fix(iam): PrincipalWithConditions.addCondition fails with a new key (#…

…23782) fixes #23781 This pr makes PrincipalWithConditions.addCondition bypass validations on the existing condition object if missing. ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Construct Runtime Dependencies: * [ ] This PR adds new construct runtime dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-construct-runtime-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
aws · Feb 12, 2023 · 8951d01 · 8951d01
1 parent 9d23cad
commit 8951d01
Show file tree

Hide file tree

Showing 11 changed files with 479 additions and 0 deletions.
diff --git a/packages/@aws-cdk/aws-iam/lib/principals.ts b/packages/@aws-cdk/aws-iam/lib/principals.ts
@@ -273,6 +273,7 @@ export class PrincipalWithConditions extends PrincipalAdapter {
     const existingValue = this.additionalConditions[key];
     if (!existingValue) {
       this.additionalConditions[key] = value;
+      return;
     }
     validateConditionObject(existingValue);
 

diff --git a/...-conditions.js.snapshot/PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9.assets.json b/...-conditions.js.snapshot/PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9.assets.json
@@ -0,0 +1,19 @@
+{
+  "version": "29.0.0",
+  "files": {
+    "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
+      "source": {
+        "path": "PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9.template.json",
+        "packaging": "file"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    }
+  },
+  "dockerImages": {}
+}
diff --git a/...onditions.js.snapshot/PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9.template.json b/...onditions.js.snapshot/PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9.template.json
@@ -0,0 +1,36 @@
+{
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}
diff --git a/packages/@aws-cdk/aws-iam/test/integ.principal-with-conditions.js.snapshot/cdk.out b/packages/@aws-cdk/aws-iam/test/integ.principal-with-conditions.js.snapshot/cdk.out
@@ -0,0 +1 @@
+{"version":"29.0.0"}
diff --git a/...t/integ.principal-with-conditions.js.snapshot/integ-principal-with-conditions.assets.json b/...t/integ.principal-with-conditions.js.snapshot/integ-principal-with-conditions.assets.json
@@ -0,0 +1,19 @@
+{
+  "version": "29.0.0",
+  "files": {
+    "e190312aaf9fec4bd55ff6f059f2bf5d7453c4ade33a3d922bfd6ff0a61d3a62": {
+      "source": {
+        "path": "integ-principal-with-conditions.template.json",
+        "packaging": "file"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "e190312aaf9fec4bd55ff6f059f2bf5d7453c4ade33a3d922bfd6ff0a61d3a62.json",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    }
+  },
+  "dockerImages": {}
+}
diff --git a/...integ.principal-with-conditions.js.snapshot/integ-principal-with-conditions.template.json b/...integ.principal-with-conditions.js.snapshot/integ-principal-with-conditions.template.json
@@ -0,0 +1,64 @@
+{
+ "Resources": {
+  "TestRole6C9272DF": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Condition": {
+        "StringLike": {
+         "aws:username": "foo-*",
+         "aws:PrincipalTag/owner": "foo"
+        },
+        "Bool": {
+         "aws:MultiFactorAuthPresent": "true"
+        }
+       },
+       "Effect": "Allow",
+       "Principal": {
+        "AWS": "*"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    }
+   }
+  }
+ },
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}
diff --git a/packages/@aws-cdk/aws-iam/test/integ.principal-with-conditions.js.snapshot/integ.json b/packages/@aws-cdk/aws-iam/test/integ.principal-with-conditions.js.snapshot/integ.json
@@ -0,0 +1,12 @@
+{
+  "version": "29.0.0",
+  "testCases": {
+    "PrincipalWithCondition/DefaultTest": {
+      "stacks": [
+        "integ-principal-with-conditions"
+      ],
+      "assertionStack": "PrincipalWithCondition/DefaultTest/DeployAssert",
+      "assertionStackName": "PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9"
+    }
+  }
+}
diff --git a/packages/@aws-cdk/aws-iam/test/integ.principal-with-conditions.js.snapshot/manifest.json b/packages/@aws-cdk/aws-iam/test/integ.principal-with-conditions.js.snapshot/manifest.json
@@ -0,0 +1,111 @@
+{
+  "version": "29.0.0",
+  "artifacts": {
+    "integ-principal-with-conditions.assets": {
+      "type": "cdk:asset-manifest",
+      "properties": {
+        "file": "integ-principal-with-conditions.assets.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+      }
+    },
+    "integ-principal-with-conditions": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "integ-principal-with-conditions.template.json",
+        "validateOnSynth": false,
+        "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
+        "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/e190312aaf9fec4bd55ff6f059f2bf5d7453c4ade33a3d922bfd6ff0a61d3a62.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
+        "additionalDependencies": [
+          "integ-principal-with-conditions.assets"
+        ],
+        "lookupRole": {
+          "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
+          "requiresBootstrapStackVersion": 8,
+          "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+        }
+      },
+      "dependencies": [
+        "integ-principal-with-conditions.assets"
+      ],
+      "metadata": {
+        "/integ-principal-with-conditions/TestRole/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "TestRole6C9272DF"
+          }
+        ],
+        "/integ-principal-with-conditions/BootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "BootstrapVersion"
+          }
+        ],
+        "/integ-principal-with-conditions/CheckBootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "CheckBootstrapVersion"
+          }
+        ]
+      },
+      "displayName": "integ-principal-with-conditions"
+    },
+    "PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9.assets": {
+      "type": "cdk:asset-manifest",
+      "properties": {
+        "file": "PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9.assets.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+      }
+    },
+    "PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9.template.json",
+        "validateOnSynth": false,
+        "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
+        "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
+        "additionalDependencies": [
+          "PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9.assets"
+        ],
+        "lookupRole": {
+          "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
+          "requiresBootstrapStackVersion": 8,
+          "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+        }
+      },
+      "dependencies": [
+        "PrincipalWithConditionDefaultTestDeployAssertA4D5A2E9.assets"
+      ],
+      "metadata": {
+        "/PrincipalWithCondition/DefaultTest/DeployAssert/BootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "BootstrapVersion"
+          }
+        ],
+        "/PrincipalWithCondition/DefaultTest/DeployAssert/CheckBootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "CheckBootstrapVersion"
+          }
+        ]
+      },
+      "displayName": "PrincipalWithCondition/DefaultTest/DeployAssert"
+    },
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    }
+  }
+}