[Bug]: managedPolicyArn array for Role broken in provider-aws-iam

[trevoredshelf]

Is there an existing issue for this?

• [X] I have searched the existing issues

Affected Resource(s)

iam.aws.upbound.io/v1beta1 - Role

Resource MRs required to reproduce the bug

apiVersion: iam.aws.upbound.io/v1beta1
kind: Role
metadata:
  annotations:
    meta.upbound.io/example-id: iam/v1beta1/role
  labels:
    testing.upbound.io/example-name: role
  name: role-with-inline-policy-new
spec:
  forProvider:
    description: test description
    forceDetachPolicies: true
    assumeRolePolicy: |
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
              "Service": "eks.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
          }
        ]
      }
    managedPolicyArns: [] ## reconciliation doesn't work
    # managedPolicyArns: ["arn:aws:iam::aws:policy/AdministratorAccess"] ## now reconciliation works
    inlinePolicy:
      - name: my_inline_policy
        policy: |
          {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Resource": "*",
                "Action": "ec2:*"
              }
            ]
          }

Steps to Reproduce

1. kubectl -f apply the manifest above
2. Add any managed policy to the role
3. Confirm after poll internal that managed policy was not detached from role

What happened?

In order for the managedPolicyArns array to work, there needs to be at least 1 policy included. If at least one policy exists in the array, Crossplane will successfully reconcile and remove any additional managed policies that get attached to the role. However, if the array is empty, reconciliation fails when managed policies are attached.

Relevant Error Output Snippet

No response

Crossplane Version

1.16.0

Provider Version

1.4.0

Kubernetes Version

No response

Kubernetes Distribution

No response

Additional Info

No response

[trevoredshelf]

Nevermind, it looks as though you just need to include an empty string in the empty array for managedPolicyArns to work.

[""] works but [] doesn't. Documentation just needs to be updated.

[chlunde]

@trevoredshelf can you try 1.5.0? I could not reproduce this issue.