fix(iam): withConditions overrides Principal actions (aws#28510)

Calling `withConditions` after `withSessionTags` will override the existing `sts:TagSession` action for the statement. This implementation fixes the issue. Closes aws#28426. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
paulhcsun · Jan 5, 2024 · 454ce16 · 454ce16
1 parent c050f6d
commit 454ce16
Show file tree

Hide file tree

Showing 11 changed files with 499 additions and 1 deletion.
diff --git a/...tags.js.snapshot/PrincipalWithConditionAndTagsDefaultTestDeployAssertA5074573.assets.json b/...tags.js.snapshot/PrincipalWithConditionAndTagsDefaultTestDeployAssertA5074573.assets.json
diff --git a/...gs.js.snapshot/PrincipalWithConditionAndTagsDefaultTestDeployAssertA5074573.template.json b/...gs.js.snapshot/PrincipalWithConditionAndTagsDefaultTestDeployAssertA5074573.template.json
diff --git a/...work-integ/test/aws-iam/test/integ.principal-with-conditions-and-tags.js.snapshot/cdk.out b/...work-integ/test/aws-iam/test/integ.principal-with-conditions-and-tags.js.snapshot/cdk.out
diff --git a/...with-conditions-and-tags.js.snapshot/integ-principal-with-conditions-and-tags.assets.json b/...with-conditions-and-tags.js.snapshot/integ-principal-with-conditions-and-tags.assets.json
diff --git a/...th-conditions-and-tags.js.snapshot/integ-principal-with-conditions-and-tags.template.json b/...th-conditions-and-tags.js.snapshot/integ-principal-with-conditions-and-tags.template.json
@@ -0,0 +1,66 @@
+{
+ "Resources": {
+  "TestRole25D98AB21": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": [
+        "sts:AssumeRole",
+        "sts:TagSession"
+       ],
+       "Condition": {
+        "StringLike": {
+         "aws:PrincipalTag/owner": "foo"
+        },
+        "Bool": {
+         "aws:MultiFactorAuthPresent": "true"
+        }
+       },
+       "Effect": "Allow",
+       "Principal": {
+        "AWS": "*"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    }
+   }
+  }
+ },
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}
diff --git a/...k-integ/test/aws-iam/test/integ.principal-with-conditions-and-tags.js.snapshot/integ.json b/...k-integ/test/aws-iam/test/integ.principal-with-conditions-and-tags.js.snapshot/integ.json
diff --git a/...nteg/test/aws-iam/test/integ.principal-with-conditions-and-tags.js.snapshot/manifest.json b/...nteg/test/aws-iam/test/integ.principal-with-conditions-and-tags.js.snapshot/manifest.json