Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

IAM: Problems sythesizing a role that can read from an SQS queue

See original GitHub issue

Java code:

Queue queue = new Queue(this, "source-import-queue",
                        QueueProps.builder()
                                  .withQueueName("source-import")
                                  .build());

Bucket bucket = new Bucket(this, "source-import-bucket",
                           BucketProps.builder()
                                      .withBucketName("source-import")
                                      .build());
bucket.onObjectCreated(queue);
bucket.addLifecycleRule(LifecycleRule.builder()
                                     .withExpirationInDays(30)
                                     .build());

PolicyStatement policyStatement = new PolicyStatement(PolicyStatementEffect.Allow);
policyStatement.addActions("ReceiveMessage", "DeleteMessage", "DeleteMessageBatch");
policyStatement.addResource(queue);

Role role = new Role(this, "source-import-queue-reader",
                     RoleProps.builder()
                              .withAssumedBy(new AccountPrincipal("12345"))
                              .withRoleName("source-import-queue-reader")
                              .build());
role.addToPolicy(policyStatement);

Expected Behavior: Create a role with a policy that allows reading from the queue.

Actual Behavior:

Exception in thread "main" software.amazon.jsii.JsiiException: While synthesizing hello-cdk/source-import-queue-reader/DefaultPolicy/Resource: Trying to resolve() a Construct at /policyDocument/Statement/0/Resource
While synthesizing hello-cdk/source-import-queue-reader/DefaultPolicy/Resource: Trying to resolve() a Construct at /policyDocument/Statement/0/Resource
    --- resource created at ---
    at new Policy (/private/tmp/jsii-kernel-aRMZR8/node_modules/@aws-cdk/aws-iam/lib/policy.js:22:26)
    at Role.addToPolicy (/private/tmp/jsii-kernel-aRMZR8/node_modules/@aws-cdk/aws-iam/lib/role.js:39:34)
    at _wrapSandboxCode (/private/var/folders/x4/0pn8hl6x4kz135bdrmgdlk7xmh2tn2/T/jsii-java-runtime6462445815484053124/jsii-runtime.js:1:84495)