Skip to content

(iam): policies created with grant interface in different stacks have the same name and overwrite each other #16074

@ProficientBell

Description

@ProficientBell

I'm importing a role in two separate stacks to add permissions to resources created in those stacks and they end up overwriting each other

Reproduction Steps

stack 1 has:

    const myRole = Role.fromRoleArn(
        this,
        'myRole',
        StringParameter.valueForStringParameter(this, 'myParam');
    );
    myLambda.grantInvoke(myRole);

stack 2 has:

    const myRole = Role.fromRoleArn(
        this,
        'myRole',
        StringParameter.valueForStringParameter(this, 'myParam');
    );
    myEventbridge.grantPutEventsTo(myRole);

What did you expect to happen?

I expected two policies to be added to the role allowing put permission to myEventbridge and allowing invoke on myLambda.

What actually happened?

I only get one of these permissions. The policy name generated is the same for both (in my case something like 'myRolePolicy3334F5F9') so one ends up overwriting the other.

I've worked around this by changing the imported role id in each stack to be unique but I find this troubling as it is extremely easy to accidentally overwrite policies set in a different stack. Shouldn't names be unique by stack?

Environment

  • **CDK CLI Version :1.117.0
  • **Framework Version:1.117.0
  • **Node.js Version:v16.3.0
  • **OS :ios
  • **Language (Version):TypeScript 4.3.4

Other


This is 🐛 Bug Report

Metadata

Metadata

Assignees

Labels

@aws-cdk/aws-iamRelated to AWS Identity and Access ManagementbugThis issue is a bug.effort/mediumMedium work item – several days of effortp1

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions