aws_iam: item 0 is not compatible with the IManagedPolicy protocol because it has no method named '__jsii_proxy_class__'

[CollinAlpert]

Describe the bug

When creating an IAM role, the deployment fails due to an issue with the IManagedPolicy protocol. I noticed this bug after updating the CDK dependency, however now even going back to an older version does not fix the issue.

I only notice this when the deployment is run via GitHub Actions, locally (macOS Silicon) the issue is not reproducible.

Regression Issue

• [ ] Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

The deployment succeeds and the changes are applied.

Current Behavior

The deployment fails with the following stack trace:

Traceback (most recent call last):
  File "/home/runner/work/id-database/id-database/celery_project/app.py", line 311, in <module>
    IdDatabaseFargateStack(app, f"IdDatabaseFargateStack{os.getenv('CDK_POSTFIX')}", env=env, stack_name=f"IdDatabaseFargateStack{os.getenv('CDK_POSTFIX')}")
  File "/opt/hostedtoolcache/Python/3.12.7/x64/lib/python3.12/site-packages/jsii/_runtime.py", line 118, in __call__
    inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/id-database/id-database/celery_project/app.py", line 79, in __init__
    ecs_task_execution_role = iam.Role(
                              ^^^^^^^^^
  File "/opt/hostedtoolcache/Python/3.12.7/x64/lib/python3.12/site-packages/jsii/_runtime.py", line 118, in __call__
    inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/hostedtoolcache/Python/3.12.7/x64/lib/python3.12/site-packages/aws_cdk/aws_iam/__init__.py", line 12921, in __init__
    props = RoleProps(
            ^^^^^^^^^^
  File "/opt/hostedtoolcache/Python/3.12.7/x64/lib/python3.12/site-packages/aws_cdk/aws_iam/__init__.py", line 10751, in __init__
    check_type(argname="argument managed_policies", value=managed_policies, expected_type=type_hints["managed_policies"])
  File "/opt/hostedtoolcache/Python/3.12.7/x64/lib/python3.12/site-packages/aws_cdk/aws_iam/__init__.py", line 881, in check_type
    typeguard.check_type(value=value, expected_type=expected_type, collection_check_strategy=typeguard.CollectionCheckStrategy.ALL_ITEMS) # type:ignore
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/hostedtoolcache/Python/3.12.7/x64/lib/python3.12/site-packages/typeguard/_functions.py", line 106, in check_type
    check_type_internal(value, expected_type, memo)
  File "/opt/hostedtoolcache/Python/3.12.7/x64/lib/python3.12/site-packages/typeguard/_checkers.py", line 861, in check_type_internal
    checker(value, origin_type, args, memo)
  File "/opt/hostedtoolcache/Python/3.12.7/x64/lib/python3.12/site-packages/typeguard/_checkers.py", line 433, in check_union
    raise TypeCheckError(f"did not match any element in the union:\n{formatted_errors}")
typeguard.TypeCheckError: list did not match any element in the union:
  Sequence[aws_cdk.aws_iam.IManagedPolicy]: item 0 is not compatible with the IManagedPolicy protocol because it has no method named '__jsii_proxy_class__'
  NoneType: is not an instance of NoneType
Subprocess exited with error 1

Reproduction Steps

This is the problematic code:

ecs_task_execution_role = iam.Role(
    self,
    "ecsTaskExecutionRole",
    assumed_by=iam.ServicePrincipal("ecs-tasks.amazonaws.com"),
    managed_policies=[
        iam.ManagedPolicy.from_aws_managed_policy_name("service-role/AmazonECSTaskExecutionRolePolicy")
    ]
)

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.162.0

Framework Version

No response

Node.js Version

20.17.0

OS

Linux

Language

Python

Language Version

3.12.7

Other information

No response

[khushail]

@CollinAlpert , thanks for reaching out.

Yes, I tried to locally repro the issue but it succeeded in deployment.

Although from the error it looks like its related to JSII repo. Trying to repro it using github actions though.

[khushail]

@CollinAlpert , team is tracking this issue -https://github.com/aws/aws-cdk/issues/31749 and this is related to the issue you are facing. So I am moving this issue to JSII Repo for further action.

[medley56]

I think aws/jsii#4657 is related to this. With the massive typeguard bump in aws-cdk 2.158, I suspect there will be a lot of these issue coming out of the woodwork.

[mrgrain]

Same as https://github.com/aws/jsii/issues/4658 we are tracking this over there.

[github-actions[bot]]

This issue is now closed. Comments on closed issues are hard for our team to see. If you need more assistance, please open a new issue that references this one.