feat: add IAM role support for Cloud9 environment ownership

packages/@aws-cdk/aws-cloud9-alpha/lib/environment.ts

@@ -1,6 +1,6 @@
 import * as codecommit from 'aws-cdk-lib/aws-codecommit';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
-import { IUser } from 'aws-cdk-lib/aws-iam';
+import { IUser, IRole } from 'aws-cdk-lib/aws-iam';
 import * as cdk from 'aws-cdk-lib/core';
 import { Construct } from 'constructs';
 import { CfnEnvironmentEC2 } from 'aws-cdk-lib/aws-cloud9';
@@ -257,6 +257,15 @@ export class Owner {
     return { ownerArn: user.userArn };
   }
 
+  /**
+   * Make an IAM role the environment owner
+   *
+   * @param role the Role object to use as the environment owner
+   */
+  public static role(role: IRole): Owner {
+    return { ownerArn: role.roleArn };
+  }
+
   /**
    * Make the Account Root User the environment owner (not recommended)
    *

packages/@aws-cdk/aws-cloud9-alpha/test/cloud9.environment.test.ts

@@ -5,6 +5,7 @@ import * as iam from 'aws-cdk-lib/aws-iam';
 import * as cdk from 'aws-cdk-lib';
 import * as cloud9 from '../lib';
 import { ConnectionType, ImageId, Owner } from '../lib';
+import { AnyPrincipal, CfnRole, CfnUser } from 'aws-cdk-lib/aws-iam';
 
 let stack: cdk.Stack;
 let vpc: ec2.IVpc;
@@ -124,10 +125,34 @@ test('environment owner can be an IAM user', () => {
     imageId: cloud9.ImageId.AMAZON_LINUX_2,
     owner: Owner.user(user),
   });
+
+  const userLogicalId = stack.getLogicalId(user.node.defaultChild as CfnUser);
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Cloud9::EnvironmentEC2', {
+    OwnerArn: {
+      'Fn::GetAtt': [userLogicalId, 'Arn'],
+    },
+  });
+});
+
+test('environment owner can be an IAM role', () => {
+  // WHEN
+  const role = new iam.Role(stack, 'Role', {
+    roleName: 'TestRole',
+    assumedBy: new AnyPrincipal(),
+  });
+  new cloud9.Ec2Environment(stack, 'C9Env', {
+    vpc,
+    imageId: cloud9.ImageId.AMAZON_LINUX_2,
+    owner: Owner.role(role),
+  });
   // THEN
+
+  const roleLogicalId = stack.getLogicalId(role.node.defaultChild as CfnRole);
+
   Template.fromStack(stack).hasResourceProperties('AWS::Cloud9::EnvironmentEC2', {
     OwnerArn: {
-      'Fn::GetAtt': ['User00B015A1', 'Arn'],
+      'Fn::GetAtt': [roleLogicalId, 'Arn'],
     },
   });
 });

packages/@aws-cdk/cli-lib-alpha/THIRD_PARTY_LICENSES

@@ -1,6 +1,6 @@
 The @aws-cdk/cli-lib-alpha package includes the following third-party software/licensing:
 
-** @jsii/check-node@1.87.0 - https://www.npmjs.com/package/@jsii/check-node/v/1.87.0 | Apache-2.0
+** @jsii/check-node@1.88.0 - https://www.npmjs.com/package/@jsii/check-node/v/1.88.0 | Apache-2.0
 jsii
 Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 
@@ -238,7 +238,7 @@ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH RE
 
 ----------------
 
-** aws-sdk@2.1446.0 - https://www.npmjs.com/package/aws-sdk/v/2.1446.0 | Apache-2.0
+** aws-sdk@2.1447.0 - https://www.npmjs.com/package/aws-sdk/v/2.1447.0 | Apache-2.0
 AWS SDK for JavaScript
 Copyright 2012-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.