Merge pull request from GHSA-q4pp-j36h-3gqg

fix: improve default basti connect iam policy

Author: BohdanPetryshyn

README.md

@@ -307,7 +307,12 @@ Minimal policy:
       "Resource": [
         "arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost",
         "arn:aws:ec2:<your-region>:<your-account-id>:instance/<your-basti-instance-id>"
-      ]
+      ],
+      "Condition": {
+          "BoolIfExists": {
+              "ssm:SessionDocumentAccessCheck": "true"
+          }
+      }
     }
   ]
 }

packages/basti-cdk/src/__test__/basti-instance.test.ts

@@ -282,6 +282,11 @@ describe('BastiInstanceTest', () => {
                 ],
               },
             ],
+            Condition: {
+              BoolIfExists: {
+                'ssm:SessionDocumentAccessCheck': 'true',
+              },
+            },
           },
         ],
       },

packages/basti-cdk/src/basti-instance.ts

@@ -225,6 +225,11 @@ export class BastiInstance extends Construct implements IBastiInstance {
       new aws_iam.PolicyStatement({
         actions: ['ssm:StartSession'],
         resources: [instanceArn, documentArn],
+        conditions: {
+          BoolIfExists: {
+            'ssm:SessionDocumentAccessCheck': 'true',
+          },
+        },
       })
     );
   }

packages/basti/README.md

@@ -313,7 +313,12 @@ Minimal policy:
       "Resource": [
         "arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost",
         "arn:aws:ec2:<your-region>:<your-account-id>:instance/<your-basti-instance-id>"
-      ]
+      ],
+      "Condition": {
+          "BoolIfExists": {
+              "ssm:SessionDocumentAccessCheck": "true"
+          }
+      }
     }
   ]
 }