feat(iam): Adding managedPolicyName to IManagedPolicy

aws · Apr 6, 2024 · a1e105e · a1e105e
1 parent bf2cf51
commit a1e105e
Show file tree

Hide file tree

Showing 4 changed files with 19 additions and 17 deletions.
diff --git a/...ework-integ/test/aws-codepipeline-actions/test/integ.pipeline-elastic-beanstalk-deploy.ts b/...ework-integ/test/aws-codepipeline-actions/test/integ.pipeline-elastic-beanstalk-deploy.ts
@@ -45,28 +45,18 @@ const serviceRole = new iam.Role(stack, 'service-role', {
   roleName: 'codepipeline-elasticbeanstalk-action-test-serivce-role',
   assumedBy: new iam.ServicePrincipal('elasticbeanstalk.amazonaws.com'),
   managedPolicies: [
-    {
-      managedPolicyArn: 'arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth',
-    },
-    {
-      managedPolicyArn: 'arn:aws:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy',
-    },
+    iam.ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkEnhancedHealth'),
+    iam.ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy'),
   ],
 });
 
 const instanceProfileRole = new iam.Role(stack, 'instance-profile-role', {
   roleName: 'codepipeline-elasticbeanstalk-action-test-instance-profile-role',
   assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
   managedPolicies: [
-    {
-      managedPolicyArn: 'arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier',
-    },
-    {
-      managedPolicyArn: 'arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker',
-    },
-    {
-      managedPolicyArn: 'arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier',
-    },
+    iam.ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkWebTier'),
+    iam.ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkMulticontainerDocker'),
+    iam.ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkWorkerTier'),
   ],
 });
 

diff --git a/packages/aws-cdk-lib/aws-codepipeline-actions/lib/elastic-beanstalk/deploy-action.ts b/packages/aws-cdk-lib/aws-codepipeline-actions/lib/elastic-beanstalk/deploy-action.ts
@@ -1,6 +1,6 @@
 import { Construct } from 'constructs';
 import * as codepipeline from '../../../aws-codepipeline';
-import { Aws } from '../../../core';
+import { ManagedPolicy } from '../../../aws-iam';
 import { Action } from '../action';
 import { deployArtifactBounds } from '../common';
 
@@ -52,7 +52,7 @@ export class ElasticBeanstalkDeployAction extends Action {
 
     // Per https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.managed-policies.html
     // it doesn't seem we can scope this down further for the codepipeline action.
-    options.role.addManagedPolicy({ managedPolicyArn: `arn:${Aws.PARTITION}:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk` });
+    options.role.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess-AWSElasticBeanstalk'));
 
     // the Action's Role needs to read from the Bucket to get artifacts
     options.bucket.grantRead(options.role);

diff --git a/packages/aws-cdk-lib/aws-iam/lib/managed-policy.ts b/packages/aws-cdk-lib/aws-iam/lib/managed-policy.ts
@@ -19,6 +19,12 @@ export interface IManagedPolicy {
    * @attribute
    */
   readonly managedPolicyArn: string;
+
+  /**
+   * The name of the managed policy
+   * @attribute
+   */
+  readonly managedPolicyName: string;
 }
 
 /**
@@ -117,6 +123,7 @@ export class ManagedPolicy extends Resource implements IManagedPolicy, IGrantabl
         resource: 'policy',
         resourceName: managedPolicyName,
       });
+      public readonly managedPolicyName = managedPolicyName;
     }
     return new Import(scope, id);
   }
@@ -143,6 +150,7 @@ export class ManagedPolicy extends Resource implements IManagedPolicy, IGrantabl
   public static fromManagedPolicyArn(scope: Construct, id: string, managedPolicyArn: string): IManagedPolicy {
     class Import extends Resource implements IManagedPolicy {
       public readonly managedPolicyArn = managedPolicyArn;
+      public readonly managedPolicyName = Stack.of(scope).splitArn(managedPolicyArn, ArnFormat.SLASH_RESOURCE_NAME).resourceName!;
     }
     return new Import(scope, id);
   }
@@ -166,6 +174,7 @@ export class ManagedPolicy extends Resource implements IManagedPolicy, IGrantabl
         resource: 'policy',
         resourceName: managedPolicyName,
       });
+      public readonly managedPolicyName = managedPolicyName;
     }
     return new AwsManagedPolicy();
   }

diff --git a/packages/aws-cdk-lib/aws-iam/test/managed-policy.test.ts b/packages/aws-cdk-lib/aws-iam/test/managed-policy.test.ts
@@ -21,6 +21,7 @@ describe('managed policy', () => {
         ':iam::aws:policy/service-role/SomePolicy',
       ]],
     });
+    expect(stack.resolve(mp.managedPolicyName)).toEqual('service-role/SomePolicy');
   });
 
   test('simple customer managed policy', () => {
@@ -33,12 +34,14 @@ describe('managed policy', () => {
         ':iam::1234:policy/SomeCustomerPolicy',
       ]],
     });
+    expect(stack.resolve(mp.managedPolicyName)).toEqual('SomeCustomerPolicy');
   });
 
   test('managed policy by arn', () => {
     const mp = ManagedPolicy.fromManagedPolicyArn(stack, 'MyManagedPolicyByArn', 'arn:aws:iam::1234:policy/my-policy');
 
     expect(stack.resolve(mp.managedPolicyArn)).toEqual('arn:aws:iam::1234:policy/my-policy');
+    expect(stack.resolve(mp.managedPolicyName)).toEqual('my-policy');
   });
 
   test('managed policy with statements', () => {