cloudformation-diff crashes if forced to diff against a non-CDK template

@aws-cdk/cloudformation-diff/lib/iam does not handle Fn::If in IAM policy statements in existing CloudFormation stacks.

Reproduction Steps

1. Create a CloudFormation stack with raw CloudFormation and utilize Fn::If: in IAM policies.

for example:

Parameters:
  AttachLambdaFunctionToVPC: { Type: String, Default: 'false', AllowedValues: ['true', 'false']}
Conditions:
  RunLambdaInVPC:
    Fn::Equals: [ {Ref: AttachLambdaFunctionToVPC}, "true"]
Resources:
  LambdaRole:
    Properties:
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [lambda.amazonaws.com]
        Version: '2012-10-17'
      Policies:
      - Fn::If:
        - RunLambdaInVPC
        - PolicyDocument:
            Statement:
            - Action: ['ec2:CreateNetworkInterface', 'ec2:DescribeNetworkInterfaces', 'ec2:DeleteNetworkInterface']
              Effect: Allow
              Resource: '*'
            Version: '2012-10-17'
          PolicyName: lambdaRoleAPIG
        - {Ref: 'AWS::NoValue'}
    Type: AWS::IAM::Role

alternatively, this following valid policy definition will also result in an error:

      Policies:
      - PolicyDocument:
          Statement:
          - Action: ['cloudwatch:*', 'logs:*', 'dynamodb:GetItem', 'dynamodb:PutItem']
            Effect: Allow
            Resource: '*'
          - Fn::If:
            - RunLambdaInVPC
            - Action: ['ec2:CreateNetworkInterface', 'ec2:DescribeNetworkInterfaces', 'ec2:DeleteNetworkInterface']
              Effect: Allow
              Resource: '*'
            - {Ref: 'AWS::NoValue'}
          Version: '2012-10-17'
        PolicyName: lambdaRoleAPIG

1. Rewrite the IAM role in CDK
2. Synthesize templates
3. Run cdk diff or cdk deploy against the CloudFormation stack created in step 1

Error Log

Errors observed when running cdk diff or cdk deploy for the templates listed in the repro step respectively:

TypeError: Cannot read property 'Statement' of undefined
    at /Users/yangtina/.../node_modules/@aws-cdk/cloudformation-diff/lib/iam/iam-changes.ts:187:106

TypeError: Cannot use 'in' operator to search for 'NotResource' in {"Fn::If":["RunLambdaInVPC",{"Action":["ec2:CreateNetworkInterface","ec2:DescribeNetworkInterfaces","ec2:DeleteNetworkInterface"],"Effect":"Allow","Resource":"*"}]}
    at new Targets (/Users/yangtina/.../node_modules/@aws-cdk/cloudformation-diff/lib/iam/statement.ts:160:20)

Environment

• CLI Version : 1.27.0 (build a98c0b3)
• Framework Version:
• OS : macOS Mojave 10.14.6
• Language : typescript

Other

The use case this serves is for migrating a production services originally created with CloudFormation to CDK. To avoid doing endpoint migrations for production services due to essential resources being recreated by CloudFormation, we are writing CDK to target an existing stack previously defined by raw CloudFormation instead of creating a whole new CDK stack.

---

This is 🐛 Bug Report

[filletofish]

Hi,

Our team is also impacted by this issue. The context is the same as @yangtina described above. Our project is in the process of migrating from CloudFormation to CDK and contains a mix of CloudFormation templates and CDK.

Due to this crash we have either to

1. Rewrite existing Cfn templates where Fn::If is used inside IAM policies

or

1. Set flag --require-approval to never (in this case cdk diff is not called during deployment). Again, this workaround in turn can mask sensitive changes to the infrastructure 😞

Error stack trace:

Cannot use 'in' operator to search for 'NotResource' in {"Fn::If":["TestCondition",{"Action":["ec2:CreateNetworkInterface","ec2:DescribeNetworkInterfaces","ec2:DeleteNetworkInterface"],"Effect":"Allow","Resource":"*"}]}
TypeError: Cannot use 'in' operator to search for 'NotResource' in {"Fn::If":["TestCondition",{"Action":["ec2:CreateNetworkInterface","ec2:DescribeNetworkInterfaces","ec2:DeleteNetworkInterface"],"Effect":"Allow","Resource":"*"}]}
    at new Targets (/usr/local/lib/node_modules/aws-cdk/node_modules/@aws-cdk/cloudformation-diff/lib/iam/statement.ts:160:20)
    at new Statement (/usr/local/lib/node_modules/aws-cdk/node_modules/@aws-cdk/cloudformation-diff/lib/iam/statement.ts:38:22)
    at /usr/local/lib/node_modules/aws-cdk/node_modules/@aws-cdk/cloudformation-diff/lib/iam/statement.ts:99:28
    at Array.map (<anonymous>)
    at Object.parseStatements (/usr/local/lib/node_modules/aws-cdk/node_modules/@aws-cdk/cloudformation-diff/lib/iam/statement.ts:99:12)
    at /usr/local/lib/node_modules/aws-cdk/node_modules/@aws-cdk/cloudformation-diff/lib/iam/iam-changes.ts:187:51
    at Object.flatMap (/usr/local/lib/node_modules/aws-cdk/node_modules/@aws-cdk/cloudformation-diff/lib/util.ts:46:17)
    at IamChanges.readIdentityPolicies (/usr/local/lib/node_modules/aws-cdk/node_modules/@aws-cdk/cloudformation-diff/lib/iam/iam-changes.ts:186:12)
    at IamChanges.readPropertyChange (/usr/local/lib/node_modules/aws-cdk/node_modules/@aws-cdk/cloudformation-diff/lib/iam/iam-changes.ts:144:40)
    at new IamChanges (/usr/local/lib/node_modules/aws-cdk/node_modules/@aws-cdk/cloudformation-diff/lib/iam/iam-changes.ts:36:12)

Best regards, Filipp

[skinny85]

This is similar to https://github.com/aws/aws-cdk/issues/12887. We should definitely fix it.