IAM.Policy: policy.attachToRole is not respecting role mutability
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
policy.attachToRole() is overly granting policies to imported roles with mutable set to false.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
_No response_
### Expected Behavior
policy.attachToRole() should respect the mutabliity of the imported role.
### Current Behavior
policy.attachToRole() does not respect the mutabliity of the imported role.
### Reproduction Steps
```
const importedRole = Role.fromRoleName(
this,
'LookUpRole',
'LookUpRole',
{ mutable: false },
);
const policyStatement = new PolicyStatement({
effect: Effect.ALLOW,
actions: ['execute-api:Invoke'],
resources: ["*"],
});
const policy = new ManagedPolicy(this, "policy", {
managedPolicyName: `testPolicy`,
description: 'an example policy',
statements: [
policyStatement
],
});
policy.attachToRole(importedRole);
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
2.257.0
### AWS CDK CLI version
2.1125.0
### Node.js Version
24
### OS
AL2
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start by tracing ManagedPolicy.attachToRole() with Role.fromRoleName() and the imported role's mutable: false option. Confirm the current behavior and identify the existing IAM policy or role tests covering attachment; done means an immutable imported role is not granted or modified by policy.attachToRole().
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100