Resolution error: "${Token[TOKEN.XXX]}" is used as the key in a map so must resolve to a string

When ${Token} is evaluated, if the ${Token} variable is placed in an Object map as a key, the error (see error log) will occur. For example:

// iamOIDCProvider is an instance of CustomResource provider
let clusterOIDCUrl = iamOIDCProvider.getAttString("clusterOIDCUrl")

// this one will return error
let trustConditionMap1 = {'StringEquals': {[clusterOIDCUrl]: 'system:serviceaccount:default:iam-test'}};

// below simple one will return the same error too
let trustConditionMap2 = {[clusterOIDCUrl]: 'system:serviceaccount:default:iam-test'};

if we checked typeof string from the variable clusterOIDCUrl, it will return ‘true’. So it was determined a string type. It is necessary to put variable as a key into an object map to configure a trust condition for an IAM role like: const samplePodRoleS3ReadOnly = new iam.Role(stack, 'SampleS3ReadOnlyRole', { roleName: 'DemoCdkEKSStack-SamplePodRoleS3ReadOnly', assumedBy: new iam.FederatedPrincipal(iamOIDCProviderArn, trustConditionMap, assumeRoleActionStr) });

Reproduction Steps

const iamOIDCProvider = new cfn.CustomResource(stack, 'IAMOIDCProvider', {
  provider: eksOIDCCustomResourceProvider,
  properties: {
    ClusterName: cluster.clusterName,
    RegionId: stack.region
  }
});

//sample string for trustConditionMap = {'StringEquals':{'oidc.eks.us-east-1.amazonaws.com/id/63B9F8F8B2BE0ABC6C647D5B6F1E9999:sub': 'system:serviceaccount:default:iam-test'}};
let clusterOIDCUrl = iamOIDCProvider.getAttString("clusterOIDCUrl")
let trustConditionMap = {'StringEquals': {[clusterOIDCUrl]: 'system:serviceaccount:default:iam-test'}};
//let trustConditionMap = {[clusterOIDCUrl]: 'system:serviceaccount:default:iam-test'}

Error Log

/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/core/lib/private/resolve.ts:151
      throw new Error(`"${key}" is used as the key in a map so must resolve to a string, but it resolves to: ${JSON.stringify(resolvedKey)}`);
            ^
Error: Resolution error: Resolution error: Resolution error: "${Token[TOKEN.541]}" is used as the key in a map so must resolve to a string, but it resolves to: {"Fn::GetAtt":["IAMOIDCProvider","clusterOIDCUrl"]}.

Environment

• **CLI Version : 1.16.297
• **Framework Version: 1.18.0 (build bc924bc)
• **OS : macos
• **Language : typescript

