Role.addManagedPolicy does not work for imported roles

Inconsistent Behavior: aws_iam.Role.attachManagedPolicy vs aws_iam.ManagedPolicy.attachToRole

The Scenario

TLDR; aws_iam.Role.attachManagedPolicy does not attach the specified managed policy to the role, aws_iam.ManagedPolicy.attachToRole does.

I have two stacks: one stack deploys roles another deploys an application stack (both are in the same account). The roles stack is deployed first.

In the application stack, I would like to attach a managed policy to a role in the first.

Attempting to use aws_iam.Role.attachManagedPolicy does not create the association but aws_iam.ManagedPolicy.attachToRole does.

Environment

• CDK CLI Version: 1.39.0 (build 5d727c1)
• Module Version: 1.38.0
• Node.js Version: v14.0.0
• OS: macOS Mojave 10.14.6 (18G4032)
• Language: Typescript and Python

Other information

Steps to reproduce

1. Deploy one stack with an IAM role
2. In a second stack create a managed policy
3. In the second stack Import the role using aws_iam.Role.fromRoleArn (importedRole)
4. In the second stack attempt to add the managed policy to importedRole via importedRole.attachManagedPolicy

Observed

1. cdk synth does not show any associations made between the role and the managed policy
2. using ManagedPolicy.attachToRole works however

Expected

1. cdk synth (and subsequently) cdk deploy should associate the role and managed policy when Role.attachManagedPolicy is used

[jayhilden]

The workaround I found is below. It’s not perfect, but it’s pretty good:

1. define the policy statement(s)
2. create the managed policy with that policy statement
3. attach the policy statement to the imported role.

Example

const statement = new PolicyStatement({
    effect: Effect.ALLOW,
    actions: ['execute-api:Invoke'],
    resources: [
        //SOME RESOURCE
    ]
})
this.cloudAuthAccessPolicy = new ManagedPolicy(this, 'FOO', {
    managedPolicyName: 'FOO',
    description: "BAR",
    statements: [
        statement
    ]
})

const role = Role.fromRoleArn(this, `name`, `arn:aws:iam::${props.account}:role/SOME_ROLE_NAME`)
role.addToPolicy(statement)

[OperationalFallacy]

Just run into this bug, trying to configure some policies for roles managed outside of cdk app 😢