AWS IAM: Unable to add AWSBackupServiceRolePolicyForBackup

[Roedy13]

Describe the bug

I'm trying to create a backup role with the policies "AWSBackupServiceRolePolicyForBackup" and "AWSBackupServiceRolePolicyForS3Backup"

  backup_role = aws_iam.Role(
      scope=self,
      id="backup_role",
      role_name=BACKUP_ROLE_NAME,
      assumed_by=aws_iam.ServicePrincipal("backup.amazonaws.com"),
      managed_policies=[
          aws_iam.ManagedPolicy.from_aws_managed_policy_name(
              "AWSBackupServiceRolePolicyForBackup"
          ),
          aws_iam.ManagedPolicy.from_aws_managed_policy_name(
              "AWSBackupServiceRolePolicyForS3Backup"
          ),
      ],
  )

Expected Behavior

I expect a role to be created with the attached permissions

Current Behavior

When I run this code, I get a CDK error:

Resource handler returned message: "Policy arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForBackup does not exist or is not attachable. (Service: Iam, Status Code: 404, Request ID: a76f50aa-3a8e-45d1-824f-
6ab1e3212290)" (RequestToken: 0bf40c12-6daf-14eb-4005-29c3c8ddedbd, HandlerErrorCode: NotFound)

Notice the the ARN listed for this role is NOT the same as the arn from the IAM webconsole, which is

arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup

Reproduction Steps

Try to deploy the code above

Possible Solution

I'm assuming that the ARN isn't being generated correctly from "aws_iam.ManagedPolicy.from_aws_managed_policy_name"

When I change the above code to

  # Create a role for Backup
  backup_role = aws_iam.Role(
      scope=self,
      id="backup_role",
      role_name=BACKUP_ROLE_NAME,
      assumed_by=aws_iam.ServicePrincipal("backup.amazonaws.com"),
      managed_policies=[
          aws_iam.ManagedPolicy.from_managed_policy_arn(
              scope=self,
              id="service_backup_policy",
              managed_policy_arn="arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
          ),
          aws_iam.ManagedPolicy.from_aws_managed_policy_name(
              "AWSBackupServiceRolePolicyForS3Backup"
          ),
      ],
  )

It works as expected

Additional Information/Context

No response

CDK CLI Version

2.142.1 (build ed4e152)

Framework Version

aws-cdk@2.142.1

Node.js Version

v18.18.2

OS

Debian 12

Language

Python

Language Version

3.12.1

Other information

No response

[khushail]

Hi @Roedy13 , thanks for reaching out.

I see that the 2 roles mentioned generate diff arns -

• for AWSBackupServiceRolePolicyForBackup , the generated ARN: arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup

• for AWSBackupServiceRolePolicyForS3Backup, the generated ARN: arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Backup

Issue happens when the first policy arn is not generated correctly. In the CDK Docs, I found that for policies which have arn preceded by service-role or job-function, one has to specify that explicitly while passing the policy name, something this-

aws-cdk/packages/aws-cdk-lib/aws-iam/lib/managed-policy.ts

Line 155 in 8c39e81

* Some managed policy names start with "service-role/", some start with

So changing the code -

      managedPolicies: [
        aws_iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSBackupServiceRolePolicyForBackup'),

which is deployed successfully. Please let me know if this works for you.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[Roedy13]

That seems to work. Thanks!

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.