Cannot create IManagedPolicy from a customer managed policy

• I’m submitting a …

  • 🚀 feature request

• What is the current behavior?

Role.addManagedPolicy(policy: IManagedPolicy) is the method to add managed policies to a role. However the only method to create IManagedPolicy is ManagedPolicy.fromAwsManagedPolicyName(), which only supports the AWS managed policies. There is no way to add a customer-managed policy to a role, either by its arn or by a ref to a CfnManagedPolicy.

This is a regression from 0.34.0 behaviour. In 0.34.0 you could do the following:

myRole: Role;
myPolicy: CfnManagedPolicy;
myRole.attachManagedPolicy(myPolicy.managedPolicyArn);

• What is the expected behavior (or behavior of feature suggested)?

One or more of the following methods should be added to ManagedPolicy to support more managed policy types:

ManagedPolicy.fromManagedPolicyRef(ref: IResolvable)
ManagedPolicy.fromManagedPolicyArn(arn: string)

• What is the motivation / use case for changing the behavior or adding this feature?

To support customer Managed policies.

• Please tell us about your environment:

  • CDK CLI Version: 0.35.0
  • OS: Windows 10
  • Language: TypeScript

[NetaNir]

You can try using addManagedPolicy:

    const role = new iam.Role(this, 'Role', {
      assumedBy: new iam.ServicePrincipal('some.domain')
    })
    role.addManagedPolicy({
      managedPolicyArn: 'managedPolicyArn'
    })

[IainCole]

I took a stab at implementing the creation / reference of customer managed policies here https://github.com/IainCole/aws-cdk/blob/ic_support_customer_managed_policy/packages/%40aws-cdk/aws-iam/lib/managed-policy.ts

It seems to work from my testing, @NGL321 if this makes sense logically I can submit a PR with tests etc.