Other

Object creation stack:
  at new PolicyDocument (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/aws-iam/lib/policy-document.ts:33:26)
  at createAssumeRolePolicy (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/aws-iam/lib/role.ts:423:15)
  at new Role (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/aws-iam/lib/role.ts:294:29)
  at Object.<anonymous> (/Users/shunminw/works/lambda-layer-eksctl/cdk/lib/index.ts:218:33)
  at Module._compile (internal/modules/cjs/loader.js:956:30)
  at Module.m._compile (/usr/local/lib/node_modules/ts-node/src/index.ts:530:23)
  at Module._extensions..js (internal/modules/cjs/loader.js:973:10)
  at Object.require.extensions.<computed> [as .ts] (/usr/local/lib/node_modules/ts-node/src/index.ts:533:12)
  at Module.load (internal/modules/cjs/loader.js:812:32)
  at Function.Module._load (internal/modules/cjs/loader.js:724:14)
  at Function.Module.runMain (internal/modules/cjs/loader.js:1025:10)
  at main (/usr/local/lib/node_modules/ts-node/src/bin.ts:212:14)
  at Object.<anonymous> (/usr/local/lib/node_modules/ts-node/src/bin.ts:470:3)
  at Module._compile (internal/modules/cjs/loader.js:956:30)
  at Object.Module._extensions..js (internal/modules/cjs/loader.js:973:10)
  at Module.load (internal/modules/cjs/loader.js:812:32)
  at Function.Module._load (internal/modules/cjs/loader.js:724:14)
  at Function.Module.runMain (internal/modules/cjs/loader.js:1025:10)
  at /usr/local/lib/node_modules/npm/node_modules/libnpx/index.js:268:14.
Object creation stack:
  at new Intrinsic (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/aws-iam/node_modules/@aws-cdk/core/lib/private/intrinsic.ts:28:26)
  at new PostResolveToken (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/aws-iam/node_modules/@aws-cdk/core/lib/util.ts:83:5)
  at Object.ignoreEmpty (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/aws-iam/node_modules/@aws-cdk/core/lib/util.ts:38:9)
  at CfnRole._toCloudFormation (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/aws-iam/node_modules/@aws-cdk/core/lib/cfn-resource.ts:252:25)
  at /Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/core/lib/stack.ts:987:58
  at Object.findTokens (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/core/lib/private/resolve.ts:173:11)
  at Stack.findTokens (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/core/lib/stack.ts:987:24)
  at Stack.prepare (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/core/lib/stack.ts:645:25)
  at Function.prepare (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/core/lib/construct.ts:81:28)
  at Function.synth (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/core/lib/construct.ts:40:10)
  at App.synth (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/core/lib/app.ts:142:36)
  at process.<anonymous> (/Users/shunminw/works/lambda-layer-eksctl/cdk/node_modules/@aws-cdk/core/lib/app.ts:121:45)
  at Object.onceWrapper (events.js:300:26)
  at process.emit (events.js:210:5)
  at process.EventEmitter.emit (domain.js:476:20)
  at process.emit (/usr/local/lib/node_modules/ts-node/node_modules/source-map-support/source-map-support.js:485:21)
  at process.topLevelDomainCallback (domain.js:131:23).

---

This is 🐛 Bug Report

[eladb]

Here is a usage example:

const conditions = new CfnJson(this, 'ConditionJson', {
  value: {
    [`${cluster.openIdConnectProvider.openIdConnectProviderIssuer}:aud`]: 'sts.amazonaws.com',
    [`${cluster.openIdConnectProvider.openIdConnectProviderIssuer}:sub`]: `system:serviceaccount:${this.serviceAccountNamespace}:${this.serviceAccountName}`,
  },
});

const principal = new OpenIdConnectPrincipal(cluster.openIdConnectProvider).withConditions({
  StringEquals: conditions,
});

Source: https://github.com/aws/aws-cdk/blob/76c795ae37d4168e8a98b3bc81034b455a8ae05e/packages/%40aws-cdk/aws-eks/lib/service-account.ts#L71

[cdalar]

Is there an equvalent solution in Go?

@phenri00 and for who searching for a solution on golang. This is what I have done.

	conditions := awscdk.NewCfnJson(stack, jsii.String("ConditionClusterAutoscaler"), &awscdk.CfnJsonProps{
		Value: map[string]interface{}{
			*props.openIDConnectProvider.OpenIdConnectProviderIssuer() + ":sub": "system:serviceaccount:kube-system:cluster-autoscaler",
		},
	})

	awsiam.NewRole(stack, jsii.String("ClusterAutoscalerRole"), &awsiam.RoleProps{
		AssumedBy: awsiam.NewFederatedPrincipal(
			props.openIDConnectProvider.OpenIdConnectProviderArn(),
			&map[string]interface{}{
				"StringEquals": conditions,
			},
			jsii.String("sts:AssumeRoleWithWebIdentity"),
		),
		ManagedPolicies: &[]awsiam.IManagedPolicy{
			autoscalingPolicy,
		},
	})

props.openIDConnectProvider is an awsiam.OpenIdConnectProvider that you get from

	openIDConnectProvider := awsiam.NewOpenIdConnectProvider(stack, jsii.String("openIDConnect"), &awsiam.OpenIdConnectProviderProps{
		Url: cluster.ClusterOpenIdConnectIssuerUrl(),
		ClientIds: &[]*string{
			jsii.String("sts.amazonaws.com"),
		},
	})