Allow option to not inject region into iam.ServicePrincipal's Principal String

Note: for support questions, please first reference our documentation, then use Stackoverflow. This repository’s issues are intended for feature requests and bug reports.

• I’m submitting a …

  • 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior? If the current behavior is a 🪲bug🪲: Please provide the steps to reproduce

When using new iam.ServicePrincipal() - the CloudFormation that is output injects the region into the Principal and there is no option to disable this behavior.

# Create a service principal, point it to "codedeploy.amazonaws.com"
new iam.Role(this, 'IamRoleWithServicePrincipal', {
    assumedBy: new iam.ServicePrincipal('codedeploy.amazonaws.com'),
    managedPolicyArns: ['arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole',
        'arn:aws:iam::aws:policy/AWSCodeDeployRoleForECS'],
    roleName: 'myrole'
});

# This is what gets output from cdk synth - Note that `Ref: AWS::Region` 
# gets included as part of the Service Principal
Resources:
  myroleD153DA9E:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                Fn::Join:
                  - ""
                  - - codedeploy.
                    - Ref: AWS::Region
                    - "."
                    - Ref: AWS::URLSuffix
        Version: "2012-10-17"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole
        - arn:aws:iam::aws:policy/AWSCodeDeployRoleForECS
      RoleName: myrole

• What is the expected behavior (or behavior of feature suggested)?

There should be an optional parameter to not inject the region into the principal in the properties passed into new iam.ServicePrincipal().

• What is the motivation / use case for changing the behavior or adding this feature?

Sometimes the console ignores roles with this region set in specific scenarios (certain CodeDeploy stuff). It is also useful to give devs the option to have this flexibility

• Please tell us about your environment:

  • CDK CLI Version: 0.35.0
  • Module Version: 0.35.0
  • OS: OSX
  • Language: TypeScript

• Other information (e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. associated pull-request, stackoverflow, gitter, etc)

This expands on the discussion here https://github.com/awslabs/aws-cdk/issues/2622

[james-portman]

Here is an example of why it’s an issue, if you don’t believe the two of us, https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html In this example AWS specify to use “delivery.logs.amazonaws.com” as the service principal, NOT something like “delivery.logs.eu-west-1.amazonaws.com” with the region in

[melnikalex]

would like to re-open this as well, or get any suggestions for workarounds