iam: Validate the policy statements when synthesizing policy

[zxkane]

Currently we can create policy with statements without actions and resources. However the deployment of Cloudformation stack will fail due to the 400 error of IAM API.

Per the doc of IAM policy grammar, the action and resource blocks are mandatory.

It would be nice to have a CDK validation to prevent malform statements submitted to Cloudformation to have a runtime failure.

Reproduction Steps

// create a malform policy like below,

const policy = new Policy(stack, 'Pol', { force: false });
    policy.addStatements(new PolicyStatement({
      resources: ['*'],
    }));

Error Log

Policy statement must contain actions. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 903150f5-cfd6-4db7-92ff-b8ae27065fa3)

Environment

• CLI Version : 1.35.0
• Framework Version:
• OS : macosx
• Language : ts

Other

---

This is 🐛 Bug Report

[shreyasdamle]

I tried to implement this feature and then noticed that resource block isn't allowed in trust relationship policy. So, I'm not sure if we can write a generic condition to make resource block mandatory for PolicyStatement without first checking the trust relationship. For example, in the following code, resource block isn't allowed.

      for (const a of input.lambdaFunctionAssociations) {
        if (a.lambdaFunction.role && a.lambdaFunction.role instanceof iam.Role && a.lambdaFunction.role.assumeRolePolicy) {
          a.lambdaFunction.role.assumeRolePolicy.addStatements(new iam.PolicyStatement({
            actions: [ 'sts:AssumeRole' ],
            principals: [ new iam.ServicePrincipal('edgelambda.amazonaws.com') ],
          }));
        }
      }