fix(iam): Error for addToPolicy and addToPrincipalPolicy in User.fromUserName corrected...

packages/@aws-cdk/aws-iam/lib/user.ts

@@ -145,19 +145,13 @@ export class User extends Resource implements IIdentity, IUser {
       public readonly userArn: string = arn;
       public readonly assumeRoleAction: string = 'sts:AssumeRole';
       public readonly policyFragment: PrincipalPolicyFragment = new ArnPrincipal(arn).policyFragment;
-      private defaultPolicy?: Policy;
 
-      public addToPolicy(statement: PolicyStatement): boolean {
-        return this.addToPrincipalPolicy(statement).statementAdded;
+      public addToPolicy(_statement: PolicyStatement): boolean {
+        throw new Error('Cannot add imported User to policy');
       }
 
-      public addToPrincipalPolicy(statement: PolicyStatement): AddToPrincipalPolicyResult {
-        if (!this.defaultPolicy) {
-          this.defaultPolicy = new Policy(this, 'Policy');
-          this.defaultPolicy.attachToUser(this);
-        }
-        this.defaultPolicy.addStatements(statement);
-        return { statementAdded: true, policyDependable: this.defaultPolicy };
+      public addToPrincipalPolicy(_statement: PolicyStatement): AddToPrincipalPolicyResult {
+        throw new Error('Cannot add imported User to principal policy');
       }
 
       public addToGroup(_group: IGroup): void {

packages/@aws-cdk/aws-iam/test/user.test.ts

@@ -1,6 +1,6 @@
 import '@aws-cdk/assert/jest';
 import { App, SecretValue, Stack } from '@aws-cdk/core';
-import { ManagedPolicy, User } from '../lib';
+import { ManagedPolicy, Policy, PolicyStatement, User } from '../lib';
 
 describe('IAM user', () => {
   test('default user', () => {
@@ -93,4 +93,47 @@ describe('IAM user', () => {
       'Fn::Join': ['', ['arn:', { Ref: 'AWS::Partition' }, ':iam::', { Ref: 'AWS::AccountId' }, ':user/MyUserName']],
     });
   });
+
+  test('imported user cannot be added to policy', () => {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    const user = User.fromUserName(stack, 'import', 'MyUserName');
+
+    // THEN
+    expect(() => stack.resolve(user.addToPolicy(new PolicyStatement()))).toThrowError(
+      new Error('Cannot add imported User to policy'),
+    );
+  });
+
+  test('imported user cannot be added to principal policy', () => {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    const user = User.fromUserName(stack, 'import', 'MyUserName');
+
+    // THEN
+    expect(() => stack.resolve(user.addToPrincipalPolicy(
+      new PolicyStatement(),
+    ))).toThrowError(
+      new Error('Cannot add imported User to principal policy'),
+    );
+  });
+
+  test('inline ploicy cannot be added to an imported user', () => {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    const user = User.fromUserName(stack, 'import', 'MyUserName');
+
+    // THEN
+    expect(() => stack.resolve(user.attachInlinePolicy(
+      new Policy(stack, 'testPolicy'),
+    ))).toThrowError(
+      new Error('Cannot add inline policy to imported User'),
+    );
+  });
 });