aws-iam: Allow string | string[] in FederatedPrincipal assumeRoleAction #15908
Description
Allow string | string[] in FederatedPrincipal.
This is required when using cognito with principal tag mapping.
Use Case
AWS has a brief video explaining the use case here: https://www.youtube.com/watch?v=tAUmz94O2Qo
The use case is that, if a cognito user from a user pool is authenticated, then their claims can be forwarded to the policy document to allow for fine-grained access control e.g.
/**
* Policy that enables a tenant to access their entire org's data
*/
const tenantPolicy = new PolicyStatement({
sid: "AllowPrecedingKeysToDynamoDBOrganisation",
effect: Effect.ALLOW,
actions: [
"dynamodb:GetItem",
"dynamodb:Query"
],
resources: [
table.tableArn
],
conditions: {
"ForAllValues:StringLike": {
"dynamodb:LeadingKeys": [
"${aws:PrincipalTag/org}#*"
]
}
},
})In order to support deploying FederatedPrincipal policies via @aws-cdk/aws-iam which use sts:TagSession and sts:AssumeRoleWithWebIdentity currently this work around is required:
const role = new iam.Role(this, "IdentityPoolAuthRole", {
assumedBy: new iam.FederatedPrincipal(
"cognito-identity.amazonaws.com",
{
StringEquals: {
"cognito-identity.amazonaws.com:aud": identityPool.ref,
},
"ForAnyValue:StringLike": {
"cognito-identity.amazonaws.com:amr": "authenticated",
},
},
// @ts-ignore
[
"sts:AssumeRoleWithWebIdentity",
"sts:TagSession"
] as string
),
});The underlying base principal supports having the this.assumeRoleAction set as a string array, but the allowed types have been restricted on the child class
aws-cdk/packages/@aws-cdk/aws-iam/lib/principals.ts
Lines 426 to 442 in fdce08c
Proposed Solution
Is update to
public readonly assumeRoleAction: string | string[];Other
- 👋 I may be able to implement this feature request
-
⚠️ This feature might incur a breaking change
This is a 🚀 Feature Request