Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(aws-iam): (importedRoleStackSafeDefaultPolicyName Feature flag generates Policy names that are over 128 characters) #24441

Closed
zeyad001 opened this issue Mar 3, 2023 · 3 comments
Closed

(aws-iam): (importedRoleStackSafeDefaultPolicyName Feature flag generates Policy names that are over 128 characters) #24441

zeyad001 opened this issue Mar 3, 2023 · 3 comments
Labels
@aws-cdk/aws-iam Related to AWS Identity and Access Management bug This issue is a bug. effort/medium Medium work item – several days of effort p2

Comments

@zeyad001
Copy link
Contributor

zeyad001 commented Mar 3, 2023

Describe the bug

I am using the CrossZoneDelegation construct to delegate between 2 hosted Zones that are in different accounts. When I use the importedRoleStackSafeDefaultPolicyName feature flag the policy names that are generated that contain the path are targer than 128 characters which causes the stack to fail to deploy.

Expected Behavior

The policy names need to be trimmed to fit within 128 characters when using this feature flag.

Current Behavior

Adding the full construct path to the policy can lead to the polices becoming too to large.

Reproduction Steps

  • Create a new stack with a long name
  • Create a Hosted Zone in that account
  • Create another stack with a long name
  • Create a DNS delegation roles
  • Create a Hosted Zone in another account
  • Use CrossAccount Delegation between the hosted zones
  • Enable the importedRoleStackSafeDefaultPolicyName feature flag
  • Attempt to deploy
  • Stack fails because of policy name being too long and containing the entire construct path.

Possible Solution

  • Trim the policy name
  • Find another uuid to generate default policy names instead of appending the construct path

Additional Information/Context

No response

CDK CLI Version

2.66.0

Framework Version

No response

Node.js Version

16

OS

Amazon Linux 2

Language

Typescript

Language Version

4.9.5

Other information

No response
@zeyad001 zeyad001 added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Mar 3, 2023
@github-actions github-actions bot added the @aws-cdk/aws-iam Related to AWS Identity and Access Management label Mar 3, 2023
@pahud
Copy link
Contributor

pahud commented Mar 3, 2023

Thank you for your report. I guess we probably need to trim the policy name with cdk.Names.UniqueResourceName() with maxLength property specified. Making this a p2 bug and any PR submission would be appreciated!

@pahud pahud added p2 effort/medium Medium work item – several days of effort and removed needs-triage This issue or PR still needs to be triaged. labels Mar 3, 2023
@isacaraujo isacaraujo mentioned this issue Oct 13, 2023
Closed
@yamoyamoto yamoyamoto mentioned this issue Oct 15, 2023
Merged
@peterwoodworth
Copy link
Contributor

Closing as duplicate of #27409

@peterwoodworth peterwoodworth closed this as not planned Won't fix, can't repro, duplicate, stale Oct 16, 2023
@github-actions
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

mergify bot pushed a commit that referenced this issue Dec 21, 2023
@yamoyamoto
fix(iam): importedRoleStackSafeDefaultPolicyName feature flag results…
4f88db6 
… in excessively long IAM policy names (#27548)

When the importedRoleStackSafeDefaultPolicyName feature flag is enabled, the method to calculate the IAM Policy Name within `aws_iam.ImportedRole.addToPrincipalPolicy()` changes. Specifically, if the generated IAM Policy Name exceeds the maximum allowed length of 128 characters, it will be truncated using `Names.uniqueResourceName()`.

Previously, the `Names.UniqueId()` method was used to generate the Policy Name. This method does not allow you to set a maximum length, so if the name exceeded the limit, it would be overwritten using `Names.uniqueResourceName()`—a function that allows for length specification.

I considered replacing `Names.UniqueId()` entirely with `Names.uniqueResourceName()`. However, this is on hold due to concerns that existing Policy Names could be affected. If a complete replacement poses no issues, your guidance is appreciated, as I'm not fully versed in the logic behind these methods.

Closes #27409 , #24441 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
paulhcsun pushed a commit to paulhcsun/aws-cdk that referenced this issue Jan 5, 2024
@yamoyamoto @paulhcsun
fix(iam): importedRoleStackSafeDefaultPolicyName feature flag results…
22e0659 
… in excessively long IAM policy names (aws#27548)

When the importedRoleStackSafeDefaultPolicyName feature flag is enabled, the method to calculate the IAM Policy Name within `aws_iam.ImportedRole.addToPrincipalPolicy()` changes. Specifically, if the generated IAM Policy Name exceeds the maximum allowed length of 128 characters, it will be truncated using `Names.uniqueResourceName()`.

Previously, the `Names.UniqueId()` method was used to generate the Policy Name. This method does not allow you to set a maximum length, so if the name exceeded the limit, it would be overwritten using `Names.uniqueResourceName()`—a function that allows for length specification.

I considered replacing `Names.UniqueId()` entirely with `Names.uniqueResourceName()`. However, this is on hold due to concerns that existing Policy Names could be affected. If a complete replacement poses no issues, your guidance is appreciated, as I'm not fully versed in the logic behind these methods.

Closes aws#27409 , aws#24441 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
@aws-cdk/aws-iam Related to AWS Identity and Access Management bug This issue is a bug. effort/medium Medium work item – several days of effort p2
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@pahud @zeyad001 @peterwoodworth