[IAM] Ability to add conditions to AccountPrincipal

[robertd]

It'd be great if we can add conditions to AccountPrincipal when creating iam.Role. Currently, AccountPrincipal only accepts accountId param. We're creating an iam role for 3rd party SaaS and we need to provide a Condition property.

Other

Current workaround is using addPropertyOverride.

const role = new iam.Role(this, "role", {
  assumedBy: new iam.AccountPrincipal('1234567890')
});

let roleRef = role.node.defaultChild as iam.CfnRole;
roleRef.addPropertyOverride("AssumeRolePolicyDocument.Statement.0.Condition.StringEquals.foo”,"baz");

Resources:
  Role1EF426C6:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              AWS:
                Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - :iam::1234567890:root
            Condition:
              StringEquals:
                foo: baz
        Version: "2012-10-17"

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[rix0rrr]

Probably a wrapper principal that adds conditions will be more reusable.

[mrpackethead]

Thanks Robertd, i'm in teh same situation. ANd this will be very useful.

[nija-at]

Our current modeling of conditions on ServicePrincipal is not the right model either. If I recall correctly, adding a conditional to a ServicePrincipal looks like this -

const role = new iam.Role(this, "role", {
  assumedBy: new iam.ServicePrincipal('service-principal.amazonaws.com', {
    conditions: {
      "string:equals": {
        "sts:ExternalId": "<sts-external-id>"
      }
    }
  })
});

I propose we switch the conditional for AccountPrincipal to something like -

conditions: {
  "sts:ExternalId": {
    StringCondition.Equals: "<sts-external-id>"
  }
}

where StringCondition is an enum and has the values listed here.

[rix0rrr]

I see how this is more logical, but it deviates from what people are used to in IAM so I'm not use that'd be a great idea.

[nija-at]

Ok - I originally assumed that there was support for repeated use of the same operator - such as multiple 'StringEquals' - in the conditional. Upon trying this out, it seems I'm mistaken and there can only be one instance of a conditional per policy. I'm ok leaving the structure as is.

However, can we still model the conditional more strongly so I don't have to look at the IAM documentation to know the list of conditionals available?