iam: Grants only work on IAM objects, not arbitrary principals

[rix0rrr]

# Works
bucket.grantReadWrite(lambda.role)

# Does not work
bucket.grantReadWrite(new ArnPrincipal('arn:aws:...'));

From the point of view of the user, it makes sense to be able to add a grant to a principal, because that's what you do in IAM.

Right now, this grantReadWrite() uses

• identity.addToPolicy()
• identity.principal

The addToPolicy() call should be a no-op. Better yet, it should probably return true|false on whether it did something, and if it returns false the permissions should be added on the resource instead of on the identity. This makes most use cases just work.

While we're at it:

# Should actually also work
bucket.grantReadWrite(lambda)

[rix0rrr]

This came up in #49

[rix0rrr]

Came up again while wanting to write the following code:

bucket.grantPut(new AccountPrincipal('12345'));

Doesn't work, because AccountPrincipal is not an IAM object.

[rix0rrr]

And it should do something different for cross-account permissions (add to both resource and identity).

[rix0rrr]

Came up again when @leepa was working on a workshop:

        bucket.grantRead(new ArnPrincipal("arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity " + webDistribution.getId()));

[rix0rrr]

Another one that came up on Gitter:

In the ECR Repository construct, grantPull expects an IPrincipal. But how can I grant everyone in the org pull access? In classic cfn it's a Condition inside the policy.

Again a principal that is not an IAM identity, but a virtual thing which means the resource policy needs updatin'.

[Tehnix]

Is there any workarounds w.r.t. to this? Like adding it through the SDK/CLI in a post-hook? :/