Apply a permissions boundary through the CDK bootstrap default so both deployment and Lambda roles are capped

Why the Answer Is Correct

Two separate roles are over-permissioned: the role developers assume to deploy the AWS CDK application, and the roles the CDK application creates and attaches to its Lambda functions. An IAM permissions boundary is the right control because it defines the maximum permissions a principal can hold, and because an explicit deny anywhere in the evaluation wins, a principal can never exceed its boundary no matter what identity-based policies allow; that is what satisfies both the excess-permission problem and the requirement that developers must not be able to grant additional permissions. Option B applies the boundary in the two places that matter and is the least operational overhead because it changes configuration rather than adding a separate enforcement system. Updating the account's AWS CDK bootstrapping to use the permissions boundary means the deployment roles the CDK tooling assumes are bounded as soon as bootstrapping runs. Updating the CDK application configuration to use the same policy as the default permissions boundary means every role the application generates for its Lambda functions is bounded automatically, with no per-role editing. Srikantha summarized this as enforcing least privilege at the CDK bootstrap level so that both the developer permissions and the Lambda function roles are restricted, and phu0298 highlighted that placing the boundary directly in the CDK workflow makes the created roles inherently compliant rather than relying on a later validation pass. B is the correct answer.

Why the Other Options Are Wrong

A creates an SCP that denies iam:CreateRole and iam:UpdateRole for the developer role and the CDK application deployment role, and centrally creates new IAM roles for the developers to attach to the Lambda functions. An SCP can only subtract permissions, so denying role creation prevents the CDK application from creating any roles for its Lambda functions at all, rather than constraining what those roles may do once created. That breaks the deployment rather than securing it, and centralizing role creation for the developers adds a process they must go through. phu0298's objection to the competing options noted that the boundary approach removes the need for a separate IAM Access Analyzer validation step because the roles are compliant by construction, which this option lacks. C creates a permissions boundary policy and instructs developers to use the boundary policy name when they create a role in the CDK application code. As teo2157 pointed out, this restricts nothing automatically, because it depends on developers supplying the boundary name and a developer can simply omit it; it also does nothing to bound the deployment role itself, so developers could still exceed the intended permissions. D creates an SCP denying iam:CreateRole and iam:UpdateRole for the developer role, gives the CDK deployment role permission to create the Lambda function roles, and runs IAM Access Analyzer to verify the Lambda function role. Access Analyzer is a validation and reporting capability: it can tell the team that a role is over-permissive, but it does not cap the role or prevent anyone from attaching broader permissions later, so it detects the problem without solving it. B is correct.

Community Comment Notes

Community was split, B (63) against A (38). Srikantha supported B, describing it as using a permission boundary at the AWS CDK bootstrap level to restrict both developer permissions and Lambda function roles, enforcing least privilege with no manual IAM role management. phu0298 supported B on the grounds that placing the permission boundary directly in the CDK workflow makes the created roles inherently compliant, removing the need for a reactive IAM Access Analyzer validation step, which is precisely what option D relies on. teo2157 preferred A on the reasoning that B does not restrict the developer's permissions and only constrains the CDK role; this is a fair reading of the narrow mechanism, but the boundary in B is what caps both the deployment role and the generated roles without denying the actions the application needs. The community did not reach a clear majority on which role is bounded more completely.