fix(agentcore): addToRolePolicy for runtime with imported role destroys and recreates policies on every deployment

[go-to-k]

Issue # (if applicable)

Closes #35844

Reason for this change

The current addToRolePolicy for Runtime with imported role destroys and recreates policies on every deployment.

The reason is that Date.now() is used for a construct ID of a new Policy in the situation:

https://github.com/aws/aws-cdk/blob/v2.221.0/packages/%40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-base.ts#L253

  public addToRolePolicy(statement: iam.PolicyStatement): IBedrockAgentRuntime {
    // Check if role is a concrete Role instance
    if (this.role instanceof iam.Role) {
      this.role.addToPolicy(statement);
    } else {
      // For imported roles (IRole), we need to attach via a new policy
      const policy = new iam.Policy(this, `CustomPolicy${Date.now()}`, {
        statements: [statement],
      });

Reproduction

1. Deploy your stack with the following CDK code:

const app = new cdk.App();
const stack = new cdk.Stack(app, 'aws-cdk-bedrock-agentcore-runtime-with-imported-role');

const runtimeArtifact = agentcore.AgentRuntimeArtifact.fromAsset(
  path.join(__dirname, 'testArtifact'),
);

const role = new iam.Role(stack, 'ExecutionRole', {
  assumedBy: new iam.ServicePrincipal('bedrock-agentcore.amazonaws.com'),
});
const imported = iam.Role.fromRoleArn(stack, 'ImportedRole', role.roleArn);

const runtime = new agentcore.Runtime(stack, 'TestRuntime', {
  runtimeName: 'integ_test_runtime',
  agentRuntimeArtifact: runtimeArtifact,
  executionRole: imported,
});

runtime.addToRolePolicy(new iam.PolicyStatement({
  actions: ['dynamodb:Query'],
  resources: ['arn:aws:dynamodb:us-east-1:123456789012:table/my-table'],
}));

2. Deploy or diff the stack with the same CDK code again.

3. The change will occur:

      [-] AWS::IAM::Policy TestRuntimeCustomPolicy1761380931769044921D2 destroy
      [+] AWS::IAM::Policy TestRuntimeCustomPolicy1761381522330E0DC0D40

Description of changes

Use addToPrincipalPolicy directly instead.

Describe any new or updated permissions being added

Description of how you validated changes

Both unit tests and an integ test.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[dineshSajwan]

Thank you @go-to-k .
LGTM.

[Abogical]

There is no need to create a new Policyobject, just use addtoPrincipalPolicy()

Suggested change

	this.role.attachInlinePolicy(policy);
	this.role.addToPrincipalPolicy(statement);

[go-to-k]

Summarized it like this. Many other Constructs are done this way. How about it?

  public addToRolePolicy(statement: iam.PolicyStatement): IBedrockAgentRuntime {
-    // Check if role is a concrete Role instance
-    if (this.role instanceof iam.Role) {
-      this.role.addToPolicy(statement);
-    } else {
-      // For imported roles (IRole), we need to attach via a new policy
-      const policy = new iam.Policy(this, `CustomPolicy${Date.now()}`, {
-        statements: [statement],
-      });
-      this.role.attachInlinePolicy(policy);
-    }
+    this.role.addToPrincipalPolicy(statement);
    return this;
  }

Pull request has been modified.

[Abogical]

Thanks! I have asked for a security review for this.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated

For security reasons, Mergify can't update this pull request. Try updating locally.
GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/pr-build.yml without workflows permission.

You should update or rebase your pull request manually. If you do, this pull request will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue, you can requeue the pull request, without updating it, by posting a @mergifyio requeue comment.

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[Abogical]

@Mergifyio rebase

[mergify]

rebase

✅ Branch has been successfully rebased

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[go-to-k]

@Mergifyio update

[mergify]

update

✅ Branch has been successfully updated

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[go-to-k]

@Mergifyio update

[mergify]

update

☑️ Nothing to do, the required conditions are not met

• #commits-behind > 0 [📌 update requirement]
• -closed [📌 update requirement]
• -conflict [📌 update requirement]
• queue-position = -1 [📌 update requirement]

[Abogical]

@Mergifyio requeue

[mergify]

requeue

✅ The queue state of this pull request has been cleaned. It can be re-embarked automatically

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.