managedPolicyArns on User isn't respected

[FantasticFiasco]

Let me start by apologizing if this isn't at all a bug, but instead the expected behavior. You can respond me with a RTFM if that is the case :)

Describe the bug
I thought that specifying a managed policy ARN when creating a User would result in the same CloudFormation as when using the method User.attachManagedPolicy.

To Reproduce
Lets start with what works.

const user = new User(this, 'SomeUser', {
  userName: 'some-user',
});

user.attachManagedPolicy('arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess');

This will synthesizes into.

Resources:
  SomeUser64A25E2C:
    Type: AWS::IAM::User
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess
      UserName: some-user
    Metadata:
      aws:cdk:path: BootstrapStack/SomeUser/Resource
  CDKMetadata:
    Type: AWS::CDK::Metadata
    Properties:
      Modules: aws-cdk=0.31.0,@aws-cdk/assets=0.31.0,@aws-cdk/aws-apigateway=0.31.0,@aws-cdk/aws-cloudwatch=0.31.0,@aws-cdk/aws-ec2=0.31.0,@aws-cdk/aws-events=0.31.0,@aws-cdk/aws-iam=0.31.0,@aws-cdk/aws-kms=0.31.0,@aws-cdk/aws-lambda=0.31.0,@aws-cdk/aws-s3=0.31.0,@aws-cdk/aws-s3-notifications=0.31.0,@aws-cdk/aws-sqs=0.31.0,@aws-cdk/cdk=0.31.0,@aws-cdk/cx-api=0.31.0,@aws-cdk/region-info=0.31.0,jsii-runtime=node.js/v10.15.3

The managed policy is attached as expected. Now lets continue with what doesn't work.

new User(this, 'SomeUser', {
  managedPolicyArns: [
    'arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess',
  ],
  userName: 'some-user',
});

This will synthesizes into.

Resources:
  SomeUser64A25E2C:
    Type: AWS::IAM::User
    Properties:
      UserName: some-user
    Metadata:
      aws:cdk:path: BootstrapStack/SomeUser/Resource
  CDKMetadata:
    Type: AWS::CDK::Metadata
    Properties:
      Modules: aws-cdk=0.31.0,@aws-cdk/assets=0.31.0,@aws-cdk/aws-apigateway=0.31.0,@aws-cdk/aws-cloudwatch=0.31.0,@aws-cdk/aws-ec2=0.31.0,@aws-cdk/aws-events=0.31.0,@aws-cdk/aws-iam=0.31.0,@aws-cdk/aws-kms=0.31.0,@aws-cdk/aws-lambda=0.31.0,@aws-cdk/aws-s3=0.31.0,@aws-cdk/aws-s3-notifications=0.31.0,@aws-cdk/aws-sqs=0.31.0,@aws-cdk/cdk=0.31.0,@aws-cdk/cx-api=0.31.0,@aws-cdk/region-info=0.31.0,jsii-runtime=node.js/v10.15.3

This time there is no attached managed policy, as I'd expect there would be. The managed policy isn't part of the CloudFormation at all.

Expected behavior

Managed policies are not a part of the synthesized CloudFormation if the managed policy is specified when creating the User.

Version:

• OS: Debian GNU/Linux 9.9 (stretch)
• Programming Language: TypeScript
• CDK Version: 0.31.0 (build 7a70c08)

[mescam]

+1 from me as I have encountered this bug today, thanks for the information that attachManagedPolicy works.

[RomainMuller]

Yeah - quite clearly a bug there... That should "just work". Thanks for reporting!