aws_iam: Cannot use a service or account principal with grantAssumeRole, use assumeRolePolicy instead.

[vmx-kbabenko]

Describe the bug

Since version 2.136 trying to grant assume role to a principal results in an error.

Code example:

        role.grant_assume_role(
            aws_iam.ServicePrincipal('batchoperations.s3.amazonaws.com')
        )

Error:
@jsii/kernel.RuntimeError: Error: Cannot use a service or account principal with grantAssumeRole, use assumeRolePolicy instead.

Expected Behavior

No error expected

Current Behavior

@jsii/kernel.RuntimeError is observed

Reproduction Steps

Grant assume role to an AWS principal.

Possible Solution

Breaking change happened in 2.136 release:

iam: grantAssumeRole silently fails with service and account principals (#29452) (36fd79d), closes #24507

Additional Information/Context

No response

CDK CLI Version

2.136.1

Framework Version

No response

Node.js Version

18

OS

AL2

Language

Python

Language Version

3.9

Other information

No response

[msambol]

Related: #29452. Can you try the following:

role.assumeRolePolicy?.addStatements(new iam.PolicyStatement({
  actions: ['sts:AssumeRole'],
  principals: [
    new iam.ServicePrincipal('batchoperations.s3.amazonaws.com'),
    ],
}));

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[badfun]

I had the identical error. The solution provided by @msambol works. Now to go and refactor all the code.
Funny how the "solution" in #29452 is a documentation change. Helps for the future I suppose. Not sure why my stuff has been working all along until this update.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.