(iam): composite principal not synthesizing correctly #18774
Description
What is the problem?
behavior as of v2.4 (or maybe v2.5)- instead of composite principals synthesizing to a list, a separate statement is made for each. this can result in overflow of quota for the max number of trust principals policy length with enough principals.
Reproduction Steps
iam.Role(
self,
id="role_id",
assumed_by=iam.CompositePrincipal(
iam.ArnPrincipal #1,
iam.ArnPrincipal #2,
iam.ArnPrincipal #3,
),
max_session_duration=1,
role_name="MyCompositeTrust"
)
What did you expect to happen?
trust policy look like this:
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {"AWS": [iam.ArnPrincipal #1, iam.ArnPrincipal #2, iam.ArnPrincipal #3]}
}
What actually happened?
trust policy looks like this:
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {"AWS": iam.ArnPrincipal #1}
},
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {"AWS": iam.ArnPrincipal #2}
},
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {"AWS": iam.ArnPrincipal #3}
}
CDK CLI Version
2.10.0 (build e5b301f)
Framework Version
No response
Node.js Version
v14.17.1
OS
Mac 12.0.1
Language
Python
Language Version
Python 3.9.9
Other information
since there is a fairly low quota on the max statements in a trust policy, this breaks very easily with a decent amount of trust principals.