(amplify-alpha): The default created role is empty

[johnf]

Describe the bug

When I create an amplify app, the associated role has no policies.

Expected Behavior

If I do the same thing in the web interface it creates a role with the managed policy AdministratorAccess-Amplify attached

Current Behavior

The role has no policies

Reproduction Steps

    const app = new amplify.App(this, 'WebApp', {
      appName: 'web',
      platform: amplify.Platform.WEB_COMPUTE,
      sourceCodeProvider: new amplify.GitHubSourceCodeProvider({
        owner,
        repository,
        oauthToken,
      }),
});

Possible Solution

I've worked around this by manually creating and passing in a role

Additional Information/Context

No response

CDK CLI Version

2.125.0

Framework Version

No response

Node.js Version

20.11.0

OS

Linux

Language

TypeScript

Language Version

No response

Other information

No response

[johnf]

I'm happy to kick off a pull request adding the managed policy if that's a good fix

[pahud]

Thank you for the report. I am not sure if it's a good idea but feel free to submit a PR for that.

[Pr0fil3]

It's very user unfriendly, mainly for an inexperienced CDK user, that it doesn't even setup the CloudWatch log roles for Web Compute Apps.

In case anyone else with as little experience as me stumbles upon this, here's a quick and dirty way to setup the CloudWatch log roles to be able to debug your deployed app.

    const app = new amplify.App(...)
    app.grantPrincipal.addToPrincipalPolicy(
      new PolicyStatement({
        actions: ['logs:CreateLogStream', 'logs:CreateLogGroup', 'logs:DescribeLogGroups', 'logs:PutLogEvents'],
        resources: ['*'],
      }),
    );