Description
Describe the feature
I noticed that the trust policy for iam-roles may have a field for Conditions: [...conditions] that can be applied directly to the Trust Policy. I understand that there is an interface to this through the external_id field that adds a condition for a 'StringEquals', {
'sts:ExternalId':
}
However there is no other point within the module to interface with the conditions. The statements on the assumeRolePolicy are private, so we cannot do:
role = iam.Role(...params)
role.assumeRolePolicy.statements[0].addCondition(customCondition)
I would like a feature that exposes a field called:
customConditions or additionalConditions that takes in Record<string, Record<string, string, string[]>> or list of conditions that are typed somehow, that can be added to the assumeRolePolicy.
Alternatively, an interface for addCondition can be exposed to the role itself to interface with the assumeRolePolicy statements to add a condition to each?
I am not too certain on whether omitting this capability is intentional, but I think there is value to providing the capabilities that the AWS UI has.
Use Case
I would like my role's trust policy to include:
Statements: [
{
"Condition": {
"StringLike": {
"aws:PrincipalArn": [
"arn:aws:iam::<aws-account-id>:role/prefix-*"
]
}
}
}
]Proposed Solution
As mentioned in the feature request a parameter to the constructor that takes conditional-like snippets, or the direct parameters to the statement.addConditon(conditionParams), would suffice. Decision would have to be made on whether these conditions are applied to all statements within the assumeRolePolicy.
Alternatively, we can have a public method addConditionToPolicy(conditionParams) that applies the condition to the statements within the policy.
Other Information
I understand that there are alternate ways of having a StringLike condition to different role names, so I am not looking for an alternative solution to the particular condition:
Statements: [
{
"Condition": {
"StringLike": {
"aws:PrincipalArn": [
"arn:aws:iam::<aws-account-id>:role/prefix-*"
]
}
}
}
]Acknowledgements
- I may be able to implement this feature request
- This feature might incur a breaking change
CDK version used
latest
Environment details (OS name and version, etc.)
linux