Skip to content

Commit 5cc2b0b

Browse files
authored
fix(iam): Modify addManagedPolicy to compare ARN instead of instance reference (#25529)
## Issue When creating a role, the following warning message appeared: ``` Policy large: 11 exceeds 10 managed policies attached to a Role, this requires a quota increase ``` This was caused by the same managed policy being added multiple times. Although there was only one managed policy in the created template, it appears that the managedPolicies field of the Role class has multiple instances of the same managed policy added to it. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 6d32b65 commit 5cc2b0b

File tree

2 files changed

+33
-2
lines changed

2 files changed

+33
-2
lines changed

packages/aws-cdk-lib/aws-iam/lib/role.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -549,7 +549,7 @@ export class Role extends Resource implements IRole {
549549
if (this._precreatedRole) {
550550
return this._precreatedRole.addManagedPolicy(policy);
551551
} else {
552-
if (this.managedPolicies.find(mp => mp === policy)) { return; }
552+
if (this.managedPolicies.some(mp => mp.managedPolicyArn === policy.managedPolicyArn)) { return; }
553553
this.managedPolicies.push(policy);
554554
}
555555
}

packages/aws-cdk-lib/aws-iam/test/role.test.ts

+32-1
Original file line numberDiff line numberDiff line change
@@ -1166,7 +1166,18 @@ test('managed policy ARNs are deduplicated', () => {
11661166
ManagedPolicy.fromAwsManagedPolicyName('SuperDeveloper'),
11671167
],
11681168
});
1169-
role.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('SuperDeveloper'));
1169+
role.addToPrincipalPolicy(
1170+
new PolicyStatement({
1171+
actions: ['s3:*'],
1172+
resources: ['*'],
1173+
}),
1174+
);
1175+
1176+
for (let i = 0; i < 20; i++) {
1177+
role.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('SuperDeveloper'));
1178+
}
1179+
1180+
Annotations.fromStack(stack).hasNoWarning('/my-stack/MyRole', Match.stringLikeRegexp('.*'));
11701181

11711182
Template.fromStack(stack).hasResourceProperties('AWS::IAM::Role', {
11721183
ManagedPolicyArns: [
@@ -1184,6 +1195,26 @@ test('managed policy ARNs are deduplicated', () => {
11841195
});
11851196
});
11861197

1198+
test('too many managed policies warning', () => {
1199+
const app = new App();
1200+
const stack = new Stack(app, 'my-stack');
1201+
const role = new Role(stack, 'MyRole', {
1202+
assumedBy: new ServicePrincipal('sns.amazonaws.com'),
1203+
});
1204+
role.addToPrincipalPolicy(
1205+
new PolicyStatement({
1206+
actions: ['s3:*'],
1207+
resources: ['*'],
1208+
}),
1209+
);
1210+
1211+
for (let i = 0; i < 20; i++) {
1212+
role.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName(`SuperDeveloper${i}`));
1213+
}
1214+
1215+
Annotations.fromStack(stack).hasWarning('/my-stack/MyRole', Match.stringLikeRegexp('.*'));
1216+
});
1217+
11871218
describe('role with too large inline policy', () => {
11881219
const N = 100;
11891220

0 commit comments

Comments
 (0)