aws / aws/aws-cdk

(aws_iam.PolicyDocument): Method 'fromJson(obj)' only takes parent 'Statement' JSON element

Open
#29,975 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-iam bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Method `fromJson()` from [aws_iam.PolicyDocument](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_iam.PolicyDocument.html#static-fromwbrjsonobj) ignores `Id` and `Version` parent elements of a JSON Policy text, taking only the `Statement` and its nested elements.

>
newPolicyDocument.addStatements(...obj.Statement.map((s: any) => PolicyStatement.fromJson(s)));
return newPolicyDocument;
}

https://github.com/aws/aws-cdk/blob/v2.137.0/packages/aws-cdk-lib/aws-iam/lib/policy-document.ts#L61

### Expected Behavior

Method `fromJson()` to accept all the JSON elements passed as an input.

### Current Behavior

When using the method, it only considers `Statement` element (and its sub elements) and auto generate `Version` one. During this process, `Id` is ignored and the synth'ed template doesn't have any `Id` element in the Policy Document.

### Reproduction Steps

Create any IAM Policy from a JSON text (with `Version` and `Id` elements included) like below:

```
const myJsonText ={
"Version": "2012-10-17",
"Id": "KMS-Key-Policy-Example",
"Statement": [
{
"Sid": "Example SID",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

export class testStack extends Stack {
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, props);

const myPolicyTest = iam.PolicyDocument.fromJson(myJsonText);

const key = new kms.Key(this, "myKMSkey",
{
policy: myPolicyTest,
});

}
}

```

The generated policy does not have `Id` element. `"Version": "2012-10-17"` is automatically generated.

```
"myKMSkey6B023671": {
"Type": "AWS::KMS::Key",
"Properties": {
"KeyPolicy": {
"Statement": [
{
"Action": "kms:*",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Resource": "*",
"Sid": "Example SID"
}
],
"Version": "2012-10-17"
}
},
"UpdateReplacePolicy": "Retain",
"DeletionPolicy": "Retain",
"Metadata": {
"aws:cdk:path": "KmsKeyMissingIdTsStack/myKMSkey/Resource"
}
},
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

All supported versions, including latest 2.139.0

### Framework Version

_No response_

### Node.js Version

20

### OS

Mac

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at packages/aws-cdk-lib/aws-iam/lib/policy-document.ts, especially PolicyDocument.fromJson(), and trace how the input object is converted into a new policy document. Add regression coverage for preserving the input’s Id and Version alongside Statement, and confirm the synthesized policy contains those values.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authorization, cloud, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.