iam.Role: condition parameter missing.

[angelosantos4]

Describe the feature

I noticed that the trust policy for iam-roles may have a field for Conditions: [...conditions] that can be applied directly to the Trust Policy. I understand that there is an interface to this through the external_id field that adds a condition for a 'StringEquals', {
'sts:ExternalId':
}

However there is no other point within the module to interface with the conditions. The statements on the assumeRolePolicy are private, so we cannot do:

role = iam.Role(...params)
role.assumeRolePolicy.statements[0].addCondition(customCondition)

I would like a feature that exposes a field called:
customConditions or additionalConditions that takes in Record<string, Record<string, string, string[]>> or list of conditions that are typed somehow, that can be added to the assumeRolePolicy.

Alternatively, an interface for addCondition can be exposed to the role itself to interface with the assumeRolePolicy statements to add a condition to each?

I am not too certain on whether omitting this capability is intentional, but I think there is value to providing the capabilities that the AWS UI has.

Use Case

I would like my role's trust policy to include:

Statements: [
{
    "Condition": {
                "StringLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::<aws-account-id>:role/prefix-*"
                    ]
                }
       }
}  
]

Proposed Solution

As mentioned in the feature request a parameter to the constructor that takes conditional-like snippets, or the direct parameters to the statement.addConditon(conditionParams), would suffice. Decision would have to be made on whether these conditions are applied to all statements within the assumeRolePolicy.

Alternatively, we can have a public method addConditionToPolicy(conditionParams) that applies the condition to the statements within the policy.

Other Information

I understand that there are alternate ways of having a StringLike condition to different role names, so I am not looking for an alternative solution to the particular condition:

Statements: [
{
    "Condition": {
                "StringLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::<aws-account-id>:role/prefix-*"
                    ]
                }
       }
}  
]

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

latest

Environment details (OS name and version, etc.)

linux

[ashishdhingra]

@angelosantos4 Good afternoon. Thanks for opening the issue. Could you please demonstrate your use case with a code example? Based on information provided in the issue, I'm assuming your need PrincipalWithConditions. Please check if it works for you.

Thanks,
Ashish

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.