(iam): Warn/error when changes to imported principals are dropped

[stephenwiebe]

When I import an IRole with Role.fromRoleArn, if I try to add a managed policy with addManagedPolicy, nothing happens. However, addToPrincipalPolicy with the desired policy statements does work. Is this the expected behavior?

Reproduction Steps

const codebuildRole = Role.fromRoleArn(
      this,
      'CodebuildRole',
      StringParameter.valueForStringParameter(this, props.commonCodebuildRoleParamName)
    );

codebuildRole.addManagedPolicy(new iam.ManagedPolicy(...));  // doesn't do anything, although the ManagedPolicy is created

Environment

• CDK CLI Version : 1.79.0
• Framework Version: 1.79.0
• Node.js Version: 14.4.0
• OS : Linux
• Language (Version): Typescript (3.7.2)

---

This is 🐛 Bug Report

[redbaron]

Did you try passing mutable flag in FromRoleArnOptions optional argument? https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-iam.FromRoleArnOptions.html

[jumi-dev]

addToPrincipalPolicy in Role.fromRoleArn is not supported, see:

aws-cdk/packages/@aws-cdk/aws-iam/lib/role.ts

Lines 226 to 228 in ab5a383

	public addManagedPolicy(_policy: IManagedPolicy): void {
	// FIXME: Add warning that we're ignoring this
	}

Is this technically not possible? Or is there any other reason why this doesn't make sense? We should explain it in the warning.

[redbaron]

I'd say it should not warn, but throw.

[rix0rrr]

Depending on the situation, it is technically not possible. CloudFormation only allows us to attached managed policies upon role creation or upon managed policy creation (there is no AWS::IAM::ManagedPolicyAttachment resource).

We don't have provisions for the second case at all at the moment.

[brentryan]

Why couldn't the CDK code still allow addManagedPolicy() to work properly when it's imported? I understand that cloudformation has this limitation but that shouldn't stop CDK from allowing you to generate the right cloudformation for certain cases. For example, if you're deploying a CDK application that consists of 2 stacks, why couldn't this addManagedPolicy() method mutate the Role in stackA if being imported to stackB? CDK in this case has full control over all the objects and should be able to do this before synth. In the case of importing a role from an external role then it should throw an error and say this isn't supported ....

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[stephenwiebe]

I'm wondering about the answer to @brentryan 's question as well, but if it's not feasible than a warning should be added at least, right?

[peterwoodworth]

I understand that cloudformation has this limitation but that shouldn't stop CDK from allowing you to generate the right cloudformation for certain cases

You cannot generate cloudformation for a resource that is not managed by the same cloudformation stack

2 stacks in same app example

This should already work because you're not interacting with an IRole but a Role

I agree with this issue that a warning should throw when adding the policy is a no-op, this frequently confuses customers in other issues as well