source/1-SDLC-organization/lib/cdk-bootstrap-template.yml [634:672]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          - Effect: Deny
            Action:
              - s3:PutAccountPublicAccessBlock
            Resource: "*"

            # DenyBoundaryPolicyEdit
          - Effect: Deny
            Action:
              - iam:CreatePolicyVersion
              - iam:DeletePolicy
              - iam:DeletePolicyVersion
              - iam:SetDefaultPolicyVersion
            Resource:
              - !Sub "arn:aws:iam::${AWS::AccountId}:policy/cdk-${Qualifier}-cfn-exec-permissions-boundary-policy-${AWS::AccountId}-${AWS::Region}"
              - !Sub "arn:aws:iam::${AWS::AccountId}:policy/cdk-${Qualifier}-cicd-pipeline-permissions-boundary-policy-${AWS::AccountId}-${AWS::Region}"

            # DenyBoundaryDelete
          - Effect: Deny
            Action:
              - iam:DeleteUserPermissionsBoundary
              - iam:DeleteRolePermissionsBoundary
            Resource:
              - !Sub "arn:aws:iam::${AWS::AccountId}:user/*"
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/*"
            Condition:
              "ForAnyValue:StringEquals":
                "iam:PermissionsBoundary":
                  - !Sub "arn:aws:iam::${AWS::AccountId}:policy/cdk-${Qualifier}-cfn-exec-permissions-boundary-policy-${AWS::AccountId}-${AWS::Region}"
                  - !Sub "arn:aws:iam::${AWS::AccountId}:policy/cdk-${Qualifier}-cicd-pipeline-permissions-boundary-policy-${AWS::AccountId}-${AWS::Region}"

            # DenyBoundaryUpdateIfNotAddingBoundary
          - Effect: Deny
            Action:
              - iam:PutUserPermissionsBoundary
              - iam:PutRolePermissionsBoundary
            Resource:
              - !Sub "arn:aws:iam::${AWS::AccountId}:user/*"
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/*"
            Condition:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



source/1-SDLC-organization/lib/cdk-bootstrap-template.yml [753:791]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          - Effect: Deny
            Action:
              - s3:PutAccountPublicAccessBlock
            Resource: "*"

            # DenyBoundaryPolicyEdit
          - Effect: Deny
            Action:
              - iam:CreatePolicyVersion
              - iam:DeletePolicy
              - iam:DeletePolicyVersion
              - iam:SetDefaultPolicyVersion
            Resource:
              - !Sub "arn:aws:iam::${AWS::AccountId}:policy/cdk-${Qualifier}-cfn-exec-permissions-boundary-policy-${AWS::AccountId}-${AWS::Region}"
              - !Sub "arn:aws:iam::${AWS::AccountId}:policy/cdk-${Qualifier}-cicd-pipeline-permissions-boundary-policy-${AWS::AccountId}-${AWS::Region}"

            # DenyBoundaryDelete
          - Effect: Deny
            Action:
              - iam:DeleteUserPermissionsBoundary
              - iam:DeleteRolePermissionsBoundary
            Resource:
              - !Sub "arn:aws:iam::${AWS::AccountId}:user/*"
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/*"
            Condition:
              "ForAnyValue:StringEquals":
                "iam:PermissionsBoundary":
                  - !Sub "arn:aws:iam::${AWS::AccountId}:policy/cdk-${Qualifier}-cfn-exec-permissions-boundary-policy-${AWS::AccountId}-${AWS::Region}"
                  - !Sub "arn:aws:iam::${AWS::AccountId}:policy/cdk-${Qualifier}-cicd-pipeline-permissions-boundary-policy-${AWS::AccountId}-${AWS::Region}"

            # DenyBoundaryUpdateIfNotAddingBoundary
          - Effect: Deny
            Action:
              - iam:PutUserPermissionsBoundary
              - iam:PutRolePermissionsBoundary
            Resource:
              - !Sub "arn:aws:iam::${AWS::AccountId}:user/*"
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/*"
            Condition:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



