importedRoleStackSafeDefaultPolicyName feature flag results in excessively long IAM policy names

[DharmSonariya]

Describe the bug

When using the @aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName feature flag with the CDK pipeline, the CDK generates exceedingly long IAM policy names that exceed AWS's character limits.

Expected Behavior

The CDK should generate names that respect AWS's character limits regardless of feature flag settings.

Current Behavior

When this feature flag is enabled, I get an error indicating that the policy name has exceeded the maximum allowed length (128 characters). The error message is as follows:

CREATE_FAILED Properties validation failed for resource Route53CrossAccountZoneDelegationRecordcrossaccountzonedelegationhandlerrolePolicyCadPlatformtoolboxDevToolchainCdkPipelineDevCadPlatformDevRoute53CrossAccountZoneDelegationRecordcrossaccountzonedelegationhandlerrole195BFE8B8FD65C38 with message: #/PolicyName: expected maxLength: 128, actual: 148

Reproduction Steps

Enable the @aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName feature flag with the CDK pipeline,
Define a stack that imports an IAM role and attach policies to it.
Deploy the stack.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.99.1 (build b2a895e)

Framework Version

No response

Node.js Version

v18.18.0

OS

Ubuntu 23.04

Language

Python

Language Version

Python 3.11.5

Other information

No response

[peterwoodworth]

Can you please share a minimal code sample? I'm not exactly sure how you're using the role

[DharmSonariya]

Certainly, please find the code below:

    route53.CrossAccountZoneDelegationRecord(
        self,
        "CrossAccountZoneDelegationRecord",
        delegated_zone=self._public_hosted_zone,
        parent_hosted_zone_name=constants.MY_PUBLIC_DOMAIN,
        delegation_role=self.delegation_role,
    )

[peterwoodworth]

Thanks, I see what's going on here.

The feature flag makes use of Names.uniqueId(). The max length when using this method is 256

aws-cdk/packages/aws-cdk-lib/core/lib/private/uniqueid.ts

Line 30 in 495dafa

* @returns a unique alpha-numeric identifier with a maximum length of 255

I wonder if it would have been better to use Names.uniqueResoureName() instead, it allows for setting the max length option directly.

aws-cdk/packages/aws-cdk-lib/core/lib/names.ts

Line 83 in 495dafa

public static uniqueResourceName(construct: IConstruct, options: UniqueResourceNameOptions) {

It may be a better call to truncate the result returned from Names.uniqueId() here since we're already using this method

aws-cdk/packages/aws-cdk-lib/aws-iam/lib/private/imported-role.ts

Line 49 in 495dafa

? `Policy${Names.uniqueId(this)}`

[isacaraujo]

There's an older issue: #24441

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.