(aws-iam): Inconsistency in resource grant permissions when importing a role using fromRoleName() and fromRoleArn()

[mrlikl]

Describe the bug

The grant permissions are producing different synth outputs/missing permissions when using fromRoleName() vs fromRoleArn()

Example -

Bug behaviour

const s3KmsKey = new Key(this, 'TestDataBucketKey')
    const bucket = new s3.Bucket(this, 'TestDataBucket', {
      encryption: s3.BucketEncryption.KMS,
      encryptionKey: s3KmsKey
    })
const role_from_name = iam.Role.fromRoleName(this, 'CDKRole', 'cdk-role')
    s3KmsKey.grantEncryptDecrypt(role_from_name)
    bucket.grantReadWrite(role_from_name)

In the resultant template, the bucket policy and KMS key policy will be missing permissions for the role. But an IAM policy will be created and attached to the role.

Expected -

const s3KmsKey = new Key(this, 'TestDataBucketKey')
    const bucket = new s3.Bucket(this, 'TestDataBucket', {
      encryption: s3.BucketEncryption.KMS,
      encryptionKey: s3KmsKey
    })
   const role_from_arn = iam.Role.fromRoleArn(
      this,
      'CDKRole',
      'arn:aws:iam::xxxxxxxxxxx:role/cdk-role'
    )
s3KmsKey.grantEncryptDecrypt(role_from_arn)
bucket.grantReadWrite(role_from_arn)

In the above example, both s3 policy and KMS policy is updated with role permissions as well as an IAM policy will be created and attached to the role.

Expected Behavior

When using fromRoleName(), resource policy as well as IAM policy be updated/modified.

Current Behavior

Resource policy is missing when using fromRoleName()

Reproduction Steps

In Description

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.114.1

Framework Version

No response

Node.js Version

18.18.2

OS

macos

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

In the resultant template, the bucket policy and KMS key policy will be missing permissions for the role. But an IAM policy will be created and attached to the role.

I can't find any missing permissions.

Can you share more details in your CFN template on which permissions are mssing?

[mrlikl]

@pahud , I have updated the replication code. When using fromRoleName(), the resultant will be

1. There will be no KMS key policy for the imported role (Only default will be there for the root).
2. No bucket policy resource will be present in template at all. When using fromRoleArn(), a bucket policy will be created with the imported role in it.
3. In both the cases (fromRoleArn and fromRoleName) an IAM policy will be present with the imported role in it.

[mrlikl]

Is this because the imported role - using fromname is expected to be in the same account ?