iam: PolicyStatement NotAction method

[Stephen-Meyerhofer]

There is an AddAction method on a PolicyStatement object, but no AddNotAction method.

[alex-berger]

Actually, all the Not* pendants are currently missing, including:

• NotAction
• NotResource
• NotPrincipal
  Would be great if CDK could support all the IAM policy statement features.

[kevinslin]

+1

[Sparkboxx]

I found a workaround (if not to say Hack). By overwriting the .toStatementJson function on a PolicyStatement you can effectively shortcut the rendering. I tested it for the NotAction case, but I would expect it to work for the NotResource and NotPrincipal cases as well.

var statements: PolicyStatement[] = []

const sDenyAllExceptListedIfNoMFA = new PolicyStatement() 
sDenyAllExceptListedIfNoMFA.toStatementJson = function() {
  return {
  "Sid": "DenyAllExceptListedIfNoMFA",
  "Effect": "Deny",
  "NotAction": [
    "iam:CreateVirtualMFADevice",
    "iam:EnableMFADevice",
    "iam:GetUser",
    "iam:ListMFADevices",
    "iam:ListVirtualMFADevices",
    "iam:ResyncMFADevice",
    "sts:GetSessionToken"
  ],
  "Resource": "*",
  "Condition": {
    "BoolIfExists": {
        "aws:MultiFactorAuthPresent": "false"
    }
  }
  }
}
statements.push(sDenyAllExceptListedIfNoMFA);

new iam.Policy(this, 'ForceMFAPolicy', {
  policyName: "Force_MFA",
  statements: statements,
})

Produces the right CloudFormation YAML on cdk synth

- Sid: DenyAllExceptListedIfNoMFA
  Effect: Deny
  NotAction:
    - iam:CreateVirtualMFADevice
    - iam:EnableMFADevice
    - iam:GetUser
    - iam:ListMFADevices
    - iam:ListVirtualMFADevices
    - iam:ResyncMFADevice
    - sts:GetSessionToken
  Resource: "*"
  Condition:
    BoolIfExists:
      aws:MultiFactorAuthPresent: "false"