fix(iam): grantAssumeRole silently fails with service and account principals

packages/@aws-cdk-testing/framework-integ/test/aws-iam/test/integ.managed-policy.js.snapshot/aws-cdk-iam-managed-policy.template.json

@@ -22,19 +22,11 @@
     ]
    }
   },
-  "OneManagedPolicy77F9185F": {
-   "Type": "AWS::IAM::ManagedPolicy",
+  "MyUserDefaultPolicy7B897426": {
+   "Type": "AWS::IAM::Policy",
    "Properties": {
-    "Description": "My Policy",
-    "ManagedPolicyName": "Default",
-    "Path": "/some/path/",
     "PolicyDocument": {
      "Statement": [
-      {
-       "Action": "sqs:SendMessage",
-       "Effect": "Allow",
-       "Resource": "*"
-      },
       {
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
@@ -48,6 +40,30 @@
      ],
      "Version": "2012-10-17"
     },
+    "PolicyName": "MyUserDefaultPolicy7B897426",
+    "Users": [
+     {
+      "Ref": "MyUserDC45028B"
+     }
+    ]
+   }
+  },
+  "OneManagedPolicy77F9185F": {
+   "Type": "AWS::IAM::ManagedPolicy",
+   "Properties": {
+    "Description": "My Policy",
+    "ManagedPolicyName": "Default",
+    "Path": "/some/path/",
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sqs:SendMessage",
+       "Effect": "Allow",
+       "Resource": "*"
+      }
+     ],
+     "Version": "2012-10-17"
+    },
     "Roles": [
      {
       "Ref": "Role1ABCC5F0"

packages/@aws-cdk-testing/framework-integ/test/aws-iam/test/integ.managed-policy.ts

@@ -24,7 +24,8 @@ const policy3 = ManagedPolicy.fromAwsManagedPolicyName('SecurityAudit');
 user.addManagedPolicy(policy3);
 
 const role = new Role(stack, 'Role', { assumedBy: new AccountRootPrincipal() });
-role.grantAssumeRole(policy.grantPrincipal);
+role.grantAssumeRole(user);
+
 Grant.addToPrincipal({ actions: ['iam:*'], resourceArns: [role.roleArn], grantee: policy2 });
 
 policy.attachToRole(role);

packages/@aws-cdk-testing/framework-integ/test/aws-iam/test/integ.policy.js.snapshot/aws-cdk-iam-policy.template.json

@@ -3,16 +3,11 @@
   "MyUserDC45028B": {
    "Type": "AWS::IAM::User"
   },
-  "HelloPolicyD59007DF": {
+  "MyUserDefaultPolicy7B897426": {
    "Type": "AWS::IAM::Policy",
    "Properties": {
     "PolicyDocument": {
      "Statement": [
-      {
-       "Action": "sqs:SendMessage",
-       "Effect": "Allow",
-       "Resource": "*"
-      },
       {
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
@@ -26,6 +21,27 @@
      ],
      "Version": "2012-10-17"
     },
+    "PolicyName": "MyUserDefaultPolicy7B897426",
+    "Users": [
+     {
+      "Ref": "MyUserDC45028B"
+     }
+    ]
+   }
+  },
+  "HelloPolicyD59007DF": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sqs:SendMessage",
+       "Effect": "Allow",
+       "Resource": "*"
+      }
+     ],
+     "Version": "2012-10-17"
+    },
     "PolicyName": "Default",
     "Users": [
      {