Adding multiple service principals in CDK

Question

Does CDK let you add multiple service principals to a role?

```
const fnRole = new iam.Role(this, "some-role-id", {
   roleName: "redirect-function-role",
   assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com')  /* others? */
})
```

I tried a few things:
```
        fnRole.grantAssumeRole(new iam.ServicePrincipal('edgelambda.amazonaws.com'))
        fnRole.grant(new iam.ServicePrincipal('edgelambda.amazonaws.com'), "sts:AssumeRole")
```

These didn't seem to have any effect whatsoever (but no errors).

Saad · Accepted Answer

Yes, the AWS CDK allows you to add multiple service principals to an IAM Role. However, instead of using the `grantAssumeRole `method, you should use a `CompositePrincipal`. This allows you to combine multiple principals together.

Here's how you can do it:

```
import * as iam from '@aws-cdk/aws-iam';
import * as cdk from '@aws-cdk/core';
// ... inside your Stack
const role = new iam.Role(this, 'MyRole', {
  assumedBy: new iam.CompositePrincipal(
    new iam.ServicePrincipal('lambda.amazonaws.com'),
    new iam.ServicePrincipal('edgelambda.amazonaws.com')
  )
});

```

This code will create an IAM Role that can be assumed by both `lambda.amazonaws.com` and `edgelambda.amazonaws.com`.

The `CompositePrincipal `class allows you to combine multiple principal entities, making it a powerful tool when creating more complex IAM Policies.

Adding multiple service principals in CDK

Add your answer

Relevant content