From becb978029db6156ce44b22a6ee7c051eecb430b Mon Sep 17 00:00:00 2001
From: Kevin DeJong <kddejong@amazon.com>
Date: Tue, 27 Aug 2024 08:33:53 -0700
Subject: [PATCH] test assumed role

---
 .../data/schemas/other/iam/policy.json        |  3 +++
 .../resources/iam/test_resource_policy.py     | 26 +++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/src/cfnlint/data/schemas/other/iam/policy.json b/src/cfnlint/data/schemas/other/iam/policy.json
index ecfec194ea..0bbe33bed9 100644
--- a/src/cfnlint/data/schemas/other/iam/policy.json
+++ b/src/cfnlint/data/schemas/other/iam/policy.json
@@ -28,6 +28,9 @@
     {
      "pattern": "^arn:(aws|aws-cn|aws-us-gov):iam::\\d{12}:(?:root|user|group|role)"
     },
+    {
+     "pattern": "^arn:(aws|aws-cn|aws-us-gov):sts::\\d{12}:assumed-role"
+    },
     {
      "pattern": "^arn:(aws|aws-cn|aws-us-gov):iam::cloudfront:user/.+$"
     }
diff --git a/test/unit/rules/resources/iam/test_resource_policy.py b/test/unit/rules/resources/iam/test_resource_policy.py
index b56635507e..1a7ea216ae 100644
--- a/test/unit/rules/resources/iam/test_resource_policy.py
+++ b/test/unit/rules/resources/iam/test_resource_policy.py
@@ -224,3 +224,29 @@ def test_principal_wildcard(self):
             )
         )
         self.assertListEqual(errs, [])
+
+    def test_assumed_role(self):
+        validator = CfnTemplateValidator({}).evolve(
+            context=Context(functions=FUNCTIONS)
+        )
+
+        policy = {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Effect": "Allow",
+                    "Action": "*",
+                    "Resource": "arn:aws:s3:::bucket",
+                    "Principal": {
+                        "AWS": "arn:aws:sts::123456789012:assumed-role/rolename/rolesessionname"
+                    },
+                },
+            ],
+        }
+
+        errs = list(
+            self.rule.validate(
+                validator=validator, policy=policy, schema={}, policy_type=None
+            )
+        )
+        self.assertListEqual(errs, [])