(iam): composite principal not synthesizing correctly

[juweeks]

What is the problem?

behavior as of v2.4 (or maybe v2.5)- instead of composite principals synthesizing to a list, a separate statement is made for each. this can result in overflow of quota for the max number of trust principals policy length with enough principals.

Reproduction Steps

iam.Role(
      self,
      id="role_id",
      assumed_by=iam.CompositePrincipal(
          iam.ArnPrincipal #1,
          iam.ArnPrincipal #2,
          iam.ArnPrincipal #3,
      ),
      max_session_duration=1,
      role_name="MyCompositeTrust"
)

What did you expect to happen?

trust policy look like this:

{
    "Action": "sts:AssumeRole",
    "Effect": "Allow",
    "Principal": {"AWS": [iam.ArnPrincipal #1, iam.ArnPrincipal #2, iam.ArnPrincipal #3]}
}

What actually happened?

trust policy looks like this:

{
    "Action": "sts:AssumeRole",
    "Effect": "Allow",
    "Principal": {"AWS": iam.ArnPrincipal #1}
},
{
    "Action": "sts:AssumeRole",
    "Effect": "Allow",
    "Principal": {"AWS": iam.ArnPrincipal #2}
},
{
    "Action": "sts:AssumeRole",
    "Effect": "Allow",
    "Principal": {"AWS": iam.ArnPrincipal #3}
}

CDK CLI Version

2.10.0 (build e5b301f)

Framework Version

No response

Node.js Version

v14.17.1

OS

Mac 12.0.1

Language

Python

Language Version

Python 3.9.9

Other information

since there is a fairly low quota on the max statements in a trust policy, this breaks very easily with a decent amount of trust principals.

[ryparker]

Hey @juweeks 👋🏻 Thanks for reporting this.

We're aware of the shortcomings in policy generation and are working hard to resolve this.

Related:
#18167
#18293
#16350
#18457

[rix0rrr]

Can you please clarify: are you running into a maximum NUMBER of trust principals, or are you running into a POLICY LENGTH limit?

[juweeks]

Well, I THOUGHT/SWORE it was max number of trust principals. But when I replicate the error, it shows a policy length limit issue.

Cannot exceed quota for ACLSizePerRole: 2048 (Service: AmazonIdentityManagement; Status Code: 409; Error Code: LimitExceeded; Request ID: xxxx; Proxy: null)

And since I can't find any limits anywhere regarding number of trust principals, let's go with POLICY LENGTH limit...

Also just noticed that there is an adjustable service quota for role trust policy length. Still no substitute for properly synthesizing an array of principals, but a temp fix nonetheless.

[iainbowman]

We are seeing the same behaviour with aws-cdk v1.144.0 and Python 3.7.9

[ytsipun]

+1
I think our problem is related.
After updating CDK from 1.123 to 1.144.0 we're losing a principal as the diffs show.
Code:

    new cloudfront.experimental.EdgeFunction(
...
        role: new iam.Role(this, 'DatadomeLambdaEdgeRole', {
          assumedBy: new iam.CompositePrincipal(
            new iam.ServicePrincipal('lambda.amazonaws.com'),
            new iam.ServicePrincipal('edgelambda.amazonaws.com'),
          ),

Diffs:

│   │ Resource                               │ Effect │ Action         │ Principal                                                    │ Condition │
├───┼────────────────────────────────────────┼────────┼────────────────┼──────────────────────────────────────────────────────────────┼───────────┤
│ - │ ${Datadome/DatadomeLambdaEdgeRole.Arn} │ Allow  │ sts:AssumeRole │ Service:edgelambda.amazonaws.com                             │           │
│   │                                        │        │                │ Service:lambda.amazonaws.com                                 │           │
├───┼────────────────────────────────────────┼────────┼────────────────┼──────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Datadome/DatadomeLambdaEdgeRole.Arn} │ Allow  │ sts:AssumeRole │ Service:lambda.amazonaws.com                                 │          

[~] AWS::IAM::Role Datadome/DatadomeLambdaEdgeRole DatadomeDatadomeLambdaEdgeRole711ABAD7 
 └─ [~] AssumeRolePolicyDocument
     └─ [~] .Statement:
         └─ @@ -3,10 +3,7 @@
            [ ]   "Action": "sts:AssumeRole",
            [ ]   "Effect": "Allow",
            [ ]   "Principal": {
            [-]     "Service": [
            [-]       "lambda.amazonaws.com",
            [-]       "edgelambda.amazonaws.com"
            [-]     ]
            [+]     "Service": "lambda.amazonaws.com"
            [ ]   }
            [ ] },
            [ ] {

[rix0rrr]

@ytsipun from the opening brace at the bottom I notice your diff isn't complete. Is there a chance that the next part of the diff adds a new statement with the edgelambda.amazonaws.com that's being removed from the statement you are showing?

[ytsipun]

@rix0rrr, seems like we've missed it - it was added separately.

    "DatadomeDatadomeLambdaEdgeRole711ABAD7": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              }
            },
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "edgelambda.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        },

So yeah it's definitely related to this issue.

[rix0rrr]

This is indeed a change that's coming from a code change we recently released. It will not cause any difference in behavior though, the two policy document forms are equivalent. Your principal is not lost, it's just somewhere else.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.