lambda: log retention policy is created when log retention role is provided

[gkaskonas]

Describe the bug

When creating a lambda function, passing an existing roleARn should be enough to make it work. However, it keeps creating a policy and attaching it to the role. Why is that the case?

Expected Behavior

Do not create any policies

Current Behavior

Creates another policy and attaches it to the role provided

Reproduction Steps

Create a lambda function with logRetentionRole prop

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.100.0

Framework Version

No response

Node.js Version

v18

OS

macOS

Language

TypeScript

Language Version

v5.2.2

Other information

No response

[gkaskonas]

https://github.com/aws/aws-cdk/blob/61be7a659f22e7ff3df255fc9542214135d07d5e/packages/aws-cdk-lib/aws-logs/lib/log-retention.ts#L159C5-L159C13
This should only be called if the role is not provided

[peterwoodworth]

It should be called regardless. If you don't want permissions to be added when passing in a role to a construct, call https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_iam.Role.html#withoutwbrpolicywbrupdatesoptions

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.