如何在AWS CDK v2（TypeScript）中为iam.PolicyDocument添加自定义ID

使用AWS CDK v2（TypeScript）创建SQS队列及关联的IAM策略文档时，希望为策略添加格式为sqspolicy-${queueName}的Id，使其能在AWS控制台中显示，但找不到直接设置该Id的方法，现有代码如下：

addFifoQueueResources(queueName: string, isFifo: boolean, iscontentBasedDeduplication: boolean, accountId: any, region: any) {
  const cfnQueue = new sqs.CfnQueue(this, queueName, {
    queueName: queueName,
    fifoQueue: isFifo,
    delaySeconds:0,
    contentBasedDeduplication: iscontentBasedDeduplication,
    maximumMessageSize: 262144,
    messageRetentionPeriod:345600,        
    receiveMessageWaitTimeSeconds:0,
    visibilityTimeout: 30
  });

  const customPolicyDocument = new iam.PolicyDocument({
    // 希望在此处添加 Id: sqspolicy-${queueName}
    statements: [
        new iam.PolicyStatement({
            actions: ['SQS:*'],
            effect: iam.Effect.ALLOW,
            sid: `Sid-${queueName}`,
            principals: [
              new iam.ArnPrincipal(`arn:aws:iam::${accountId}:root`)
              ],
              resources: [
                `arn:aws:sqs:${region}:${accountId}:${queueName}`
            ]
        })
    ]
});

new sqs.CfnQueuePolicy(this, 'customPolicyDocument', {
  queues: [cfnQueue.attrQueueUrl],
  policyDocument: customPolicyDocument.toJSON()});}

CDK的iam.PolicyDocument构造器并未直接提供设置策略Id的参数，但可以通过修改toJSON()返回的序列化对象来添加该字段，具体修改如下：

将创建CfnQueuePolicy的代码中，policyDocument的赋值改为：

policyDocument: {
  ...customPolicyDocument.toJSON(),
  Id: `sqspolicy-${queueName}`
}

修改后的完整代码：

addFifoQueueResources(queueName: string, isFifo: boolean, iscontentBasedDeduplication: boolean, accountId: any, region: any) {
  const cfnQueue = new sqs.CfnQueue(this, queueName, {
    queueName: queueName,
    fifoQueue: isFifo,
    delaySeconds:0,
    contentBasedDeduplication: iscontentBasedDeduplication,
    maximumMessageSize: 262144,
    messageRetentionPeriod:345600,        
    receiveMessageWaitTimeSeconds:0,
    visibilityTimeout: 30
  });

  const customPolicyDocument = new iam.PolicyDocument({
    statements: [
        new iam.PolicyStatement({
            actions: ['SQS:*'],
            effect: iam.Effect.ALLOW,
            sid: `Sid-${queueName}`,
            principals: [
              new iam.ArnPrincipal(`arn:aws:iam::${accountId}:root`)
              ],
              resources: [
                `arn:aws:sqs:${region}:${accountId}:${queueName}`
            ]
        })
    ]
});

new sqs.CfnQueuePolicy(this, 'customPolicyDocument', {
  queues: [cfnQueue.attrQueueUrl],
  // 手动添加策略Id字段
  policyDocument: {
    ...customPolicyDocument.toJSON(),
    Id: `sqspolicy-${queueName}`
  }
});}

说明 #

IAM策略的Id字段属于可选属性，AWS CDK的高层封装类未暴露该配置项，因此通过扩展序列化后的JSON对象来补充这个字段，即可让策略Id在AWS控制台中正常显示。

内容的提问来源于stack exchange，提问作者iondevx