aws / aws/aws-cdk

Role: Python type checking fails on Role is not assignable to IRole

Open
#37,501 6 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-iam bug effort/medium p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

I'm using `ty` for type checking my python cdk code. There's an issue with the following:
```python
error[invalid-assignment]: Object of type `Role` is not assignable to `IRole`
--> cdk_stack.py:74:15
|
74 | role: iam.IRole = iam.Role(
| _______________---------___^
| | |
| | Declared type
75 | | self,
76 | | "MyRole",
77 | | assumed_by=iam.ServicePrincipal("lambda.amazonaws.com"),
78 | | role_name="MyRole",
79 | | )
| |_________^ Incompatible value of type `Role`
80 |
|
info: rule `invalid-assignment` is enabled by default

Found 1 diagnostic
```
The `Role` class implements
```python
@jsii.member(jsii_name="grantAssumeRole")
def grant_assume_role(self, identity: "IPrincipal") -> "Grant":
...
```
Whereas the `IRole` protocol has this:
```python
@jsii.member(jsii_name="grantAssumeRole")
def grant_assume_role(self, grantee: "IPrincipal") -> "Grant":
```

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

N/A

### Expected Behavior

I expect the type checker to be happy and let me assign iam.Role() to a variable typed with iam.IPrincipal.

### Current Behavior

Currently the type checker `ty` reports this as an error, because of the difference in the argument defined in the `grant_assume_role()` function.

### Reproduction Steps

```python
from aws_cdk import Stack
from aws_cdk import aws_iam as iam

class CdkStack(Stack):
def __init__(self, scope, construct_id, **kwargs):
super().__init__(scope, construct_id, **kwargs)
role: iam.IRole = iam.Role(
self, "MyRole", assumed_by=iam.ServicePrincipal("lambda.amazonaws.com"), role_name="MyRole"
)
```
Run `ty check` on the code, and notice the reported errors.

### Possible Solution

Rename the Role.grant_assume_role() function parameter to make Role compatible with the IRole protocol.

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.246.0

### AWS CDK CLI version

2.1104.0 (build 203898c)

### Node.js Version

v22.12.0

### OS

Pop!_OS 24.04 LTS, Linux 6.18.7-76061807-generic x86_64 GNU/Linux

### Language

Python

### Language Version

Python 3.12.3

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the cdk_stack.py reproduction and run ty check to confirm the invalid-assignment diagnostic. Compare the shown Role and IRole grant_assume_role declarations, then make the parameter naming compatible so the iam.Role() assignment succeeds without the reported error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.