fix(iam): attach policy to imported User (#11493)

It was not possible to attach policies to imported `User` objects. This can be made to work though, as the underlying CloudFormation resource allows doing so. Make this work in the class library. Fixes #10913, closes #11046, closes #10527. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
aws · Nov 18, 2020 · 0a8971c · 0a8971c
1 parent 33cc5ec
commit 0a8971c
Show file tree

Hide file tree

Showing 2 changed files with 63 additions and 3 deletions.
diff --git a/packages/@aws-cdk/aws-iam/lib/user.ts b/packages/@aws-cdk/aws-iam/lib/user.ts
@@ -145,6 +145,7 @@ export class User extends Resource implements IIdentity, IUser {
       public readonly userArn: string = arn;
       public readonly assumeRoleAction: string = 'sts:AssumeRole';
       public readonly policyFragment: PrincipalPolicyFragment = new ArnPrincipal(arn).policyFragment;
+      private readonly attachedPolicies = new AttachedPolicies();
       private defaultPolicy?: Policy;
 
       public addToPolicy(statement: PolicyStatement): boolean {
@@ -164,8 +165,9 @@ export class User extends Resource implements IIdentity, IUser {
         throw new Error('Cannot add imported User to Group');
       }
 
-      public attachInlinePolicy(_policy: Policy): void {
-        throw new Error('Cannot add inline policy to imported User');
+      public attachInlinePolicy(policy: Policy): void {
+        this.attachedPolicies.attach(policy);
+        policy.attachToUser(this);
       }
 
       public addManagedPolicy(_policy: IManagedPolicy): void {

diff --git a/packages/@aws-cdk/aws-iam/test/user.test.ts b/packages/@aws-cdk/aws-iam/test/user.test.ts
@@ -1,6 +1,6 @@
 import '@aws-cdk/assert/jest';
 import { App, SecretValue, Stack } from '@aws-cdk/core';
-import { ManagedPolicy, User } from '../lib';
+import { ManagedPolicy, Policy, PolicyStatement, User } from '../lib';
 
 describe('IAM user', () => {
   test('default user', () => {
@@ -93,4 +93,62 @@ describe('IAM user', () => {
       'Fn::Join': ['', ['arn:', { Ref: 'AWS::Partition' }, ':iam::', { Ref: 'AWS::AccountId' }, ':user/MyUserName']],
     });
   });
+
+  test('add to policy of imported user', () => {
+    // GIVEN
+    const stack = new Stack();
+    const user = User.fromUserName(stack, 'ImportedUser', 'john');
+
+    // WHEN
+    user.addToPrincipalPolicy(new PolicyStatement({
+      actions: ['aws:Use'],
+      resources: ['*'],
+    }));
+
+    // THEN
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
+      Users: ['john'],
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: 'aws:Use',
+            Effect: 'Allow',
+            Resource: '*',
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    });
+  });
+
+  test('attach policy to imported user', () => {
+    // GIVEN
+    const stack = new Stack();
+    const user = User.fromUserName(stack, 'ImportedUser', 'john');
+
+    // WHEN
+    user.attachInlinePolicy(new Policy(stack, 'Policy', {
+      statements: [
+        new PolicyStatement({
+          actions: ['aws:Use'],
+          resources: ['*'],
+        }),
+      ],
+    }));
+
+    // THEN
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
+      Users: ['john'],
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: 'aws:Use',
+            Effect: 'Allow',
+            Resource: '*',
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    });
+  });
 });