fix(lambda): handle token resolution issues in addToRolePolicy #34904

alvazjor · 2025-07-04T10:05:44Z

Issue # (if applicable)

Reason for this change

When createNewPoliciesWithAddToRolePolicy flag is false, addToRolePolicy() fails with CloudFormation intrinsic functions due to token resolution issues. More details in the issue itself.

Description of changes

This fix detects complex tokens and forces separate inline policies to prevent the error while maintaining backward compatibility.

Describe any new or updated permissions being added

No new permissions being added

Description of how you validated changes

Tested the new changes in the broken cdk app that was able to reproduce the issue (used reproduction steps from the original issue). The app can be synth now, and deployed. Verifying the lambda role manually in the console also showed that a single role is preserved but the role policies are now split in 2: one from the string literal and one from the token. Both are correctly resolved.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

mrgrain · 2025-07-04T10:39:20Z

packages/aws-cdk-lib/aws-lambda/lib/function-base.ts

+  private statementHasComplexTokens(statement: iam.PolicyStatement): boolean {
+    // Check if resources contain tokens that represent CloudFormation functions
+    const resources = statement.resources;
+    if (!resources || resources.length === 0) {


Can you check resources.length if this is a token? Does this not error?

mrgrain · 2025-07-04T10:41:42Z

packages/aws-cdk-lib/aws-lambda/lib/function-base.ts

+   * that would cause issues when merged with other statements in a single policy document.
+   * @internal
+   */
+  private statementHasComplexTokens(statement: iam.PolicyStatement): boolean {


Not sure what a "complex token" would be just from reading the description. Looking at the code this might more accurately as "nested token".

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

…tion

mergify · 2025-07-10T13:50:49Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-07-10T14:30:59Z

This pull request has been removed from the queue for the following reason: pull request dequeued.

Pull request #34904 has been dequeued. The pull request could not be merged. This could be related to an activated branch protection or ruleset rule that prevents us from merging. (details: 2 of 2 required status checks are expected.).

You can check the last failing draft PR here: #34952.

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.
If you do update this pull request, it will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue instead, you can requeue the pull request, without updating it, by posting a @mergifyio requeue comment.

alvazjor · 2025-07-10T14:41:59Z

@Mergifyio requeue

mergify · 2025-07-10T14:42:07Z

requeue

✅ The queue state of this pull request has been cleaned. It can be re-embarked automatically

mergify · 2025-07-10T16:36:14Z

This pull request has been removed from the queue for the following reason: pull request dequeued.

Pull request #34904 has been dequeued. The pull request could not be merged. This could be related to an activated branch protection or ruleset rule that prevents us from merging. (details: 2 of 2 required status checks are expected.).

You can check the last failing draft PR here: #34958.

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.
If you do update this pull request, it will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue instead, you can requeue the pull request, without updating it, by posting a @mergifyio requeue comment.

…tion

mergify · 2025-07-11T09:35:13Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

…tion

aws-cdk-automation · 2025-07-11T10:50:20Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: bd30f11
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-07-11T10:50:42Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-07-11T10:50:58Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p0 labels Jul 4, 2025

aws-cdk-automation requested a review from a team July 4, 2025 10:05

alvazjor added pr/work-in-progress This PR is a draft and needs further work. and removed bug This issue is a bug. p0 effort/medium Medium work item – several days of effort labels Jul 4, 2025

mergify bot added the contribution/core This is a PR that came from AWS. label Jul 4, 2025

aws-cdk-automation previously requested changes Jul 4, 2025

View reviewed changes

mrgrain reviewed Jul 4, 2025

View reviewed changes

alvazjor force-pushed the fix/issue-34894-addtorolepolicy-token-resolution branch 6 times, most recently from 61f69d5 to 9a95a29 Compare July 7, 2025 14:17

alvazjor changed the title ~~fix(aws-lambda): handle CloudFormation intrinsic functions in addToRolePolicy~~ fix(lambda): handle oken resolution issues in addToRolePolicy Jul 7, 2025

github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p0 labels Jul 7, 2025

alvazjor removed the pr/work-in-progress This PR is a draft and needs further work. label Jul 7, 2025

aemada-aws self-assigned this Jul 7, 2025

alvazjor changed the title ~~fix(lambda): handle oken resolution issues in addToRolePolicy~~ fix(lambda): handle token resolution issues in addToRolePolicy Jul 8, 2025

fix(lambda): prevent token resolution conflicts in addToRolePolicy

c4591ae

alvazjor force-pushed the fix/issue-34894-addtorolepolicy-token-resolution branch from 9f4a242 to c4591ae Compare July 9, 2025 19:35

aemada-aws approved these changes Jul 10, 2025

View reviewed changes

alvazjor and others added 2 commits July 10, 2025 11:54

Merge branch 'main' into fix/issue-34894-addtorolepolicy-token-resolu…

ea5df24

…tion

refactoring some comments

9b230cd

Jorge Diaz added 4 commits July 10, 2025 14:26

fix integ test folder name

3394d8c

Separating unit test files

79cf190

clean up integ tests

02bb4b8

generated new integ test files

2170123

mergify bot added a commit that referenced this pull request Jul 10, 2025

Merge of #34904

045c1c6

mergify bot mentioned this pull request Jul 10, 2025

merge queue: embarking main (05afab3) and #34904 together #34952

Closed

30 tasks

mergify bot added a commit that referenced this pull request Jul 10, 2025

Merge of #34904

5de476c

mergify bot mentioned this pull request Jul 10, 2025

merge queue: embarking main (05afab3) and #34904 together #34958

Closed

30 tasks

Merge branch 'main' into fix/issue-34894-addtorolepolicy-token-resolu…

5af9480

…tion

mergify bot added a commit that referenced this pull request Jul 11, 2025

Merge of #34904

777d806

mergify bot mentioned this pull request Jul 11, 2025

merge queue: embarking main (b0018dc) and #34904 together #34967

Closed

30 tasks

Merge branch 'main' into fix/issue-34894-addtorolepolicy-token-resolu…

bd30f11

…tion

mergify bot merged commit 6cd1802 into main Jul 11, 2025
18 checks passed

mergify bot deleted the fix/issue-34894-addtorolepolicy-token-resolution branch July 11, 2025 10:50

github-actions bot locked as resolved and limited conversation to collaborators Jul 11, 2025

fix(lambda): handle token resolution issues in addToRolePolicy #34904

fix(lambda): handle token resolution issues in addToRolePolicy #34904

Uh oh!

Conversation

alvazjor commented Jul 4, 2025

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mrgrain Jul 4, 2025

Choose a reason for hiding this comment

Uh oh!

mrgrain Jul 4, 2025

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Jul 10, 2025

Uh oh!

mergify bot commented Jul 10, 2025

Uh oh!

alvazjor commented Jul 10, 2025

Uh oh!

mergify bot commented Jul 10, 2025

✅ The queue state of this pull request has been cleaned. It can be re-embarked automatically

Uh oh!

mergify bot commented Jul 10, 2025

Uh oh!

mergify bot commented Jul 11, 2025

Uh oh!

aws-cdk-automation commented Jul 11, 2025

AWS CodeBuild CI Report

Uh oh!

mergify bot commented Jul 11, 2025

Uh oh!

Uh oh!

github-actions bot commented Jul 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

aws-cdk-automation left a comment •

edited

Loading