Hi Bernard, it’s PermissionsBoundary property of AWS::IAM::Role resource:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-permissionsboundary