aws-iam: Calling grant methods with immutable role fails silently

[willdady]

Describe the bug

Calling grantEncryptDecrypt on a KMS key when passing an immutable role fails silently. No errors or warning are shown during synthesis.

    const myRole = iam.Role.fromRoleArn(
      this,
      "MyRole",
      "arn:aws:iam::999999999999:role/my-role",
      { mutable: false }
    );

    const myKey = new kms.Key(this, "MyKey");

    myKey.grantEncryptDecrypt(myRole); // This should be a build-time error as role is marked as immutable

Expected Behavior

Calling a grant* methods with an immutable role should raise an error, or at a minimum a warning, during synthesis. It's unexpected behaviour that calling grantEncryptDecrypt has no effect if the role has { mutable: false } set.

Current Behavior

Calling grantEncryptDecrypt as shown in the snippet above has no effect. No IAM policy is created and no errors or warnings are emitted.

Reproduction Steps

See above snippet.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.79.1

Framework Version

No response

Node.js Version

18

OS

MacOS

Language

Typescript

Language Version

No response

Other information

No response

[pahud]

I think this is by design as described here but I agree we should print warning messages at least. I am making it a p2 feature request and we welcome pull requests.

[peterwoodworth]

Thanks for reporting, closing as a duplicate of this #12188

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.