CodeBuild: Associating an existing IAM role to a CodeBuild project results in exception

Describe the bug Creating a new CodeBuild project and associating an existing IAM role results in: Policy must be attached to at least one principal: user, group or role during synthesis. My best guess is that the default policy generated by CDK is getting orphaned instead of disregarded in the case where an existing IAM role is specified?

To Reproduce Using the following code to make the association:

val codeBuildProjectRole = Role.fromRoleArn(
            this,
            "code-build-project-role",
            "arn:aws:iam::1234567890:role/service-role/codebuild-bruiser-service-role"
        )

        val projectProps = ProjectProps.builder()
            .withEnvironment(buildEnvironment)
            .withProjectName(appName)
            .withSource(gitHubEnterpriseSource)
            .withBuildSpec("buildspec.yml")
            .withVpc(props.vpc)
            .withRole(codeBuildProjectRole)
            .withArtifacts(NoBuildArtifacts())
            .withSecondaryArtifacts(
                listOf(
                    s3BucketBuildArtifacts
                )
            )
            .build()

        val project = Project(this, "code-build-project", projectProps)

Expected behavior Associating a valid existing role to a CodeBuild project should not result in exception.

Version:

• Ubuntu 18.04
• Kotlin using Java CDK artifacts
• 0.32.0

[pcolazurdo]

The problem seems to be in the code for IAM: Service Role are supported in CodeBuild, but IAM Policy is expecting a Role Name and not a /path/RoleName:

"codebuildEmbeddedMetricsPolicy11DBAAB4": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            ...
        "PolicyName": "codebuildEmbeddedMetricsPolicy11DBAAB4",
        "Roles": [
          "service-role/codebuild-EmbeddedMetrics-service-role"
        ]
      },
...

If I manually change this with:

"Roles": [
          "codebuild-EmbeddedMetrics-service-role"
        ]

it works totally fine

[skinny85]

Aaah, I get it now 😃. Thanks @pcolazurdo , I’ll try to get this fixed!