Closed jakauppila closed 3 years ago
Hello, thanks for reporting this.
You could simplify your code snippet down to
Use-STSRole -PolicyArn @{ Arn = 'arn:aws:iam::aws:policy/job-function/ViewOnlyAccess' } #other params
Would that be a reasonable solution?
The reason we are not simplifying this to be a string is that this specific input modeling is provided by the STS team. We could accept
Use-STSRole -PolicyArn 'arn:aws:iam::aws:policy/job-function/ViewOnlyAccess'
based on the fact that Amazon.SecurityToken.Model.PolicyDescriptorType
has a single property (Arn
) but that will break if, in the future, the STS team decides to add other properties to PolicyDescriptorType
(this actually happens frequently).
Hi @jakauppila,
Please let me know if the workaround provided by @matteo-prosperi works for you and if we could close this issue.
Thanks, Ashish
This issue has not recieved a response in 2 weeks. If you want to keep this issue open, please just leave a comment below and auto-close will be canceled.
Expected Behavior
When I am assuming a role via
Use-STSRole
I want to pass a managed policy ARN to restrict its access. I want to be able to pass a string or array of strings of those ARNs.Current Behavior
PolicyArn
is required to be of typePolicyDescriptorType[]
per the documentation, which means I must do the following:Possible Solution
Ideally, the cmdlet itself could do that conversion from
string
toAmazon.SecurityToken.Model.PolicyDescriptorType
so I don't have to be responsible for that conversion which doesn't appear to do anything of value for me anyways (like validation, etc)Your Environment
3.3.563.1 AWSPowerShell