aws / aws/aws-cdk

IAM: Role Trust Relationships cannot be extended with multiple principals

Open
#27,006 11 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-iam documentation feature-request p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

The Trust Relationships of a Role cannot be extended with multiple principals. As example I included this configuration (which is possible from AWS-console)

![image](https://github.com/aws/aws-cdk/assets/26426283/a40ee520-a0c7-4b1c-b062-1673eb205999)

### Expected Behavior

The Trust Relationships can contain multiple principals

### Current Behavior

While Deployment I'm getting this errors:

" A PolicyStatement used in an identity-based policy cannot specify any IAM principals" and "A PolicyStatement used in an identity-based policy must specify at least one resource"

### Reproduction Steps

see this code as example:

![image](https://github.com/aws/aws-cdk/assets/26426283/f7db3d2d-9308-4c88-b046-75383aab8c88)

I tried also with this:

![image](https://github.com/aws/aws-cdk/assets/26426283/8abfe5bd-cdfe-4e79-8643-ca41a17ba20d)

but I got this errors:

![image](https://github.com/aws/aws-cdk/assets/26426283/e237088b-bb7f-4b57-9674-dcdcd8e742a5)

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

aws-cli/2.13.12 Python/3.11.4 Windows/10 exe/AMD64 prompt/off

### Framework Version

_No response_

### Node.js Version

9.5.1

### OS

Windows

### Language

Java

### Language Version

Java 17

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported multiple-principal role trust relationship with the Java example and compare it with the equivalent AWS Console configuration. Confirm that deployment preserves all principals in the trust relationship and no identity-policy principal or missing-resource errors occur.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
authorization, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.