(AWS Backup): Don't add AWSBackupServiceRolePolicyForBackup policy to role automatically

[delenamalan]

Describe the feature

There should be an option to prevent BackupSelection from adding the AWSBackupServiceRolePolicyForBackup policy to the provided role.

Use Case

I'm enabling AWS Backup in multiple AWS accounts using cdk-stacksets.

First, I'm creating a role in each account for backup and attaching the AWSBackupServiceRolePolicyForBackup and AWSBackupServiceRolePolicyForS3Backup policies.

Then, I'm importing this role using Role.from_role_name.

role = iam.Role.from_role_name("DailyBackupsRole")

Then I'm passing the role to add_selection:

        plan.add_selection(
            "DailyBackupsSelection",
            resources=[backup.BackupResource(resource="*")],  # all resources
            backup_selection_name="DailyBackupsSelection",
            role=role,
        )

When I run cdk synth, I get this error:

RuntimeError: TypeError: role.addManagedPolicy is not a function

The above error is caused by #8307.

Proposed Solution

Add a parameter to BackupSelection to make it optional for policies to be attached to a provided role. For example, attach_backup_policies=False.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.79.1

Environment details (OS name and version, etc.)

Mac OS 13.3.1 Python 3.7.13

[peterwoodworth]

role = iam.Role.from_role_name("DailyBackupsRole")

Is this how you've specified this in your code? If so, I'm surprised this is compiling since you also need to define the scope and id of the construct. You should just be receiving a warning if addManagedPolicy is called on an imported role

aws-cdk/packages/aws-cdk-lib/aws-iam/lib/private/imported-role.ts

Lines 70 to 72 in bbdb16a

	public addManagedPolicy(policy: IManagedPolicy): void {
	Annotations.of(this).addWarning(`Not adding managed policy: ${policy.managedPolicyArn} to imported role: ${this.roleName}`);
	}

Add a parameter to BackupSelection to make it optional for policies to be attached to a provided role. For example, attach_backup_policies=False.

There's already an option you can enable on your role when importing it: mutable

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.