diff --git a/moto/iam/models.py b/moto/iam/models.py index 617da69b0..3e7b638b2 100755 --- a/moto/iam/models.py +++ b/moto/iam/models.py @@ -1435,6 +1435,23 @@ class IAMBackend(BaseBackend): role.max_session_duration = max_session_duration return role + def put_role_permissions_boundary(self, role_name, permissions_boundary): + if permissions_boundary and not self.policy_arn_regex.match( + permissions_boundary + ): + raise RESTError( + "InvalidParameterValue", + "Value ({}) for parameter PermissionsBoundary is invalid.".format( + permissions_boundary + ), + ) + role = self.get_role(role_name) + role.permissions_boundary = permissions_boundary + + def delete_role_permissions_boundary(self, role_name): + role = self.get_role(role_name) + role.permissions_boundary = None + def detach_role_policy(self, policy_arn, role_name): arns = dict((p.arn, p) for p in self.managed_policies.values()) try: diff --git a/moto/iam/responses.py b/moto/iam/responses.py index 6f785f8ac..88ab9aef1 100644 --- a/moto/iam/responses.py +++ b/moto/iam/responses.py @@ -265,6 +265,19 @@ class IamResponse(BaseResponse): template = self.response_template(UPDATE_ROLE_TEMPLATE) return template.render(role=role) + def put_role_permissions_boundary(self): + permissions_boundary = self._get_param("PermissionsBoundary") + role_name = self._get_param("RoleName") + iam_backend.put_role_permissions_boundary(role_name, permissions_boundary) + template = self.response_template(GENERIC_EMPTY_TEMPLATE) + return template.render(name="PutRolePermissionsBoundary") + + def delete_role_permissions_boundary(self): + role_name = self._get_param("RoleName") + iam_backend.delete_role_permissions_boundary(role_name) + template = self.response_template(GENERIC_EMPTY_TEMPLATE) + return template.render(name="DeleteRolePermissionsBoundary") + def create_policy_version(self): policy_arn = self._get_param("PolicyArn") policy_document = self._get_param("PolicyDocument") @@ -1315,6 +1328,12 @@ GET_ROLE_TEMPLATE = """