-
Notifications
You must be signed in to change notification settings - Fork 4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(iam): support adding permissions to imported roles #2805
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just some tiny comments/questions.
// FIXME: Add warning that we're ignoring this | ||
public attachInlinePolicy(policy: Policy): void { | ||
this.attachedPolicies.attach(policy); | ||
policy.attachToRole(this); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The methods addToPolicy
and attachInlinePolicy
are the same as in the Role
class. I wonder whether we could use inheritance here to remove the duplication.
], | ||
Version: "2012-10-17" | ||
}, | ||
Roles: [ "MyRole" ] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure I understand this test. Where does the Role with the logical ID MyRole
come from?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh wait, is this the physical name of the Role? Does that work in CFN?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
CFN is just doing a put-role-policy call with this parameter.
Now create a Policy and attach it to imported roles as well.
This will only work for imported roles in the same account. If you
need to reference roles in other accounts without trying to add
these policy statements, use an
AwsPrincipal
.Relates to #2381, #2651, #2652, #2662.
Pull Request Checklist
design
folderBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.