Skip to content

(iam): principal conditions are not type-checked correctly #20974

@tenjaa

Description

@tenjaa

Describe the bug

When adding a permission to a lambda function, there is an error since CDK 2.30.0.
Adding a PrincipalWithConditions supports less conditions than before.

Expected Behavior

I expect, that synthing the project still works fine like in the prior version.

Current Behavior

When synthing the following error appears:

Error: PrincipalWithConditions had unsupported conditions for Lambda permission statement: [{"operator":"0","key":"StringEquals"}]. Supported operator/condition pairs: [{"operator":"ArnLike","key":"aws:SourceArn"},{"operator":"StringEquals","key":"aws:SourceAccount"},{"operator":"StringEquals","key":"aws:PrincipalOrgID"}]

Reproduction Steps

secretRotationFunction.grantInvoke(new ServicePrincipal('secretsmanager.amazonaws.com', {
      conditions: [
        {
          StringEquals: {
            'aws:SourceAccount': Accounts.MAIN.account,
          }
        }
      ]
    }));

Possible Solution

No response

Additional Information/Context

I guess the responsible change is in packages/@aws-cdk/aws-lambda/lib/function-base.ts directly below line 596 / 643 in the diff: v2.29.1...v2.30.0#diff-6cd0e14e946761622244e7c236ddb2c328b1881f050b1638897231ea27e5e62eR645.

CDK CLI Version

2.30.0

Framework Version

No response

Node.js Version

18.2.0

OS

OSX/CodeBuild

Language

Typescript

Language Version

No response

Other information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    @aws-cdk/aws-iamRelated to AWS Identity and Access ManagementbugThis issue is a bug.effort/smallSmall work item – less than a day of effortp1

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions