aws-iam: policy statements are trying to validate tokens

[cheng-kevin]

❓ General Issue

Are IAM PolicyDocument Actions limited to string types? I am trying to reference a cloudformation parameter as my action.

 new iam.PolicyStatement({
      actions: [
         core.Fn.join('',
          [ core.Fn.ref(Parameters.myparameter, ':*' )]
      ],
      effect: iam.Effect.ALLOW,
      resources: [ '*' ] 
    }
)

The Question

Environment

• CDK CLI Version:
• Module Version:
• Node.js Version:
• OS:
• Language (Version):

Other information

[skinny85]

Hey @cheng-kevin ,

looks like you're right - while usually in the CDK you can do things like:

        const myParameter = new cdk.CfnParameter(this, 'Param');
        new iam.PolicyStatement({
                actions: [
                    `${myParameter.value}:*`,
                ],
                effect: iam.Effect.ALLOW,
                resources: [ '*' ]
            }
        );

This results in the following error:

Action '${Token[Param.Ref.20]}:*' is invalid. An action string consists of a service namespace, a colon, and the name of an action. Action names can include wildcards.

Probably this code should check if action is a Token using the Token.isUnresolved() method.

[rix0rrr]

What @skinny85 said is accurate

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.