(aws-iam): PermissionsBoundary Not Added to Custom Resource roles

[joel-aws]

When applying a Permissions Boundary to a stack, not all roles in the CFn include PermissionsBoundary.

Reproduction Steps

from aws_cdk import core, aws_iam as iam, aws_s3 as s3

app = core.App()

class SupportFilesStack(core.Stack):
    def __init__(self, scope: core.Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        generic_role = iam.Role(
            self, "generic", assumed_by=iam.ServicePrincipal("lambda")
        )

        support_files_bucket = s3.Bucket(
            self,
            "support-files",
            removal_policy=core.RemovalPolicy.DESTROY,
            auto_delete_objects=True,
        )
        support_files_bucket.grant_read(generic_role)

        self.permission_boundary = iam.ManagedPolicy(
            self,
            "pb",
            statements=[
                iam.PolicyStatement(
                    effect=iam.Effect.ALLOW, actions=["*"], resources=["*"]
                )
            ],
        )

stack = SupportFilesStack(app, "SupportFiles")

iam.PermissionsBoundary.of(stack).apply(stack.permission_boundary)

app.synth()

What did you expect to happen?

In the outputted CFn, I expected all roles to have their Permissions Boundary set.

What actually happened?

Two roles were created: one defined and the other automatically created as a result of setting auto_delete_objects=True in the S3 construct. Only the first role had the Permissions Boundary set; the second did not.

Environment

• CDK CLI Version : 1.91.0

Other

As pointed out by @ottokruse in #3242 (comment), you can work around this by creating an aspect that checks the following conditions:

def visit(self, node: core.IConstruct):
    if (
        core.CfnResource.is_cfn_resource(node)
        and node.cfn_resource_type == "AWS::IAM::Role"
    ):
        pass

---

This is 🐛 Bug Report

[robertd]

@joel-aws I believe it's because the role attached to the custom resource is not actually an iam.Role. A raw CfnResource is used to create the role.

Reference: #12323 (comment)

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.