Description
@aws-cdk/cloudformation-diff/lib/iam does not handle Fn::If in IAM policy statements in existing CloudFormation stacks.
Reproduction Steps
- Create a CloudFormation stack with raw CloudFormation and utilize
Fn::If:in IAM policies.
for example:
Parameters:
AttachLambdaFunctionToVPC: { Type: String, Default: 'false', AllowedValues: ['true', 'false']}
Conditions:
RunLambdaInVPC:
Fn::Equals: [ {Ref: AttachLambdaFunctionToVPC}, "true"]
Resources:
LambdaRole:
Properties:
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
AssumeRolePolicyDocument:
Statement:
- Action: ['sts:AssumeRole']
Effect: Allow
Principal:
Service: [lambda.amazonaws.com]
Version: '2012-10-17'
Policies:
- Fn::If:
- RunLambdaInVPC
- PolicyDocument:
Statement:
- Action: ['ec2:CreateNetworkInterface', 'ec2:DescribeNetworkInterfaces', 'ec2:DeleteNetworkInterface']
Effect: Allow
Resource: '*'
Version: '2012-10-17'
PolicyName: lambdaRoleAPIG
- {Ref: 'AWS::NoValue'}
Type: AWS::IAM::Role
alternatively, this following valid policy definition will also result in an error:
Policies:
- PolicyDocument:
Statement:
- Action: ['cloudwatch:*', 'logs:*', 'dynamodb:GetItem', 'dynamodb:PutItem']
Effect: Allow
Resource: '*'
- Fn::If:
- RunLambdaInVPC
- Action: ['ec2:CreateNetworkInterface', 'ec2:DescribeNetworkInterfaces', 'ec2:DeleteNetworkInterface']
Effect: Allow
Resource: '*'
- {Ref: 'AWS::NoValue'}
Version: '2012-10-17'
PolicyName: lambdaRoleAPIG
- Rewrite the IAM role in CDK
- Synthesize templates
- Run
cdk difforcdk deployagainst the CloudFormation stack created in step 1
Error Log
Errors observed when running cdk diff or cdk deploy for the templates listed in the repro step respectively:
TypeError: Cannot read property 'Statement' of undefined
at /Users/yangtina/.../node_modules/@aws-cdk/cloudformation-diff/lib/iam/iam-changes.ts:187:106
TypeError: Cannot use 'in' operator to search for 'NotResource' in {"Fn::If":["RunLambdaInVPC",{"Action":["ec2:CreateNetworkInterface","ec2:DescribeNetworkInterfaces","ec2:DeleteNetworkInterface"],"Effect":"Allow","Resource":"*"}]}
at new Targets (/Users/yangtina/.../node_modules/@aws-cdk/cloudformation-diff/lib/iam/statement.ts:160:20)
Environment
- CLI Version : 1.27.0 (build a98c0b3)
- Framework Version:
- OS : macOS Mojave 10.14.6
- Language : typescript
Other
The use case this serves is for migrating a production services originally created with CloudFormation to CDK. To avoid doing endpoint migrations for production services due to essential resources being recreated by CloudFormation, we are writing CDK to target an existing stack previously defined by raw CloudFormation instead of creating a whole new CDK stack.
This is 🐛 Bug Report