AWS : Trust relationship in CDK

Question

I want to create following trust relationship of IAM role using CDK code

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<ABC>:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<ID>"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<XYZ>:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Above policy is directly created using AWS console, but when I am creating it through CDK code I am getting something like :

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::<XYZ>:root",
          "arn:aws:iam::<ABC>:root"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<ID>"
        }
      }
    }
  ]
}

I am using following CDK code to achieve this:

const account1 = new AccountPrincipal('<XYZ>');
account1.withConditions({StringEquals : { "sts:ExternalId": "<ID>"}});

const account2 =  new AccountPrincipal('<ABC>');

const role1 = new Role(this, 'role1', {
  roleName:  "role1",
  description: "some description",
  assumedBy: new CompositePrincipal(account1, account2),
  externalIds: ['<ID>'],
});

Q1: Will these two policies have different effect?

Q2: How can I achieve first policy from CDK?

stijndepestel stijndepestel · Accepted Answer · 2021-10-21T13:32:20

Q1: The policies are different, because of the extra condition that is imposed on account XYZ in the CDK code, which isn't imposed in the manually created policy. If that's not what you want/need, you will have to change it.

Q2: If you want to achieve the exact same policy, you can use the attachToPolicy function on the Role to add the second statement separately, without the extra condition of the externalIds.

AWS : Trust relationship in CDK

1 Answers