Unable to create Role policy: Resolution error due to infinite loop?

[schabe77]

Hi,
I'm using cdk 2.26.0 (build a409d63) and the java aws-cdk-lib and get an error on cdk synth. I don't know if I'm doing something wrong or if there is a bug. I try to create a role containing this policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::ACCOUNT_ID:oidc-provider/my-provider-domain.s3.eu-central-1.amazonaws.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "my-provider-domain.s3.eu-central-1.amazonaws.com:sub": [
                        "system:serviceaccount:account1",
                        "system:serviceaccount:account2"
                    ]
                }
            }
        }
    ]
}

my Stack class looks like this:

public class TestStack extends Stack {
    public TestStack(Construct parent) {
        super(parent, "test-stack");

        OpenIdConnectProvider provider = new OpenIdConnectProvider(this, "openid-connect-provider", OpenIdConnectProviderProps.builder()
                .url("https://my-provider-domain.s3.eu-central-1.amazonaws.com")
                .clientIds(List.of("sts.amazonaws.com"))
                .build());

        OpenIdConnectPrincipal principal = new OpenIdConnectPrincipal(provider, Map.of("ForAnyValue:StringEquals",
                CfnJson.Builder.create(this, "CfnJson")
                        .value(Map.of(provider.getOpenIdConnectProviderIssuer() + ":sub",
                                List.of("system:serviceaccount:account1", "system:serviceaccount:account2")))
                        .build()));

        Role role = new Role(this, "myRolename", RoleProps.builder()
                .assumedBy(principal)
                .build());

        PolicyStatement assumeRolePolicy = new PolicyStatement(PolicyStatementProps.builder()
                .actions(List.of("sts:AssumeRoleWithWebIdentity"))
                .effect(Effect.ALLOW)
                .principals(List.of(principal))
                .build());
        role.getAssumeRolePolicy().addStatements(assumeRolePolicy);
    }
}

When running cdk synthI get this error:

Error: Resolution error: Resolution error: Resolution error: Trying to resolve() a Construct at /Resources/${Token[test-stack.logshipperRole.Resource.LogicalID.219]}/Properties/assumeRolePolicyDocument/Statement/0/Condition/ForAnyValue:StringEquals/node.
Object creation stack:
  at new PolicyDocument (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/aws-iam/lib/policy-document.js:1:758)
  at createAssumeRolePolicy (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/aws-iam/lib/role.js:1:10465)
  at new Role (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/aws-iam/lib/role.js:1:1390)
  at /tmp/jsii-java-runtime6519317117772059611/lib/program.js:8171:58
  at Kernel._wrapSandboxCode (/tmp/jsii-java-runtime6519317117772059611/lib/program.js:8592:24)
  at Kernel._create (/tmp/jsii-java-runtime6519317117772059611/lib/program.js:8171:34)
  at Kernel.create (/tmp/jsii-java-runtime6519317117772059611/lib/program.js:7919:29)
  at KernelHost.processRequest (/tmp/jsii-java-runtime6519317117772059611/lib/program.js:9506:36)
  at KernelHost.run (/tmp/jsii-java-runtime6519317117772059611/lib/program.js:9469:22)
  at Immediate._onImmediate (/tmp/jsii-java-runtime6519317117772059611/lib/program.js:9470:46)
  at processImmediate (node:internal/timers:466:21)..
    at resolve (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:2787)
    at Object.resolve (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:1136)
    at resolve (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:2958)
    at Object.resolve (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:1136)
    at resolve (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:2958)
    at Object.resolve (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:1136)
    at resolve (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:2958)
    at Object.resolve (/tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:1136)
    at /tmp/jsii-kernel-xJFE6c/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:2522
    at Array.map (<anonymous>) 

The comment at resolve.ts says "Must not be a Construct at this point, otherwise you probably made a typo mistake somewhere and resolve will get into an infinite loop recursing into child.parent <---> parent.children". But I don't know were this parent->child loop should occur.

What do I have to do to create a policy statement as provided?

[hamilton-earthscope]

Hello, from 2024. Did you ever figure this one out? Cheers

[hamilton-earthscope]

In my case, I was inadvertently passing an L2 construct to an L1 construct's constructor props by using a spread operator. Once I corrected the call to the constructor to pass only the props I intended, the Resolution Error went away.

The hint from the comment you quoted was helpful:

Must not be a Construct at this point, otherwise you probably made a typo mistake somewhere and resolve will get into an infinite loop recursing into child.parent <---> parent.children

[schabe77]

I have just tried it again (with cdk 2.137.0) and now it works as desired. The given source code creates the target Trusted Entity.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.