[iam] iam policies should allow passing policydocuments via props to constructor like managed policies do

[markussiebert]

Use Case

While using eks a lot i often find policy documents for certain tools maintained by the creator of the tool (as an example, aws ingress controller).
I would like to use these policy documents, and don't rewrite them. There is the function, that allows creating policy documents from json - that's fine. Then it is possible to pass the document to the managedpolicy constructor - but not to inline policys.

I see no reason why this shouldn't be allowed for policies to.

Proposed Solution

extend policy props like it's done in managed policy props and extend constructor of policy like it's done in managed policy.

aws-cdk/packages/@aws-cdk/aws-iam/lib/managed-policy.ts

Line 95 in 55e6130

readonly document?: PolicyDocument;

aws-cdk/packages/@aws-cdk/aws-iam/lib/managed-policy.ts

Line 219 in 55e6130

if (props.document) {

both lines are not included in the normal policy.

Other

If you agree, i will start to implement this and as far as i can see, there should be no negative side effects.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[rix0rrr]

What would the user code look like with your proposed solution in place?

[rix0rrr]

(In favor of this functionality in general, btw, but it depends on what the solution looks like)

[markussiebert]

ok, thats what i do at the moment:

 const albIngressIamPolicyDocument = iam.PolicyDocument.fromJson(
      require(`${__dirname}/addonAwsLoadbalancerControllerFiles/iam_policy.json`)
    );

        const albIngressPolicy = new iam.ManagedPolicy(scope, "AwsLoadbalancerControllerManagedPolicy", {
            document: albIngressIamPolicyDocument
        })

        const albIngressIamPolicyDocument = iam.PolicyDocument.fromJson(
      require(`${__dirname}/addonAwsLoadbalancerControllerFiles/iam_policy.json`)
    );

        albIngressPolicy.attachToRole(albIngressServiceAccount.role)

and i want to use Policy instead of ManagedPolicy - but it's not supported now.

p.s. the iam_policy.json comes from the AwsLoadbalancerController (included via submodules).

[markussiebert]

@rix0rrr what do you think? Can i start creating the PR?

[rix0rrr]

I was asking about what the could WOULD look like with your ideal API in place, not about your current workaround.

For example, we could pick either of the following:

const policy = Policy.fromJson(this, 'MyPolicy', '/path/to/bla.json');
albIngressServiceAccount.role.addInlinePolicy(policy);

// OR

const document = PolicyDocument.fromJson('/path/to/bla.json');
const policy = new Policy(this, 'MyPolicy', {
  document: document,
});
albIngressServiceAccount.role.addInlinePolicy(policy);

I feel like my preference would be for the 2nd one.

[markussiebert]

i also prefer the second one (as i wrote, it's like managedpolicy behaves - and i think it should be implemented the same way).

[markussiebert]

I created a PR with the changes I suggest. I implemented it like your 2nd solution (and as it's implemented in ManagedPolicy).

And sorry, if i did things wrong, it's my first PR for CDK.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[sathishpothuri]

The require option works fine, but the lint fails.
I have the below working example.

managedPolicies: [
          new ManagedPolicy(this, 'myCustomPolicy', {
            document: PolicyDocument.fromJson(JSON.parse(fs.readFileSync(`${__dirname}/../policy/mypolicy.json`, 'utf-8'))),
          }),
        ]