Code that was working is suddenly failing on an IAM mismatch. We suspect a CDK update is the culprit.
Currently working to isolate it. The "proof" is in the Error Log section below.
Have reproduced the error using a minimum of independent code, shown below.

Reproduction Steps

const role = new Role(this, 'myRole', {
  assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
})

const param = new StringParameter(this, 'myParam', {
  stringValue: 'myValue',
  parameterName: '/path/to/parameter',
})

const readSsmStatement = new PolicyStatement({ effect: Effect.ALLOW })
readSsmStatement.addActions('ssm:DescribeParameters', 'ssm:GetParameter')
readSsmStatement.addResources(param.parameterArn)

role.addToPolicy(readSsmStatement)

Deploy this and you will see the double // in the Resource section of the policy statement

Error Log

AccessDeniedException: User: [redacted] is not authorized to perform: ssm:GetParameter on resource: arn:aws:ssm:us-west-2:[redacted]:parameter/x/y/z

Where the generated IAM role contains:
{
"Action": [
"ssm:DescribeParameters",
"ssm:GetParameter"
],
"Resource": "arn:aws:ssm:us-west-2:[redacted]:parameter//x/y/z"
"Effect": "Allow"
}

Note the double // in the parameter ARN. Manually edititng the role in the console fixes the problem. We cannot, however get CDK to generate it properly.

Environment

• CLI Version :aws-cli/1.16.107 Python/2.7.16 Darwin/18.7.0 botocore/1.12.97
• Framework Version:1.15.0
• OS :MacOS on desktop and Ubuntu in CI pipeline (both affected)
• Language :typescript

Other

This is 🐛 Bug Report