CompositePrincipal does not support conditions #1578
Description
I am trying to reproduces the following Cloudformation Template with CDK:
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sts:AssumeRole"
],
"Principal": {
"AWS": [
"arn:aws:iam::<account>:role/MasterRole",
"arn:aws:iam::<account>:role/AccountOwner"
]
}
},
{
"Effect": "Allow",
"Action": [
"sts:AssumeRoleWithSAML"
],
"Principal": {
"Federated": "arn:aws:iam::<account>:saml-provider/SAMLIDP"
},
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
},
Either of those (Federated or Arn) work just fine but I am unable to combine them with CompositePrincipal because there is no support for Conditions: feat(iam): CompositePrincipal and allow multiple principal types #1377
The Condition is in a different scope so I don't understand why this would be not possible.
new iam.CompositePrincipal(new iam.FederatedPrincipal(
`arn:aws:iam::${props.account.account}:saml-provider/SAMLIDP`, {
"StringEquals": [{"SAML:aud": "https://signin.aws.amazon.com/saml"}],
}, "sts:AssumeRoleWithSAML"
),
new iam.ArnPrincipal(`arn:aws:iam::${props.default.rootAccount}:saml-provider/MasterRole`),
new iam.ArnPrincipal(`arn:aws:iam::${props.default.rootAccount}:saml-provider/AccountOwner`)
)