title: How to design SAM deployer policy? to enforce SAM generated AWS resources to be in PermissionBoundary
body: <p>we have <code>someAWSAccount</code> assuming <code>someaccountrole</code> with instance profile name <code>p</code> in AWS.</p>
  
  <p>Managed policy by name <code>some-permission-boundary</code> is created in this account(<code>someAWSAccount</code>). Purpose of creating this boundary policy in this account is mentioned below.</p>
  
  <hr>
  
  <p>Requirement is, </p>
  
  <pre><code>Resources:
    HelloWorldFunction:
      Type: AWS::Serverless::Function 
      Properties:
        CodeUri: hello-world/
        Handler: app.LambdaHandler
        Runtime: nodejs8.10
        Events:
          MySQSEvent:
            Type: SQS
            Properties:
              Queue: !GetAtt SomeQueue.Arn
              BatchSize: 10
        PermissionsBoundary: "arn:aws:iam::${AWS::AccountId}:policy/some-permission-boundary"
  
    SomeQueue:
      Type: AWS::SQS::Queue
  </code></pre>
  
  <hr>
  
  <p>to <strong>enforce some rules</strong> to AWS resources generated from above SAM template, by <strong>enforcing SAM template to have</strong> <code>PermissionsBoundary: "arn:aws:iam::${AWS::AccountId}:policy/some-permission-boundary"</code> as part of <code>Properties</code> list, </p>
  
  <p>so that any AWS resource type( like Lambda, SQS, roles, policies etc...) that are created amidst</p>
  
  <p><code>sam deploy --template-file above-SAM-template --stack-name somestack --profile p</code> </p>
  
  <p>should be in compliance with rules mentioned in <code>arn:aws:iam::${AWS::AccountId}:policy/some-permission-boundary</code></p>
  
  <hr>
  
  <p>Developers write these SAM tempates and security team need to make sure that <code>sam deploy</code> does not work until this <code>PermissionsBoundary</code> property is part of the <code>Properties</code> list of SAM template.</p>
  
  <p>So, for this, we are thinking to design another managed policy in <code>someAWSAaccount</code> that make sure <code>sam deploy</code> fails if SAM template does not have this entry: <code>sam deploy --template-file above-SAM-template --profile p</code></p>
  
  <hr>
  
  <p>What should the deployer policy(managed policy) look like, to enforce this rule? Which <code>Principal</code> should get assigned with this deployer policy?</p>
  
  <p>or </p>
  
  <p>Do you suggest an alternate approach?</p>