-
Notifications
You must be signed in to change notification settings - Fork 4.5k
IAM: Problems sythesizing a role that can read from an SQS queue #622
Copy link
Copy link
Closed
Description
Java code:
Queue queue = new Queue(this, "source-import-queue",
QueueProps.builder()
.withQueueName("source-import")
.build());
Bucket bucket = new Bucket(this, "source-import-bucket",
BucketProps.builder()
.withBucketName("source-import")
.build());
bucket.onObjectCreated(queue);
bucket.addLifecycleRule(LifecycleRule.builder()
.withExpirationInDays(30)
.build());
PolicyStatement policyStatement = new PolicyStatement(PolicyStatementEffect.Allow);
policyStatement.addActions("ReceiveMessage", "DeleteMessage", "DeleteMessageBatch");
policyStatement.addResource(queue);
Role role = new Role(this, "source-import-queue-reader",
RoleProps.builder()
.withAssumedBy(new AccountPrincipal("12345"))
.withRoleName("source-import-queue-reader")
.build());
role.addToPolicy(policyStatement);Expected Behavior: Create a role with a policy that allows reading from the queue.
Actual Behavior:
Exception in thread "main" software.amazon.jsii.JsiiException: While synthesizing hello-cdk/source-import-queue-reader/DefaultPolicy/Resource: Trying to resolve() a Construct at /policyDocument/Statement/0/Resource
While synthesizing hello-cdk/source-import-queue-reader/DefaultPolicy/Resource: Trying to resolve() a Construct at /policyDocument/Statement/0/Resource
--- resource created at ---
at new Policy (/private/tmp/jsii-kernel-aRMZR8/node_modules/@aws-cdk/aws-iam/lib/policy.js:22:26)
at Role.addToPolicy (/private/tmp/jsii-kernel-aRMZR8/node_modules/@aws-cdk/aws-iam/lib/role.js:39:34)
at _wrapSandboxCode (/private/var/folders/x4/0pn8hl6x4kz135bdrmgdlk7xmh2tn2/T/jsii-java-runtime6462445815484053124/jsii-runtime.js:1:84495)
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels