Cannot create IManagedPolicy from a customer managed policy

[elexisvenator]

• I'm submitting a ...

  • 🚀 feature request

• What is the current behavior?

Role.addManagedPolicy(policy: IManagedPolicy) is the method to add managed policies to a role. However the only method to create IManagedPolicy is ManagedPolicy.fromAwsManagedPolicyName(), which only supports the AWS managed policies. There is no way to add a customer-managed policy to a role, either by its arn or by a ref to a CfnManagedPolicy.

This is a regression from 0.34.0 behaviour. In 0.34.0 you could do the following:

myRole: Role;
myPolicy: CfnManagedPolicy;
myRole.attachManagedPolicy(myPolicy.managedPolicyArn);

• What is the expected behavior (or behavior of feature suggested)?

One or more of the following methods should be added to ManagedPolicy to support more managed policy types:

ManagedPolicy.fromManagedPolicyRef(ref: IResolvable)
ManagedPolicy.fromManagedPolicyArn(arn: string)

• What is the motivation / use case for changing the behavior or adding this feature?

To support customer Managed policies.

• Please tell us about your environment:

  • CDK CLI Version: 0.35.0
  • OS: Windows 10
  • Language: TypeScript

[NGL321]

From the latest changelog entry:

iam: managedPolicyArns renamed to managedPolicies, takes return value from ManagedPolicy.fromAwsManagedPolicyName().

Is this what you are looking for?

[elexisvenator]

No, that only allows existing AWS managed policies. Previously you could use any managed policy arn, including manage policies (CfnManagedPolicy) you create in your cdk app.

[NetaNir]

You can try using addManagedPolicy:

    const role = new iam.Role(this, 'Role', {
      assumedBy: new iam.ServicePrincipal('some.domain')
    })
    role.addManagedPolicy({
      managedPolicyArn: 'managedPolicyArn'
    })

[kgregory-chariot]

One of the nice things about fromAwsManagedPolicyName is that it constructs the ARN given just the name. It would be really nice to have a similar method for customer managed policies, rather than this:

      (new iam.User(this, username, {
        userName: username
      }))
      .addManagedPolicy({
        managedPolicyArn: this.formatArn({
          service:      "iam",
          region:        "",
          resource:     "policy",
          resourceName: "BasicUserPolicy"
        })
      })

[IainCole]

I took a stab at implementing the creation / reference of customer managed policies here https://github.com/IainCole/aws-cdk/blob/ic_support_customer_managed_policy/packages/%40aws-cdk/aws-iam/lib/managed-policy.ts

It seems to work from my testing, @NGL321 if this makes sense logically I can submit a PR with tests etc.