Feature Request: Add PermissionsBoundary as option for role that gets created about aws-secrets-manager-rotation-lambdas HOT 6 OPEN

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Parameters:
  endpoint:
    Type: String
    Description: The Secrets Manager endpoint to use.
  functionName:
    Type: String
    Description: The name of the Lambda function.
  invokingServicePrincipal:
    Type: String
    Description: The service principal for the invoking service.
    Default: secretsmanager.amazonaws.com
  vpcSubnetIds:
    Type: CommaDelimitedList
    Description: A comma-separated list of VPC subnet IDs applied to the database
      network.
    Default: ''
  vpcSecurityGroupIds:
    Type: CommaDelimitedList
    Description: A comma-separated list of security group IDs applied to the database.
    Default: ''
  kmsKeyArn:
    Type: String
    Description: The ARN of the KMS key that Secrets Manager uses to encrypt the secret.
    Default: ''
  excludeCharacters:
    Type: String
    Description: A string of the characters that you don't want in the password.
    Default: :/@"'\
  runtime:
    Type: String
    Description: The python runtime associated with the Lambda function
    Default: python3.9
  PermissionsBoundaryPolicyArn:
    Description: ARN of a boundary policy if your organisation uses some for roles, optional.
    Type: String
    Default: ""
Conditions:
  AddVpcConfig:
    Fn::And:
    - Fn::Not:
      - Fn::Equals:
        - ''
        - Fn::Join:
          - ''
          - Ref: vpcSubnetIds
    - Fn::Not:
      - Fn::Equals:
        - ''
        - Fn::Join:
          - ''
          - Ref: vpcSecurityGroupIds
  KmsKeyArnExists:
    Fn::Not:
    - Fn::Equals:
      - ''
      - Ref: kmsKeyArn
  ApplyPermissionsBoundary:
    !Not [!Equals [!Ref PermissionsBoundaryPolicyArn, ""]]

Resources:
  SecretsManagerRDSPostgreSQLRotationSingleUser:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName:
        Ref: functionName
      Description: Rotates a Secrets Manager secret for Amazon RDS PostgreSQL credentials
        using the single user rotation strategy.
      Handler: lambda_function.lambda_handler
      Runtime:
        Ref: runtime
      CodeUri:
        Bucket: <%REPO_BUCKET%>
        Key: 8494558e-a7c7-479b-b855-6a42fa99ba3f
      AutoPublishCodeSha256: b6db215a045dfe41d9838f1236af55b0de0d491d7d03b67d78ebde754eeadaae
      Timeout: 30
      PermissionsBoundary: !If
        - ApplyPermissionsBoundary
        - !Ref PermissionsBoundaryPolicyArn
        - !Ref AWS::NoValue
      Policies:
      - VPCAccessPolicy: {}
      - AWSSecretsManagerRotationPolicy:
          FunctionName:
            Ref: functionName
      - Fn::If:
        - KmsKeyArnExists
        - Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - kms:Decrypt
            - kms:DescribeKey
            - kms:GenerateDataKey
            Resource:
              Ref: kmsKeyArn
        - Ref: AWS::NoValue
      Environment:
        Variables:
          SECRETS_MANAGER_ENDPOINT:
            Ref: endpoint
          EXCLUDE_CHARACTERS:
            Ref: excludeCharacters
      VpcConfig:
        Fn::If:
        - AddVpcConfig
        - SubnetIds:
            Ref: vpcSubnetIds
          SecurityGroupIds:
            Ref: vpcSecurityGroupIds
        - Ref: AWS::NoValue
      Tags:
        SecretsManagerLambda: Rotation
  LambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName:
        Fn::GetAtt:
        - SecretsManagerRDSPostgreSQLRotationSingleUser
        - Arn
      Principal:
        Ref: invokingServicePrincipal
      SourceAccount:
        Ref: AWS::AccountId
Outputs:
  RotationLambdaARN:
    Description: The ARN of the rotation lambda
    Value:
      Fn::GetAtt:
      - SecretsManagerRDSPostgreSQLRotationSingleUser
      - Arn