Minimized IAM Statements produced are inconsistent

Describe the bug

aws-cdk version: 2.27.0 (build 8e89048) aws-cdk-lib version: 2.27.0

I have a Policy attached to a User which has been granted S3 access as such:

        bucket.grant_delete(iam_user)
        bucket.grant_put_acl(iam_user)

When doing cdk synth this results in the following statement block being added onto an IAM policy tied to the user:

      {
       "Action": [
        "s3:DeleteObject*",
        "s3:PutObjectAcl",
        "s3:PutObjectVersionAcl"
       ],
       "Effect": "Allow",
       "Resource": {
        "Fn::Join": [
         "",
         [
          {
           "Fn::GetAtt": [
            "bucket43879C71",
            "Arn"
           ]
          },
          "/*"
         ]
        ]
       }
      }

However, when I try to assert that this statement is on the policy in the template it fails because in the template generated by the test it has split it into 2 statements.

Expected Behavior

I expect that the output of cdk synth would be the same as what aws_cdk.assertions.Template.from_stack(stack) produces when it comes to IAM policy statements.

Current Behavior

What actually happens is the aws_cdk.assertions.Template.from_stack(stack) produces 2 individual statements like so:

E                     {
E                       "Action": "s3:DeleteObject*",
E                       "Effect": "Allow",
E                       "Resource": {
E                         "Fn::Join": [
E                           "",
E                           [
E                             {
E                               "Fn::GetAtt": [
E                                 "bucket43879C71",
E                                 "Arn"
E                               ]
E                             },
E                             "/*"
E                           ]
E                         ]
E                       }
E                     },
E                     {
E                       "Action": [
E                         "s3:PutObjectAcl",
E                         "s3:PutObjectVersionAcl"
E                       ],
E                       "Effect": "Allow",
E                       "Resource": {
E                         "Fn::Join": [
E                           "",
E                           [
E                             {
E                               "Fn::GetAtt": [
E                                 "bucket43879C71",
E                                 "Arn"
E                               ]
E                             },
E                             "/*"
E                           ]
E                         ]
E                       }
E                     },

(pardon the E’s, taken straight from my CLI)

Reproduction Steps

import aws_cdk
from constructs import Construct

class TestStack(aws_cdk.Stack):
    def __init__(
        self,
        scope: Construct,
        construct_id: str,
        **kwargs
    ) -> None:
        super().__init__(scope, construct_id, **kwargs)

        bucket = aws_cdk.aws_s3.Bucket(self, 'bucket')
        iam_user = aws_cdk.aws_iam.User(self, 'iam-user')
        bucket.grant_delete(iam_user)
        bucket.grant_put_acl(iam_user)

app = aws_cdk.App()
stack = TestStack(app, 'test')
template = aws_cdk.assertions.Template.from_stack(stack)

user = template.find_resources("AWS::IAM::User")
bucket = template.find_resources("AWS::S3::Bucket")
template.has_resource_properties(
    "AWS::IAM::Policy",
    aws_cdk.assertions.Match.object_like(
        {
            "PolicyDocument": {
                "Statement": aws_cdk.assertions.Match.array_with(
                    [
                        aws_cdk.assertions.Match.object_like(
                            {
                                "Action": [
                                    "s3:DeleteObject*",
                                    "s3:PutObjectAcl",
                                    "s3:PutObjectVersionAcl",
                                ],
                                "Effect": "Allow",
                                "Resource": {
                                    "Fn::Join": [
                                        "",
                                        [
                                            {
                                                "Fn::GetAtt": [
                                                    aws_cdk.assertions.Match.any_value(),
                                                    "Arn",
                                                ]
                                            },
                                            "/*",
                                        ],
                                    ]
                                },
                            }
                        ),
                    ]
                )
            },
        }
    ),
)

Possible Solution

It seems that the synth is doing some extra smarts to merge the 2 statements for grant_delete and grant_put_acl into 1 statement?

It would be great for the output of synth and aws_cdk.assertions.Template.from_stack() to be as similar as possible so that a developer can write their tests based on the output of synth and what ends up getting deployed into CF

Additional Information/Context

No response

CDK CLI Version

2.27.0 (build 8e89048)

Framework Version

No response

Node.js Version

v18.0.0

OS

Mac

Language

Python

Language Version

3.8.5

Other information

No response

[joekeilty-oub]

@polothy That worked perfectly, thank you! ❤️

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.