aws / aws/aws-cli

IAM: ForAllValues/ForAnyValue array arguments converted to string if array has only one element

Open
#6,584 5 comments 0 reactions 1 assignee Claimed by @kdaily View on GitHub
feature-request iam p3
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

- [x] I've gone though the [User Guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html) and the [API reference](https://docs.aws.amazon.com/cli/latest/reference/)
- [x] I've searched for [previous similar issues](https://github.com/aws/aws-cli/issues) and didn't find any solution

**Describe the bug**
When using IAM array conditions `ForAllValues` or `ForAnyValue` with one element array, the array is converted to string.

**SDK version number**
2.2.44

**Platform/OS/Hardware/Device**
Linux

**To Reproduce (observed behavior)**
```shell
aws iam create-role --role-name foo2 --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Federated":"arn:aws:iam::012345678910:oidc-provider/token.actions.githubusercontent.com"},"Action":"sts:AssumeRoleWithWebIdentity","Condition":{"StringEquals":{"token.actions.githubusercontent.com:aud":"sts.amazonaws.com"},"ForAnyValue:StringEquals":{"token.actions.githubusercontent.com:sub":["foo"]}}}]}'
{
"Role": {
"Path": "/",
"RoleName": "foo2",
"RoleId": "AROAWNTAAAAAAAA7BOJWT",
"Arn": "arn:aws:iam::012345678910:role/foo2",
"CreateDate": "2021-12-01T13:39:47+00:00",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::012345678910:oidc-provider/token.actions.githubusercontent.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
},
"ForAnyValue:StringEquals": {
"token.actions.githubusercontent.com:sub": [
"foo"
]
}
}
}
]
}
}
}
aws iam get-role --role-name foo2
{
"Role": {
"Path": "/",
"RoleName": "foo2",
"RoleId": "AROAWNTAAAAAAAA7BOJWT",
"Arn": "arn:aws:iam::012345678910:role/foo2",
"CreateDate": "2021-12-01T13:39:47+00:00",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::012345678910:oidc-provider/token.actions.githubusercontent.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
},
"ForAnyValue:StringEquals": {
"token.actions.githubusercontent.com:sub": "foo"
}
}
}
]
},
"MaxSessionDuration": 3600,
"RoleLastUsed": {}
}
}

```
We can see that
```
"ForAnyValue:StringEquals": {
"token.actions.githubusercontent.com:sub": [
"foo"
]
}
```
is not equal to
```
"ForAnyValue:StringEquals": {
"token.actions.githubusercontent.com:sub": "foo"
}
```
**Expected behavior**
Result after `create-role` is equal to the result after `get-role` and equal to the actual role policy document

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.