{"action":"created","issue":{"url":"https://api.github.com/repos/awslabs/aws-cdk/issues/622","repository_url":"https://api.github.com/repos/awslabs/aws-cdk","labels_url":"https://api.github.com/repos/awslabs/aws-cdk/issues/622/labels{/name}","comments_url":"https://api.github.com/repos/awslabs/aws-cdk/issues/622/comments","events_url":"https://api.github.com/repos/awslabs/aws-cdk/issues/622/events","html_url":"https://github.com/awslabs/aws-cdk/issues/622","id":353473517,"node_id":"MDU6SXNzdWUzNTM0NzM1MTc=","number":622,"title":"IAM: Problems sythesizing a role that can read from an SQS queue","user":{"login":"millems","id":24903526,"node_id":"MDQ6VXNlcjI0OTAzNTI2","avatar_url":"https://avatars0.githubusercontent.com/u/24903526?v=4","gravatar_id":"","url":"https://api.github.com/users/millems","html_url":"https://github.com/millems","followers_url":"https://api.github.com/users/millems/followers","following_url":"https://api.github.com/users/millems/following{/other_user}","gists_url":"https://api.github.com/users/millems/gists{/gist_id}","starred_url":"https://api.github.com/users/millems/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/millems/subscriptions","organizations_url":"https://api.github.com/users/millems/orgs","repos_url":"https://api.github.com/users/millems/repos","events_url":"https://api.github.com/users/millems/events{/privacy}","received_events_url":"https://api.github.com/users/millems/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-08-23T17:09:17Z","updated_at":"2018-08-24T20:00:28Z","closed_at":null,"author_association":"NONE","body":"Java code:\r\n```Java\r\nQueue queue = new Queue(this, \"source-import-queue\",\r\n                        QueueProps.builder()\r\n                                  .withQueueName(\"source-import\")\r\n                                  .build());\r\n\r\nBucket bucket = new Bucket(this, \"source-import-bucket\",\r\n                           BucketProps.builder()\r\n                                      .withBucketName(\"source-import\")\r\n                                      .build());\r\nbucket.onObjectCreated(queue);\r\nbucket.addLifecycleRule(LifecycleRule.builder()\r\n                                     .withExpirationInDays(30)\r\n                                     .build());\r\n\r\nPolicyStatement policyStatement = new PolicyStatement(PolicyStatementEffect.Allow);\r\npolicyStatement.addActions(\"ReceiveMessage\", \"DeleteMessage\", \"DeleteMessageBatch\");\r\npolicyStatement.addResource(queue);\r\n\r\nRole role = new Role(this, \"source-import-queue-reader\",\r\n                     RoleProps.builder()\r\n                              .withAssumedBy(new AccountPrincipal(\"12345\"))\r\n                              .withRoleName(\"source-import-queue-reader\")\r\n                              .build());\r\nrole.addToPolicy(policyStatement);\r\n```\r\n\r\nExpected Behavior: Create a role with a policy that allows reading from the queue.\r\n\r\nActual Behavior:\r\n```\r\nException in thread \"main\" software.amazon.jsii.JsiiException: While synthesizing hello-cdk/source-import-queue-reader/DefaultPolicy/Resource: Trying to resolve() a Construct at /policyDocument/Statement/0/Resource\r\nWhile synthesizing hello-cdk/source-import-queue-reader/DefaultPolicy/Resource: Trying to resolve() a Construct at /policyDocument/Statement/0/Resource\r\n    --- resource created at ---\r\n    at new Policy (/private/tmp/jsii-kernel-aRMZR8/node_modules/@aws-cdk/aws-iam/lib/policy.js:22:26)\r\n    at Role.addToPolicy (/private/tmp/jsii-kernel-aRMZR8/node_modules/@aws-cdk/aws-iam/lib/role.js:39:34)\r\n    at _wrapSandboxCode (/private/var/folders/x4/0pn8hl6x4kz135bdrmgdlk7xmh2tn2/T/jsii-java-runtime6462445815484053124/jsii-runtime.js:1:84495)\r\n```\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/awslabs/aws-cdk/issues/comments/415867107","html_url":"https://github.com/awslabs/aws-cdk/issues/622#issuecomment-415867107","issue_url":"https://api.github.com/repos/awslabs/aws-cdk/issues/622","id":415867107,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNTg2NzEwNw==","user":{"login":"RomainMuller","id":411689,"node_id":"MDQ6VXNlcjQxMTY4OQ==","avatar_url":"https://avatars2.githubusercontent.com/u/411689?v=4","gravatar_id":"","url":"https://api.github.com/users/RomainMuller","html_url":"https://github.com/RomainMuller","followers_url":"https://api.github.com/users/RomainMuller/followers","following_url":"https://api.github.com/users/RomainMuller/following{/other_user}","gists_url":"https://api.github.com/users/RomainMuller/gists{/gist_id}","starred_url":"https://api.github.com/users/RomainMuller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RomainMuller/subscriptions","organizations_url":"https://api.github.com/users/RomainMuller/orgs","repos_url":"https://api.github.com/users/RomainMuller/repos","events_url":"https://api.github.com/users/RomainMuller/events{/privacy}","received_events_url":"https://api.github.com/users/RomainMuller/received_events","type":"User","site_admin":false},"created_at":"2018-08-24T20:00:28Z","updated_at":"2018-08-24T20:00:28Z","author_association":"CONTRIBUTOR","body":"I guess right now you have to be unfortunately aware of whether you're using a low-level class (will need you to use `Ref` or `GetAtt` accessors) or a higher-level class (will just get the object). That's not ideal 😔. Hopefully this fades out significantly as our L2 construct coverage expands and is not much of an issue anymore by then."}}
{"actor":{"display_login":"RomainMuller"}}