(aws_iam.PolicyDocument): Method 'fromJson(obj)' only takes parent 'Statement' JSON element
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Method `fromJson()` from [aws_iam.PolicyDocument](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_iam.PolicyDocument.html#static-fromwbrjsonobj) ignores `Id` and `Version` parent elements of a JSON Policy text, taking only the `Statement` and its nested elements.
>
newPolicyDocument.addStatements(...obj.Statement.map((s: any) => PolicyStatement.fromJson(s)));
return newPolicyDocument;
}
https://github.com/aws/aws-cdk/blob/v2.137.0/packages/aws-cdk-lib/aws-iam/lib/policy-document.ts#L61
### Expected Behavior
Method `fromJson()` to accept all the JSON elements passed as an input.
### Current Behavior
When using the method, it only considers `Statement` element (and its sub elements) and auto generate `Version` one. During this process, `Id` is ignored and the synth'ed template doesn't have any `Id` element in the Policy Document.
### Reproduction Steps
Create any IAM Policy from a JSON text (with `Version` and `Id` elements included) like below:
```
const myJsonText ={
"Version": "2012-10-17",
"Id": "KMS-Key-Policy-Example",
"Statement": [
{
"Sid": "Example SID",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
}
export class testStack extends Stack {
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, props);
const myPolicyTest = iam.PolicyDocument.fromJson(myJsonText);
const key = new kms.Key(this, "myKMSkey",
{
policy: myPolicyTest,
});
}
}
```
The generated policy does not have `Id` element. `"Version": "2012-10-17"` is automatically generated.
```
"myKMSkey6B023671": {
"Type": "AWS::KMS::Key",
"Properties": {
"KeyPolicy": {
"Statement": [
{
"Action": "kms:*",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Resource": "*",
"Sid": "Example SID"
}
],
"Version": "2012-10-17"
}
},
"UpdateReplacePolicy": "Retain",
"DeletionPolicy": "Retain",
"Metadata": {
"aws:cdk:path": "KmsKeyMissingIdTsStack/myKMSkey/Resource"
}
},
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
All supported versions, including latest 2.139.0
### Framework Version
_No response_
### Node.js Version
20
### OS
Mac
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start at packages/aws-cdk-lib/aws-iam/lib/policy-document.ts, especially PolicyDocument.fromJson(), and trace how the input object is converted into a new policy document. Add regression coverage for preserving the input’s Id and Version alongside Statement, and confirm the synthesized policy contains those values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- authorization, cloud, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 30/100