AccountPrinicpal does not support multiple accounts

[ccurrie-amzn]

If a single role is used to grant access to multiple accounts, the principal does not output correct cloudformation:

new AccountPrincipal(["123","456"])   

generates:

AWS:
    'Fn::Join':
        - ''
        -
            - 'arn:'
            -
                Ref: 'AWS::Partition'
            - ':iam::123,456:root'

It should instead generate:

AWS:
    -
        'Fn::Join':
            - ''
            -
                - 'arn:'
                -
                    Ref: 'AWS::Partition'
                - ':iam::123:root'
    -
        'Fn::Join':
            - ''
            -
                - 'arn:'
                -
                    Ref: 'AWS::Partition'
                - ':iam::456:root'

The current workaround is to build the role using property overrides.

[symroe]

I wonder if this has been regressed since this issue was closed?

Today, with aws-cdk.aws-iam==1.145.0 (using Python 3.8):

iam.Role(
    self,
    "role-name",
    assumed_by=iam.AccountPrincipal(["123","456"]),
)

Produces

AWS:
  Fn::Join:
    - ""
    - - "arn:"
      - Ref: AWS::Partition
      - :iam::123,456:root

I would expect to be able to pass a list of account IDs, as per the initial bug report and fix.

(My use case is to take a list from SSM and pass it in, but it looks like there might be other issues there)

[thieslei]

Hi Folks.

Any updates about it?

My case is very similar to @symroe, I'm receiving a list of accountIDs and a need to pass it to a ECR policy as multiple Principals.

I'm using Python 3.9 and CDK 2.8.

[thieslei]

Problem Solved.

We used the append function and save the results into a variable.

PrincipalList = []
for account in AccountList:
    PrincipalList.append(iam.AccountPrincipal(account))

Then we used the variable to forward the principals list to the PolicyStatement.

I hope it helps 👍 😁 .

[aperuru]

I ran into a similar problem, but I was able to solve this using spread operator.
The only difference is that I intended to add multiple account principals to the trusted relationship along with the service principal so that the permissions are not wide open.

    const accountsToAllowAssumedBy = ['000000000000', '111111111111'];

    const role = new iam.Role(this, 'Role', {
      roleName: 'AssumeRoleTest',
      assumedBy: new iam.CompositePrincipal(
        new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
        ...accountsToAllowAssumedBy.map((account) => new iam.AccountPrincipal(account)), //Spread Operator (...)
      ),
    });

Output:

"Role1ABCC5F0": {
   "Type": "AWS::IAM::Role",
   "Properties": {
    "RoleName": "AssumeRoleTest",
    "AssumeRolePolicyDocument": {
     "Statement": [
      {
       "Action": "sts:AssumeRole",
       "Effect": "Allow",
       "Principal": {
        "AWS": [
         "arn:aws:iam::000000000000:root",
         "arn:aws:iam::111111111111:root"
        ],
        "Service": "ecs-tasks.amazonaws.com"
       }
      }
     ],
    },
   },
  },

In your case, you can just do this

    const accountsToAllowAssumedBy = ['000000000000', '111111111111'];

    const role = new iam.Role(this, 'Role', {
      roleName: 'AssumeRoleTest',
      assumedBy: new iam.CompositePrincipal(
        ...accountsToAllowAssumedBy.map((account) => new iam.AccountPrincipal(account)), //Spread Operator (...)
      ),
    });