Describe the bug

When a Secret is created and then passed to a cross-env stack (provided the secret has a specified physical name), its internal arnForPolicies is its partial ARN without the 6-character suffix. This is wrong, as the generated policies from e.g. grantRead cannot use the partial ARN as is - they have to append -?????? to it.

Expected Behavior

When doing Secret.grantRead in a cross-environment stack, the resulting CF template contains the partial ARN of the secret followed by -??????.

Current Behavior

The partial ARN is used as is.

Reproduction Steps

Here's a simple Python app:

import os
import aws_cdk as cdk
from aws_cdk import aws_iam as iam, aws_secretsmanager as sm, aws_ssm as ssm
​
app = cdk.App()
​
root_env = cdk.Environment(
    account=os.environ["CDK_DEFAULT_ACCOUNT"], region="us-east-1"
)
cross_region_env = cdk.Environment(
    account=os.environ["CDK_DEFAULT_ACCOUNT"], region="us-west-2"
)
​
producer_stack = cdk.Stack(app, "producer", env=root_env)
consumer_stack = cdk.Stack(app, "consumer", env=cross_region_env)
​
secret = sm.Secret(producer_stack, "secret", secret_name="MySecret")
role = iam.Role(consumer_stack, "role", assumed_by=iam.ServicePrincipal("foo"))
​
secret.grant_read(role)

ssm.StringParameter(consumer_stack, "parameter", string_value=secret.secret_full_arn)
​
app.synth()

Relevant excerpts of the synthed template of the consumer:

  "roleDefaultPolicy7C980EBA": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": [
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetSecretValue"
       ],
       "Effect": "Allow",
       "Resource": {
        "Fn::Join": [
         "",
         [
          "arn:",
          {
           "Ref": "AWS::Partition"
          },
          ":secretsmanager:us-east-1:574067550520:secret:MySecret"
         ]
        ]
       }
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "roleDefaultPolicy7C980EBA",

The value of secretFullArn evaluates to the partial ARN, which is probably related.

  "parameter76C24FC7": {
   "Type": "AWS::SSM::Parameter",
   "Properties": {
    "Type": "String",
    "Value": {
     "Fn::Join": [
      "",
      [
       "arn:",
       {
        "Ref": "AWS::Partition"
       },
       ":secretsmanager:us-east-1:574067550520:secret:MySecret"
      ]
     ]
    }
   },
   "Metadata": {
    "aws:cdk:path": "consumer/parameter/Resource"
   }
  }
 },

Possible Solution

No response

Additional Information/Context

In addition, the secret's secretFullArn prop evaluates to the partial ARN at synth time (in the consumer stack, that is).

CDK CLI Version

2.45.0

Framework Version

No response

Node.js Version

18.9.0

OS

Linux

Language

Python

Language Version

No response

Other information

No response