fix(amplify): add the default amplify policy to the auto-generated role

packages/@aws-cdk/aws-amplify-alpha/lib/app.ts

@@ -155,7 +155,7 @@ export interface AppProps {
    * The IAM service role to associate with the application. The App
    * implements IGrantable.
    *
-   * @default - a new role is created
+   * @default - a new role is created with the AdministratorAccess-Amplify managed policy attached
    */
   readonly role?: iam.IRole;
 
@@ -224,6 +224,7 @@ export class App extends Resource implements IApp, iam.IGrantable {
 
     const role = props.role || new iam.Role(this, 'Role', {
       assumedBy: new iam.ServicePrincipal('amplify.amazonaws.com'),
+      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess-Amplify')],
     });
     this.grantPrincipal = role;
 
@@ -239,7 +240,7 @@ export class App extends Resource implements IApp, iam.IGrantable {
         buildSpec: props.autoBranchCreation.buildSpec && props.autoBranchCreation.buildSpec.toBuildSpec(),
         enableAutoBranchCreation: true,
         enableAutoBuild: props.autoBranchCreation.autoBuild ?? true,
-        environmentVariables: Lazy.any({ produce: () => renderEnvironmentVariables(this.autoBranchEnvironmentVariables ) }, { omitEmptyArray: true }), // eslint-disable-line max-len
+        environmentVariables: Lazy.any({ produce: () => renderEnvironmentVariables(this.autoBranchEnvironmentVariables) }, { omitEmptyArray: true }), // eslint-disable-line max-len
         enablePullRequestPreview: props.autoBranchCreation.pullRequestPreview ?? true,
         pullRequestEnvironmentName: props.autoBranchCreation.pullRequestEnvironmentName,
         stage: props.autoBranchCreation.stage,

packages/@aws-cdk/aws-amplify-alpha/test/app.test.ts

@@ -113,6 +113,21 @@ test('create an app connected to a GitLab repository', () => {
       ],
       Version: '2012-10-17',
     },
+    ManagedPolicyArns: [
+      {
+        'Fn::Join': [
+          '',
+          [
+            'arn:',
+            {
+              Ref: 'AWS::Partition',
+            },
+            ':iam::aws:policy/AdministratorAccess-Amplify',
+          ],
+        ],
+      },
+    ],
+
   });
 });
 

packages/@aws-cdk/aws-amplify-alpha/test/integ.app-asset-deployment.js.snapshot/cdk-amplify-app-asset-deployment.template.json

@@ -14,7 +14,21 @@
       }
      ],
      "Version": "2012-10-17"
-    }
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/AdministratorAccess-Amplify"
+       ]
+      ]
+     }
+    ]
    }
   },
   "AppF1B96344": {

packages/@aws-cdk/aws-amplify-alpha/test/integ.app-codecommit.js.snapshot/cdk-amplify-codecommit-app.template.json

@@ -20,7 +20,21 @@
       }
      ],
      "Version": "2012-10-17"
-    }
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/AdministratorAccess-Amplify"
+       ]
+      ]
+     }
+    ]
    }
   },
   "AppRoleDefaultPolicy9CADBAA1": {

packages/@aws-cdk/aws-amplify-alpha/test/integ.app.js.snapshot/cdk-amplify-app.template.json

@@ -14,7 +14,21 @@
       }
      ],
      "Version": "2012-10-17"
-    }
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/AdministratorAccess-Amplify"
+       ]
+      ]
+     }
+    ]
    }
   },
   "AppAppBasicAuthE743F015": {
@@ -70,6 +84,7 @@
     "CustomRules": [
      {
       "Source": "/source",
+      "Status": "302",
       "Target": "/target"
      }
     ],

packages/@aws-cdk/aws-amplify-alpha/test/integ.app.ts

@@ -31,6 +31,9 @@ class TestStack extends Stack {
     amplifyApp.addCustomRule({
       source: '/source',
       target: '/target',
+      // NOTE: This is optional according to the API but Cloudformation is breaking without it
+      // Resource handler returned message: "Invalid request provided: Status field in rewrite custom rules should not be empty
+      status: amplify.RedirectStatus.TEMPORARY_REDIRECT,
     });
 
     const mainBranch = amplifyApp.addBranch('main');