SNS Topic Policy can't be created and synth'd

[mbonig]

❓ General Issue

When creating an SNS TopicPolicy the Props only have topics as a field. However, there also needs to be a PolicyDocument field and without it an error occurs during synth. There doesn't appear to be any way to set it, either through the Props in the constructor or after the fact.

The Question

With this minimum example:

const topic = new Topic(this, 'topic', {});
const tp = new TopicPolicy(this, 'tp', {
    topics: [topic],
});

An error occurs during synth:

Error: Resolution error: Supplied properties not correct for "CfnTopicPolicyProps"
  policyDocument: required but missing.

Environment

• CDK CLI Version: 1.38.0 (build d5fa31f)
• Module Version: 1.38.0
• OS: Mac OS 10.15.4
• Language: Typescript

Other information

[SomayaB]

Hi @mbonig, sorry for the late reply. It does seem like this is a bug, I'm getting the same error. So I'll file this as a bug and we'll add it to our workload. In the meantime, you might want to try using Topic.addToResourcePolicy(statement) instead of TopicPolicy.

[sunojram]

Do we have any updates for this issue? I'm not blocked but would be nice to have this.

[MrArnoldPalmer]

So after spending some time researching this and talking to @rix0rrr, I think that the correct usage here is to use addStatements to add statements to the policy document post construction. You shouldn't be synthesizing an empty policy document, and CFN won't let you deploy one anyway. Here is a short example:

export class Issue10559Stack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const topic = new sns.Topic(this, 'Topic');
    const topicPolicy = new sns.TopicPolicy(this, 'Policy', {
      topics: [topic],
    });
    
    topicPolicy.document.addStatements(new iam.PolicyStatement({
        actions: ["sns:Subscribe"],
        principals: [new iam.AccountPrincipal('430030518091')],
        resources: [topic.topicArn] 
      })
    );
  }
}

General I'd recommend using addToResourcePolicy over creating a TopicPolicy but the above allows synthesizing one.

[MrArnoldPalmer]

Additionally added an issue to track the addition of local input validation for the policy statements passed to PolicyDocument.
#13617

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.