aws-iam: Allow `string | string[]` in FederatedPrincipal assumeRoleAction

Allow string | string[] in FederatedPrincipal.

This is required when using cognito with principal tag mapping.

Use Case

AWS has a brief video explaining the use case here: https://www.youtube.com/watch?v=tAUmz94O2Qo

The use case is that, if a cognito user from a user pool is authenticated, then their claims can be forwarded to the policy document to allow for fine-grained access control e.g.

    /**
     * Policy that enables a tenant to access their entire org's data
     */
    const tenantPolicy = new PolicyStatement({
      sid: "AllowPrecedingKeysToDynamoDBOrganisation",
      effect: Effect.ALLOW,
      actions: [
        "dynamodb:GetItem",
        "dynamodb:Query"
      ],
      resources: [
        table.tableArn
      ],
      conditions: {
        "ForAllValues:StringLike": {
          "dynamodb:LeadingKeys": [
            "${aws:PrincipalTag/org}#*"
          ]
        }
      },
    })

In order to support deploying FederatedPrincipal policies via @aws-cdk/aws-iam which use sts:TagSession and sts:AssumeRoleWithWebIdentity currently this work around is required:

    const role = new iam.Role(this, "IdentityPoolAuthRole", {
      assumedBy: new iam.FederatedPrincipal(
        "cognito-identity.amazonaws.com",
        {
          StringEquals: {
            "cognito-identity.amazonaws.com:aud": identityPool.ref,
          },
          "ForAnyValue:StringLike": {
            "cognito-identity.amazonaws.com:amr": "authenticated",
          },
        },
        // @ts-ignore
        [
          "sts:AssumeRoleWithWebIdentity",
          "sts:TagSession"
        ] as string
      ),
    });

The underlying base principal supports having the this.assumeRoleAction set as a string array, but the allowed types have been restricted on the child class

https://github.com/aws/aws-cdk/blob/fdce08cee6f0eb58aad93572641a1dd4b59e8d37/packages/%40aws-cdk/aws-iam/lib/principals.ts#L426-L442

Proposed Solution

https://github.com/aws/aws-cdk/blob/fdce08cee6f0eb58aad93572641a1dd4b59e8d37/packages/%40aws-cdk/aws-iam/lib/principals.ts#L427

Is update to

public readonly assumeRoleAction: string | string[];

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[simonireilly]

@simonireilly Any ETA on the PR and release that fixes this issue? We currently need this functionality in our project and are using the workaround proposed here

PR is open, awaiting comments: https://github.com/aws/aws-cdk/pull/16725

It’s a fix, but not ideal. I think the other option is to rewrite entire IPrincipal to take a string[] instead of string in assume role action and publish under a feature flag.

Awaiting comments for @rix0rrr

[Dachmian]

Much obliged🙌