(iam): policies created with grant interface in different stacks have the same name and overwrite each other

[ProficientBell]

I'm importing a role in two separate stacks to add permissions to resources created in those stacks and they end up overwriting each other

Reproduction Steps

stack 1 has:

    const myRole = Role.fromRoleArn(
        this,
        'myRole',
        StringParameter.valueForStringParameter(this, 'myParam');
    );
    myLambda.grantInvoke(myRole);

stack 2 has:

    const myRole = Role.fromRoleArn(
        this,
        'myRole',
        StringParameter.valueForStringParameter(this, 'myParam');
    );
    myEventbridge.grantPutEventsTo(myRole);

What did you expect to happen?

I expected two policies to be added to the role allowing put permission to myEventbridge and allowing invoke on myLambda.

What actually happened?

I only get one of these permissions. The policy name generated is the same for both (in my case something like 'myRolePolicy3334F5F9') so one ends up overwriting the other.

I've worked around this by changing the imported role id in each stack to be unique but I find this troubling as it is extremely easy to accidentally overwrite policies set in a different stack. Shouldn't names be unique by stack?

Environment

• **CDK CLI Version :1.117.0
• **Framework Version:1.117.0
• **Node.js Version:v16.3.0
• **OS :ios
• **Language (Version):TypeScript 4.3.4

Other

---

This is 🐛 Bug Report

[EhrhardtDa]

I'm having the same with grants on kms keys.
I deploy a key in each environment (different apps / same stack template) and add grants for the equal role in each environment, which leads to a Policy, with the same Unique Identifier in each environment. The policy gets then overwritten, depending on which environment was deployed lastly.

[acere]

This looks like the same problem as #7483
I've encountered the same issue when granting privileges to the same IAM roles from two different stacks.
Is there any update on workarounds to rename the IAM policies created by grant* methods?

[comcalvi]

I've reproduced this successfully.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.