(aws-iam): role contains invalid characters for service roles

[ThomasSteinbach]

I have a service account role - generated by AWS itself - with about following ARN:

ssm_role_arn = "arn:aws:iam::123456789123:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"

Then

aws_iam.Role.from_role_arn(id, "my_ssm_role", role_arn=ssm_role_arn).role_name

returns aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM but should return just AWSServiceRoleForAmazonSSM instead.

Using the Role from_role_arn leads to errors on deployment, as the role name contains invalid characters like /.

---

This is 🐛 Bug Report

[ThomasSteinbach]

I have added a code change #8692 which shows, how the bug could be fixed in my opinion. Note that I am not a typescript developer and the code change is just a proposal. Hopefully ist accelerates the bugfix.

[ThomasSteinbach]

Hi @skinny85 , I've seen that you have implemented the original support for service roles. However AWS also known "service linked roles" which have a little different ARN which aws_cdk.aws_iam.Role.fromRoleArn currently can't handle. See the documentation:

https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html

The ARN format is

arn:aws:iam::*:role/aws-service-role/SERVICE-NAME.amazonaws.com/SERVICE-LINKED-ROLE-NAME-PREFIX*

In the cdk synth CloudFormation output CDK writes the whole ARN instead of just the role name, which equals to the SERVICE-LINKED-ROLE-NAME-PREFIX*. The deployment then complains about invalid characters in the role name reference.

I hope I am not too pushy, but could you please have a look, if you could extend your solution for those "service linked roles". That would be very kind, as this is a really blocker for my work with CDK. I am not able to patch this bug locally, as we are using CDK with python and I don't know how to patch, build and package the CDK library on my machine.

I have already made a proposal with #8692

[skinny85]

Replied in the PR 🙂

[rix0rrr]

Don't the docs specifically state that role paths aren't supported?