Creating a role for IAM Roles anywhere requires a trust policy with sts:SetSourceIdentity

[royby-cyberark]

Hi,
i'm attempting to create a role for "iam role anywhere", and it requires the following trust policy:
I can add sts:TagSession with "aws_cdk.iam.ServicePrincipal.withSessionTags", but I see no way to add the SetSourceIdentity.
I was thinking that you simply provide a list of actions, but seeing "withSessionTags", I understand this isn't so.
what are my options, until something is implemented, maybe going with CfnRole?

///
"Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "rolesanywhere.amazonaws.com"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession",
                "sts:SetSourceIdentity"
            ]
}
...

Thank you for your help.
Roy.

[royby-cyberark]

So I guess this is missing from CDK,
until its added, I wrote this blog on IAM Roles anywhere, which also includes a fully working CDK example:

https://medium.com/cyberark-engineering/calling-aws-services-from-your-on-premises-servers-using-iam-roles-anywhere-3e335ed648be

Hope this helps someone

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[mohamed-jawad-etg]

I was stuck on this trying to create a role with trusted relationship for EKS Pod Identities and got that resolved by

const podsEksPrinciple=new cdk.aws_iam.ServicePrincipal('pods.eks.amazonaws.com')
const sessionTagsPrincipal = new cdk.aws_iam.SessionTagsPrincipal(podsEksPrinciple);
// IAM Role
const eksAuthRole = new cdk.aws_iam.Role(cluster, 'EksAuthRole', 
{
    assumedBy: sessionTagsPrincipal,
});

[nemec]

You can also update the role policy after creating the CDK Role object

const role = new Role(this, "MyRole", {
  assumedBy: new ServicePrincipal("rolesanywhere.amazonaws.com"),
  inlinePolicies: policies,
});
role.assumeRolePolicy?.addStatements(
  new PolicyStatement({
    effect: Effect.ALLOW,
    principals: [new ServicePrincipal("rolesanywhere.amazonaws.com")],
    actions: [
      "sts:AssumeRole",  // this is probably unnecessary since the CDK role creation also adds a policy for AssumeRole
      "sts:TagSession",
      "sts:SetSourceIdentity"
    ],
    conditions: {
      ...
    },
  }),
);