Adding managed policy aws with cdk

Question

I am trying to add a managed policy to a role that contains an account id:

    const role = iam.Role.fromRoleArn(
          this,
          'Role',
          `arn:aws:iam::${cdk.Stack.of(this).account}:role/example-role`,
        );
    
        role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonDynamoDBFullAccess'));
        role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonKinesisFullAccess'));

on the aws console i can't see the policy being added to the role.

fyi My aws-cli is logged with the right account.

Answer 1

Unfortunately, CDK cannot modify external resources. So the changes will go through, but will have no effect.

The proper way is to create the role with CDK and add the policy in the same place where you're creating the role.

Here's a relevant excerpt from the documentation:

Although you can use an external resource anywhere you'd use a similar resource defined in your AWS CDK app, you cannot modify it. For example, calling addToResourcePolicy (Python: add_to_resource_policy) on an external s3.Bucket does nothing.