(aws_iam): service roles are doubled, causing a fatal error, when using the same role for 2 resources

service roles are doubled, causing a fatal error, when using the same role for 2 resources

I have 2 lambda functions and 2 config rules and as you can see the AWSConfigRulesExecutionRole is attached as a managed policy twice, even though I don’t have it at all in my iam stack: IAM Policy Changes ┌───┬──────────────────────────────┬────────────────────────────────────────────────────────────────────────────────┐ │ │ Resource │ Managed Policy ARN │ ├───┼──────────────────────────────┼────────────────────────────────────────────────────────────────────────────────┤ │ + │ ${EBS Encrypted Lambda Role} │ arn:${AWS::Partition}:iam::aws:policy/IAMReadOnlyAccess │ │ + │ ${EBS Encrypted Lambda Role} │ arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole │ │ + │ ${EBS Encrypted Lambda Role} │ arn:${AWS::Partition}:iam::aws:policy/service-role/AWSConfigRulesExecutionRole │ │ + │ ${EBS Encrypted Lambda Role} │ arn:${AWS::Partition}:iam::aws:policy/service-role/AWSConfigRulesExecutionRole │ └───┴──────────────────────────────┴────────────────────────────────────────────────────────────────────────────────┘

The stack then errors out: `iam: deploying… iam: creating CloudFormation changeset… [██████████████████████████████████████▋···················] (2/3)

1:40:37 PM | CREATE_FAILED | AWS::IAM::Role | EBS Encryp` Property ManagedPolicyArns contains duplicate values.

Reproduction Steps

create 2 lambda functions and 2 custom config rules, use the same role for each lambda function

If I comment the 2nd config custom rule it works fine

What did you expect to happen?

I didn’t know it would add the service role at all because I don’t explicitly specify it, but it certainly shouldn’t be adding it twice.

What actually happened?

arn:${AWS::Partition}:iam::aws:policy/service-role/AWSConfigRulesExecutionRole was added twice

Environment

• CDK CLI Version: 1.85.0 (build 5f44668)
• Framework Version: How do I find this?
• Node.js Version:15.6.0
• OS : Mac Big Sur
• Language (Version): Python 3.8.6

Other

URL to the code: https://github.com/NickTheSecurityDude/config-security-risks

---

This is 🐛 Bug Report

[skinny85]

I still think this is a bug in the IAM service library 🙂 (the Managed Policy should be attached to the Role only once)

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.