IAM: ForAllValues/ForAnyValue array arguments converted to string if array has only one element
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
- [x] I've gone though the [User Guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html) and the [API reference](https://docs.aws.amazon.com/cli/latest/reference/)
- [x] I've searched for [previous similar issues](https://github.com/aws/aws-cli/issues) and didn't find any solution
**Describe the bug**
When using IAM array conditions `ForAllValues` or `ForAnyValue` with one element array, the array is converted to string.
**SDK version number**
2.2.44
**Platform/OS/Hardware/Device**
Linux
**To Reproduce (observed behavior)**
```shell
aws iam create-role --role-name foo2 --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Federated":"arn:aws:iam::012345678910:oidc-provider/token.actions.githubusercontent.com"},"Action":"sts:AssumeRoleWithWebIdentity","Condition":{"StringEquals":{"token.actions.githubusercontent.com:aud":"sts.amazonaws.com"},"ForAnyValue:StringEquals":{"token.actions.githubusercontent.com:sub":["foo"]}}}]}'
{
"Role": {
"Path": "/",
"RoleName": "foo2",
"RoleId": "AROAWNTAAAAAAAA7BOJWT",
"Arn": "arn:aws:iam::012345678910:role/foo2",
"CreateDate": "2021-12-01T13:39:47+00:00",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::012345678910:oidc-provider/token.actions.githubusercontent.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
},
"ForAnyValue:StringEquals": {
"token.actions.githubusercontent.com:sub": [
"foo"
]
}
}
}
]
}
}
}
aws iam get-role --role-name foo2
{
"Role": {
"Path": "/",
"RoleName": "foo2",
"RoleId": "AROAWNTAAAAAAAA7BOJWT",
"Arn": "arn:aws:iam::012345678910:role/foo2",
"CreateDate": "2021-12-01T13:39:47+00:00",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::012345678910:oidc-provider/token.actions.githubusercontent.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
},
"ForAnyValue:StringEquals": {
"token.actions.githubusercontent.com:sub": "foo"
}
}
}
]
},
"MaxSessionDuration": 3600,
"RoleLastUsed": {}
}
}
```
We can see that
```
"ForAnyValue:StringEquals": {
"token.actions.githubusercontent.com:sub": [
"foo"
]
}
```
is not equal to
```
"ForAnyValue:StringEquals": {
"token.actions.githubusercontent.com:sub": "foo"
}
```
**Expected behavior**
Result after `create-role` is equal to the result after `get-role` and equal to the actual role policy document
Contributor guide
Assessment
This issue has not been assessed yet.