Search code examples
aws-cdk

What type of aws cdk role principal type do I use for a cross account role arn?

I need to replicate this in python cdk (let a role from another account assume this role)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "redshift.amazonaws.com",
                "AWS": "arn:aws:iam::1234:role/otheraccountrole"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Do I use ArnPrincipal or AccountPrincipal in the example below?

iam.Role(
    self,
    "thisaccountrole",
    assumed_by=iam.CompositePrincipal(
        iam.ServicePrincipal("redshift.amazonaws.com"),
        iam.???Principal("arn:aws:iam::12345:role/otheraccountrole")
    ),
    managed_policies=[...
Solution

  • You should be able to use ArnPrincipal since this implements IPrincipal. That enables you to pass the ARN of the role. See also the documentation of the class for more information.