aws / aws/aws-cdk

IAM.Policy: policy.attachToRole is not respecting role mutability

Open
#38,103 2 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-iam bug p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

policy.attachToRole() is overly granting policies to imported roles with mutable set to false.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

policy.attachToRole() should respect the mutabliity of the imported role.

### Current Behavior

policy.attachToRole() does not respect the mutabliity of the imported role.

### Reproduction Steps

```
const importedRole = Role.fromRoleName(
this,
'LookUpRole',
'LookUpRole',
{ mutable: false },
);

const policyStatement = new PolicyStatement({
effect: Effect.ALLOW,
    actions: ['execute-api:Invoke'],
  resources: ["*"],
});

const policy = new ManagedPolicy(this, "policy", {
managedPolicyName: `testPolicy`,
description: 'an example policy',
statements: [
policyStatement
],
});

policy.attachToRole(importedRole);
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.257.0

### AWS CDK CLI version

2.1125.0

### Node.js Version

24

### OS

AL2

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing ManagedPolicy.attachToRole() with Role.fromRoleName() and the imported role's mutable: false option. Confirm the current behavior and identify the existing IAM policy or role tests covering attachment; done means an immutable imported role is not granted or modified by policy.attachToRole().

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authorization
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.