S3 Bucket grant* stopped working in 1.20.0

[jeshan]

I've upgraded cdk (and aligned their modules as well) from 1.16.3(?) to 1.20.0 and I noticed that bucket policies that I created with the following stopped working

myBucket.grantReadWrite(myRole, `*/${templatesPublic}/*`);

Reproduction Steps

What I saw with cdk diff 1.20.0:

If I renamed the bucket, I'd get:

So, it suggests that it's broken for new and existing buckets as well.

It's not just the diff that was wrong; when I did cdk deploy, the bucket policy was actually gone.

Downgrading cdk (and the node modules) to 1.19.0:
I saw iam policies are back to what I had before:

Environment

• **CLI Version :1.20.0
• Framework Version:
• **OS :Linux
• **Language :JavaScript

I didn't spot any breaking change notice in the release notes at:
https://github.com/aws/aws-cdk/releases/tag/v1.20.0

---

This is 🐛 Bug Report

[netroy]

@jeshan is myRole imported using Role.fromRoleArn?
if not, can you please share some more information on how myRole is created?

[jeshan]

Sorry, I didn't realise that that was relevant. It is indeed created with fromRoleArn:

Role.fromRoleArn(
            this,
            'deployment-account-role',
            `arn:aws:iam::123456789012:role/deployment-role`,
        );

and I'm creating the bucket with something like:

this.publicBucket = new Bucket(this, 'bucket', {
            publicReadAccess: true,
            bucketName: 'my-public-bucket',
        });

[netroy]

I believe the change that's causing this issue for you, landed in this PR #5568

[jeshan]

OK. I'm trying with a newly created role just now (with 1.20) and I'm getting the same incorrect behaviour:

let myRole = new Role(this, 'dep-role', {
            assumedBy: new ServicePrincipal('...'),
            managedPolicies: [
                ManagedPolicy.fromAwsManagedPolicyName(
                    '...',
                ),
            ],
        });

[netroy]

For a new role, that's been the expected behaviour.
For imported roles, I'd recommend waiting for one of the repo owners to confirm if this is a regression or not.

[jeshan]

For a new role, that's been the expected behaviour.

I don't understand. Why would it be different for new v/s imported ones? How else would you reference a role in a bucket policy?

[rix0rrr]

Normally you wouldn't add the permissions to the bucket but to the role.

Since this is an imported role we assume the permissions have already been added to the role and we don't add them to the bucket. On the other hand, this is an imported role from another account (seems like?), in which case the permissions need to be added to BOTH the resource and the role.

For the moment, you can work around this by using bucket.addToResourcePolicy() while we sort this out.

Sorry for the problems this has caused.