PR #33555) was implemented but later reverted (PR #33773) because it broke compatibility with code using tokens for organization IDs.
Description of changes
This PR adds token-aware validation to the
OrganizationPrincipalconstructor to ensure organization IDs match the required pattern (^o-[a-z0-9]{10,32}$) when they are literal strings, while maintaining compatibility with tokens.Pattern defined here: https://docs.aws.amazon.com/organizations/latest/APIReference/API_Organization.html#API_Organization_Contents
Key changes:
The implementation uses
Token.isUnresolved()to check if the organization ID is a token before applying validation, which addresses the regression that caused the previous fix to be reverted.Describe any new or updated permissions being added
No new IAM permissions are being added. This change only affects validation of organization IDs used in IAM policies.
Description of how you validated changes
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license