fix(iam): withConditions overrides Principal actions #28510
Conversation
github-actions
bot
added
bug
aws-cdk-automation
added
the
pr/needs-community-review
aws-cdk-automation
added
pr/needs-maintainer-review
| @@ -264,6 +264,18 @@ export class PrincipalWithConditions extends PrincipalAdapter { | |||
| this.additionalConditions = conditions; | |||
| } | |||
|
|
|||
| public addToAssumeRolePolicy(doc: PolicyDocument) { | |||
| // eslint-disable-next-line @typescript-eslint/no-require-imports | |||
| const adapter: typeof import('./private/policydoc-adapter') = require('./private/policydoc-adapter'); | |||
There was a problem hiding this comment.
Ok, I'll ask the question: why are we doing this weird import here? I assume something is stopping us from importing MutatingPolicyDocumentAdapter the normal way?
There was a problem hiding this comment.
To prevent a circular dependency on imports (it seems on PolicyDocument) as done here.
I added a comment to clarify.
There was a problem hiding this comment.
Perfect thanks. My next comment was going to be that if I'm confused, so will people who look at the code in the future!
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
aws-cdk-automation
removed
the
pr/needs-maintainer-review
mergify
bot
dismissed
kaizencc’s stale review
Pull request has been modified.
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Calling `withConditions` after `withSessionTags` will override the existing `sts:TagSession` action for the statement. This implementation fixes the issue. Closes aws#28426. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Calling
withConditionsafterwithSessionTagswill override the existingsts:TagSessionaction for the statement.This implementation fixes the issue.
Closes #28426.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license