Skip to content

Commit 4f88db6

Browse files
authored
fix(iam): importedRoleStackSafeDefaultPolicyName feature flag results in excessively long IAM policy names (#27548)
When the importedRoleStackSafeDefaultPolicyName feature flag is enabled, the method to calculate the IAM Policy Name within `aws_iam.ImportedRole.addToPrincipalPolicy()` changes. Specifically, if the generated IAM Policy Name exceeds the maximum allowed length of 128 characters, it will be truncated using `Names.uniqueResourceName()`. Previously, the `Names.UniqueId()` method was used to generate the Policy Name. This method does not allow you to set a maximum length, so if the name exceeded the limit, it would be overwritten using `Names.uniqueResourceName()`—a function that allows for length specification. I considered replacing `Names.UniqueId()` entirely with `Names.uniqueResourceName()`. However, this is on hold due to concerns that existing Policy Names could be affected. If a complete replacement poses no issues, your guidance is appreciated, as I'm not fully versed in the logic behind these methods. Closes #27409 , #24441 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 73a5e74 commit 4f88db6

File tree

17 files changed

+33779
-1289
lines changed

17 files changed

+33779
-1289
lines changed

packages/@aws-cdk-testing/framework-integ/test/aws-iam/test/integ.imported-role.js.snapshot/ImportedRoleTestAssertions.assets.json

Lines changed: 6 additions & 6 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-iam/test/integ.imported-role.js.snapshot/ImportedRoleTestAssertions.template.json

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"Resources": {
3-
"AwsApiCallIAMlistRolePolicies": {
3+
"AwsApiCallIAMlistRolePoliciese15a421383f9698f4159fca8713990e6": {
44
"Type": "Custom::DeployAssert@SdkCallIAMlistRolePolicies",
55
"Properties": {
66
"ServiceToken": {
@@ -11,18 +11,30 @@
1111
},
1212
"service": "IAM",
1313
"api": "listRolePolicies",
14-
"expected": "{\"$StringLike\":\"^Policyintegiamimportedrole2Role.{8}$\"}",
15-
"actualPath": "PolicyNames.1",
14+
"expected": "{\"$StringLike\":\"^Policyintegiamimportedrole2Roley+.{8}$\"}",
15+
"actualPath": "PolicyNames.3",
1616
"parameters": {
1717
"RoleName": {
18-
"Fn::ImportValue": "integ-iam-imported-role-role-stack:ExportsOutputRefTestRole6C9272DF9DD89F08"
18+
"Fn::Join": [
19+
"",
20+
[
21+
"\"",
22+
{
23+
"Fn::ImportValue": "integ-iam-imported-role-role-stack:ExportsOutputRefTestRole6C9272DF9DD89F08"
24+
},
25+
"\""
26+
]
27+
]
1928
}
2029
},
2130
"flattenResponse": "true",
2231
"outputPaths": [
23-
"PolicyNames.1"
32+
"PolicyNames.0",
33+
"PolicyNames.1",
34+
"PolicyNames.2",
35+
"PolicyNames.3"
2436
],
25-
"salt": "1676338905652"
37+
"salt": "1697413484207"
2638
},
2739
"UpdateReplacePolicy": "Delete",
2840
"DeletionPolicy": "Delete"
@@ -71,12 +83,12 @@
7183
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F": {
7284
"Type": "AWS::Lambda::Function",
7385
"Properties": {
74-
"Runtime": "nodejs14.x",
86+
"Runtime": "nodejs18.x",
7587
"Code": {
7688
"S3Bucket": {
7789
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
7890
},
79-
"S3Key": "73c20a669c041469f7fc3fc03d574b093b5b97e7c716f76c1e8117e6163e4dc4.zip"
91+
"S3Key": "c91921c142e824b74d06797a2be74eab5d0dd0453e753549f5182ac7a02f556b.zip"
8092
},
8193
"Timeout": 120,
8294
"Handler": "index.handler",
@@ -90,10 +102,10 @@
90102
}
91103
},
92104
"Outputs": {
93-
"AssertionResultsAwsApiCallIAMlistRolePolicies": {
105+
"AssertionResultsAwsApiCallIAMlistRolePoliciese15a421383f9698f4159fca8713990e6": {
94106
"Value": {
95107
"Fn::GetAtt": [
96-
"AwsApiCallIAMlistRolePolicies",
108+
"AwsApiCallIAMlistRolePoliciese15a421383f9698f4159fca8713990e6",
97109
"assertion"
98110
]
99111
}

0 commit comments

Comments
 (0)