Skip to content

Conversation

@alvazjor
Copy link
Contributor

Issue # (if applicable)

Closes #.

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

alvazjor and others added 2 commits July 11, 2025 15:21
### Issue # (if applicable)

Closes #34894.

### Reason for this change

When createNewPoliciesWithAddToRolePolicy flag is false, addToRolePolicy() fails with CloudFormation intrinsic functions due to token resolution issues. More details in the issue itself.

### Description of changes

This fix detects complex tokens and forces separate inline policies to prevent the error while maintaining backward compatibility.

### Describe any new or updated permissions being added

No new permissions being added


### Description of how you validated changes

Tested the new changes in the broken cdk app that was able to reproduce the issue (used reproduction steps from the original issue). The app can be synth now, and deployed. Verifying the lambda role manually in the console also showed that a single role is preserved but the role policies are now split in 2: one from the string literal and one from the token. Both are correctly resolved.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@aws-cdk-automation aws-cdk-automation requested a review from a team July 11, 2025 14:51
@github-actions github-actions bot added the p2 label Jul 11, 2025
@mergify
Copy link
Contributor

mergify bot commented Jul 11, 2025

⚠️ The sha of the head commit of this PR conflicts with #34969. Mergify cannot evaluate rules on this PR. ⚠️

Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter fails with the following errors:

❌ The title prefix of this pull request must be one of "feat|fix|build|chore|ci|docs|style|refactor|perf|test|revert"

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

@mergify
Copy link
Contributor

mergify bot commented Jul 11, 2025

⚠️ The sha of the head commit of this PR conflicts with #34969. Mergify cannot evaluate rules on this PR. ⚠️

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: da25365
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Jul 11, 2025
@alvazjor alvazjor closed this Jul 11, 2025
@github-actions
Copy link
Contributor

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jul 11, 2025
@alvazjor alvazjor deleted the alvazjor/v2.204.1 branch July 29, 2025 14:08
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

contribution/core This is a PR that came from AWS. p2

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants