Deploying AWS SAM function with least privileges

Question

For a SAM CI/CD credentials like https://github.com/TractorZoom/sam-cli-action how do I create/specify a key/secret with the least privileges? ie not my PowerUser account's AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY , but still enough to deploy and update the application?

When I do a sam deploy it says it's creating a IAM role, but on inspection it simply a arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole which only allows to write logs AFAICT.

So how does one create a "deployment role" with least privileges or is there something I am missing?

Answer 1

You could create an IAM role with least privileges policies, and allow for your user to assume the role, then injecting the temp credentials to your CI/CD file. More info here

Better yet, if you have an instance executing your pipeline, you could attach the IAM role to it. I use Gitlab runners and this is what I always go for. In this scenario, you can skip defining the credentials since the instance takes care of that.

Either case an IAM role is a pre-req, preferably an independent deployment.