[Python] Variadic args incorrectly passed to invoke method

[carterv]

Describe the bug
Related issue: aws/jsii#483

When attempting to use aws_cdk.aws_sqs.Queue.grant(), I get the following error:

PS C:\Users\cvandeur\PycharmProjects\CDK-UX-Study> cdk synth
Traceback (most recent call last):
  File "app.py", line 11, in <module>
    QueueViewerStack(app, "QueueViewer")
  File "C:\Users\cvandeur\AppData\Local\Programs\Python\Python37\lib\site-packages\jsii\_runtime.py", line 66, in __call__
    inst = super().__call__(*args, **kwargs)
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\cdk_ux_study\queue_viewer_stack.py", line 60, in __init__
    queue_viewer = QueueViewerConstruct(self, "QueueViewer", queue=queue)
  File "C:\Users\cvandeur\AppData\Local\Programs\Python\Python37\lib\site-packages\jsii\_runtime.py", line 66, in __call__
    inst = super().__call__(*args, **kwargs)
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\cdk_ux_study\queue_viewer_stack.py", line 45, in __init__
    queue.grant(function.role, "sqs:GetQueueAttributes")
  File "C:\Users\cvandeur\AppData\Local\Programs\Python\Python37\lib\site-packages\aws_cdk\aws_sqs\__init__.py", line 1119, in grant
    return jsii.invoke(self, "grant", [grantee, actions])
  File "C:\Users\cvandeur\AppData\Local\Programs\Python\Python37\lib\site-packages\jsii\_kernel\__init__.py", line 104, in wrapped
    return _recursize_dereference(kernel, fn(kernel, *args, **kwargs))
  File "C:\Users\cvandeur\AppData\Local\Programs\Python\Python37\lib\site-packages\jsii\_kernel\__init__.py", line 258, in invoke
    args=_make_reference_for_native(self, args),
  File "C:\Users\cvandeur\AppData\Local\Programs\Python\Python37\lib\site-packages\jsii\_kernel\__init__.py", line 115, in _make_reference_for_native
    return [_make_reference_for_native(kernel, i) for i in d]
  File "C:\Users\cvandeur\AppData\Local\Programs\Python\Python37\lib\site-packages\jsii\_kernel\__init__.py", line 115, in <listcomp>
    return [_make_reference_for_native(kernel, i) for i in d]
  File "C:\Users\cvandeur\AppData\Local\Programs\Python\Python37\lib\site-packages\jsii\_kernel\__init__.py", line 121, in _make_reference_for_native
    d.__jsii__type__ = "Object"
AttributeError: 'tuple' object has no attribute '__jsii__type__'

This error appears to be related to jsii being unable to handle tuples in _make_reference_for_native. See the linked issue for more on that.

Patching jsii locally reveals a new error (more relevant to aws_cdk):

Traceback (most recent call last):
  File "app.py", line 11, in <module>
    QueueViewerStack(app, "QueueViewer")
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\.env\lib\site-packages\jsii\_runtime.py", line 66, in __call__
    inst = super().__call__(*args, **kwargs)
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\cdk_ux_study\queue_viewer_stack.py", line 60, in __init__
    queue_viewer = QueueViewerConstruct(self, "QueueViewer", queue=queue)
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\.env\lib\site-packages\jsii\_runtime.py", line 66, in __call__
    inst = super().__call__(*args, **kwargs)
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\cdk_ux_study\queue_viewer_stack.py", line 45, in __init__
    queue.grant(function.role, "sqs:GetQueueAttributes")
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\.env\lib\site-packages\aws_cdk\aws_sqs\__init__.py", line 1119, in grant
    return jsii.invoke(self, "grant", [grantee, actions])
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\.env\lib\site-packages\jsii\_kernel\__init__.py", line 104, in wrapped
    return _recursize_dereference(kernel, fn(kernel, *args, **kwargs))
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\.env\lib\site-packages\jsii\_kernel\__init__.py", line 258, in invoke
    args=_make_reference_for_native(self, args),
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\.env\lib\site-packages\jsii\_kernel\providers\process.py", line 346, in invoke
    return self._process.send(request, InvokeResponse)
  File "C:\Users\cvandeur\PycharmProjects\CDK-UX-Study\.env\lib\site-packages\jsii\_kernel\providers\process.py", line 316, in send
    raise JSIIError(resp.error) from JavaScriptError(resp.stack)
jsii.errors.JSIIError: Expected Scalar, got ["sqs:GetQueueAttributes"]

Digging into that stack, the issue appears to with the grant() method:

    @jsii.member(jsii_name="grant")
    def grant(self, grantee: aws_cdk.aws_iam.IGrantable, *actions: str) -> aws_cdk.aws_iam.Grant:
        """Grant the actions defined in queueActions to the identity Principal given on this SQS queue resource.

        Arguments:
            grantee: Principal to grant right to.
            actions: The actions to grant.
        """
        return jsii.invoke(self, "grant", [grantee, actions])

Because variadic arguments are passed as tuples, "grant" is being given arguments in the form [grantee, (action0, action1, action2, ...)]. If the final line is changed to pass arguments as a flat list (return jsii.invoke(self, "grant", [grantee, *actions])), cdk synthesis behaves as expected.

Looking at the other stack traces in the linked issue, it's likely that this bug is present in multiple places.

To Reproduce

        queue = Queue(app, "Queue")
        function = Function(
            app,
            "QueueViewerFunction",
            code=Code.inline(LAMBDA_CODE),
            runtime=Runtime.NODE_J_S810,
            handler="index.handler",
            environment={"QUEUE_URL": queue.queue_url},
        )
        queue.grant(function.role, "sqs:GetQueueAttributes")

Expected behavior
CDK doesn't crash and properly synthesizes the IAM policy.

Version:

• Windows 10
• Python
• 0.30.0

[merlinmary]

The issue exists with aws_cdk.aws_iam.PolicyStatement().add_actions() and aws_cdk.aws_iam.PolicyStatement().add_resources() as well.

iam.PolicyStatement( effect=iam.PolicyStatementEffect.Allow ).add_actions(( "sqs:SendMessageBatch", "sqs:ReceiveMessage", "sqs:SendMessage" )).add_resources([ "arn:aws:sqs:us-east-1:xxxxxxxxx:contact_IDs_queue", "arn:aws:sqs:us-east-1:xxxxxxxxx:directories_queue" ] )

[carterv]

I've turned my suspicions to the jsii code generator for this issue. See an explanation here.

[mb-dev]

This issue also exists with step functions Parallel branch function

[carterv]

This was fixed by aws/jsii#513