IAM Managed Policy

[sdole]

• I'm submitting a ...

  • 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior?
  In python, I have not found any way to create a Managed Policy and attach to a role. I see a ManagedPolicy class that seems to be a place holder.

The Role.add_managed_policy() method takes a IManagedPolicy and no documentation on how to create an instance of it.

Finally, it looks like the low level Resource CfnManagedPolicy may work, but, it cannot be easily added to Constructs such as Lambda

• What is the expected behavior (or behavior of feature suggested)?
  There needs to be some way to create a ManagedPolicy

• What is the motivation / use case for changing the behavior or adding this feature?
  I want to be able to create a Lambda function in CDK and attach a new role on it. The role should contain a newly created Managed Policy

• Please tell us about your environment:

  • CDK CLI Version: 0.36
  • Module Version: xx.xx.xx
  • OS: [all | Windows 10 | OSX Mojave | Ubuntu | etc... ]
  • Language: [all | TypeScript | Java | Python ]

• Other information (e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. associated pull-request, stackoverflow, gitter, etc)

[rix0rrr]

You're probably looking for this:

https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-iam.ManagedPolicy.html#static-fromawsmanagedpolicynamemanagedpolicyname

[NGL321]

Hi @sdole,

We currently do not support creating Customer Managed Policies in the CDK. This is a feature we plan to implement eventually.
This seems to be a part of a larger gap that is going to be tracked here: #3128. This feature in particular is logged here: #2974

If this answered your question, since there is a duplicate feature request, I will close this issue out.

Thanks for your patience!

[sdole]

That is totally fine and thanks. Is there a listing of gaps? Else, what could be an easy way to find gaps? I ask because I want to decide whether to promote this in our company or not. Thanks.

[NGL321]

@sdole Thank you for asking! There is not presently a good way of listing gaps. However, I am making a concerted effort to go through all issues, new and old, to apply the "gap" label where relevant.
This would make a label-search of github issues that you could see all the construct library gaps (that is also distinct from the feature-request search).