{"id":17921533,"url":"https://github.com/theopolis/cfn-test-conditions","last_synced_at":"2025-07-22T11:34:10.357Z","repository":{"id":199167928,"uuid":"702273765","full_name":"theopolis/cfn-test-conditions","owner":"theopolis","description":"Tools to test what IAM conditions can be used with CFN StackSet Stacks","archived":false,"fork":false,"pushed_at":"2023-10-09T01:45:32.000Z","size":5,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-03T11:14:20.692Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/theopolis.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-10-09T01:40:24.000Z","updated_at":"2023-10-09T01:40:50.000Z","dependencies_parsed_at":null,"dependency_job_id":"3bce4971-eb82-4c2b-814b-7b9141426cb8","html_url":"https://github.com/theopolis/cfn-test-conditions","commit_stats":null,"previous_names":["theopolis/cfn-test-conditions"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/theopolis/cfn-test-conditions","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fcfn-test-conditions","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fcfn-test-conditions/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fcfn-test-conditions/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fcfn-test-conditions/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/theopolis","download_url":"https://codeload.github.com/theopolis/cfn-test-conditions/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fcfn-test-conditions/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266484133,"owners_count":23936495,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-22T02:00:09.085Z","response_time":66,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-28T20:34:36.995Z","updated_at":"2025-07-22T11:34:10.322Z","avatar_url":"https://github.com/theopolis.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"## cfn-test-conditions\n\nThis example code is used to determine what AWS IAM condition keys can be used with `cloudformation:CreateStack`.\n\nA condition on `CreateStack` when used by a StackSet is important because the executor role may be used as a \"confused deputy\" if it can also be used to create Stacks outside of the intended StackSet.\n\nThe problem is that \"sub stacks\", or Stacks that run as a result of a StackSet resource, have limited conditions.\nOne of the most important condition keys `cloudformation:TemplateURL` is unusable because CloudFormation uses an internal copy of the template in an internal S3 bucket.\n\nAll other keys are also either non-set so they cannot be used.\n\nKeys:\n- `cloudformation:TemplateUrl`: This is re-written to an internal CloudFormation S3 bucket ([see below](https://github.com/theopolis/cfn-test-conditions#guessing-the-internal-bucket-for-templateurl)).\n- `aws:SourceArn`: Not set by CloudFormation.\n- `aws:SourceIdentity`: Not set by CloudFormation.\n- `aws:PrincipalArn`: Set to the executor role, which is not helpful when trying to mitigate a confused deputy situation.\n- `aws:PrincipalIsAWSService`: Set to false.\n- `cloudformation:ResourceTypes`: Not set by CloudFormation.\n- `cloudformation:RoleARN`: Set to null.\n- `aws:ViaAWSService`: Set to false.\n- `aws:CalledViaFirst`: Set to null.\n\nAnd `aws:SourceIp` cannot be used because with StackSets the IP is an AWS internal IP, which is rewritten to `cloudformation.amazonaws.com`.\n\n## Using this tool\n\nThis documentation is for reproducing the conditions tests.\n\n### How this works\n\nThis repo contains a script `./test.sh` that will enumerate condition statements within `./conditions.json`.\n\nFor each of these conditions, the script will replace the StackSet's execution role IAM policy condition for `cloudformation:CreateStack`.\n\nThe script will then upload the TemplateURL to an S3 bucket, execute the stack, and check the result.\n\nIf the stack succeeds then the condition passed.\n\n### How to use\n\nSet your profile.\n\n```sh\n$ export AWS_PROFILE=your-profile\n```\n\nUpdate the code to replace `cfn-test-conditions` with a name of your choice.\nThis name should have an associated S3 bucket in the account you will use.\nThis bucket's objects should be publically accessible so that CloudFormation can read objects.\n\n```sh\n./test.sh\n```\n\n### Guessing the internal bucket for TemplateURL\n\nThe most frustrating thing about CloudFormation StackSet stack templates is that CloudFormation does not use the origin TemplateURL. This means the `cloudformation:TemplateURL` condition is unusable.\n\nCloudFormation seems to use a URL like:\n\n```\nhttps://executor-templates-${AWS_INTERNAL_ACCOUNT_ID}-${AWS_REGION}.s3.${AWS_REGION}.amazonaws.com/${UUID}.${AWS_ACCOUNT_ID}.template\n```\n\nIt will take hours to guess the URL, but you can use:\n\n```sh\n./guess.sh\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheopolis%2Fcfn-test-conditions","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftheopolis%2Fcfn-test-conditions","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheopolis%2Fcfn-test-conditions/lists"}