I wonder if this is an acceptable feature request. If so, I could try submitting a PR myself.

aws-iam currently creates sub-optimal policies that could be pretty easily optimized. For example consider a helper method that runs this on an ECR repository:

    policy.addToPolicy(
      new iam.PolicyStatement({
        resources: [repository.repositoryArn],
        actions: [
          "ecr:InitiateLayerUpload",
          "ecr:UploadLayerPart",
          "ecr:CompleteLayerUpload",
          "ecr:BatchCheckLayerAvailability",
          "ecr:PutImage",
        ],
      })
    );

If policy is a "shared" policy, and the stack adds new ECR repositories over time, this construct will very quickly run into #11562.

The optimization would be that instead of creating duplicate statements with the same actions for every separate resource, it could just create one policy statement and merge all the resources together.

For example, it would be the equivalent of adding just one policy of:

    policy.addToPolicy(
      new iam.PolicyStatement({
        resources: [repository.repositoryArn, repository2.repositoryArn, ...etc],
        actions: [
          "ecr:InitiateLayerUpload",
          "ecr:UploadLayerPart",
          "ecr:CompleteLayerUpload",
          "ecr:BatchCheckLayerAvailability",
          "ecr:PutImage",
        ],
      })
    );

Note that I'm aware that new resources could be added to the PolicyStatement instead of adding new statements to the policy, but this results in a lot of extra complexity in the stack's implementation, and I feel that cdk could do an optimization here instead.

Additionally, there are places like:

Use Case

The main issue is that the resulting CloudFormation template ends up huge, and runs over some internal limits as mentioned in #11562 (comment) and #11562 (comment)

Proposed Solution

My initial idea is to add a post-processor similar to the one in:

It would detect if the generated policy can be optimized by merging similar resources or actions together.

Other

I think this shouldn't be a breaking change if implemented correctly. Also I'm not sure if it requires any changes, or if it affects the IAM Statement Changes interactive prompt.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

This is a 🚀 Feature Request