Unable to build multi-principal Policy with Role #1201
Description
I am trying to create a role with the following policy document:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "${aws_iam_role.eks_nodes.arn}",
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
The problem, however, is that the Role construct only takes a single entity for assumedBy.
const defaultPodRole = new iam.Role(this, "default-pod-role", {
roleName: "default",
path: "/pods/",
assumedBy: new iam.ServicePrincipal("ec2.amazonaws.com"),
})
I tried pulling out the assumeRolePolicy but its statements member is private, and that would involve digging around in the statements array anyway.
export declare class PolicyDocument extends Token {
private readonly baseDocument?;
private statements;
This workaround produces a role/policy/trust setup that collapses to the same interpretation, but the resulting document is not the same.
const role = new iam.Role(this, 'Role', {
assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
});
if ( role.assumeRolePolicy ) {
role.assumeRolePolicy.addStatement(new iam.PolicyStatement().
addAccountRootPrincipal().
addAction('sts:AssumeRole'));
}
The resulting document is this:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
},
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456123456:root"
},
"Action": "sts:AssumeRole"
}
]
}