Hey all, my team is new to IaC in general and we were wondering how you deal with permissions in AWS. Do you all just have a single ‘god’ role for pulumi to deploy resources with or do you create stricter roles and assign them differently per CI pipeline (e.g. my pipeline that just deploys a Lambda function only has access to lambda)? The latter seems like it might be difficult to manage once you have quite a few projects all deploying to AWS with roles that are getting more permissive as projects grow.

This depends on your threat model and security requirements. The second approach is more secure, but as you already noted, maintaining is difficult. The first is far less secure, but if you carefully control access, log, and audit the use of that role, it can be okay. Both are valid, but have different tradeoffs. I will say it’s likely far more common to see a single over-privileged role running their IaC in CI/CD