EcrMirror creating malformed role policy

[doiron]

I'm trying to use EcrMirror in a new simple stack that only has two resources. Currently using aws-delivlib "version": "14.0.26".

1. a Secrets Manager Secret object for the Docker creds
2. EcrMirror to replicate jsii/superchain from docker to avoid throttling errors.

when I tried to synth it and deploy it fails due to a malformed role policy

notice the resource value "${Token[Fn"

not sure how to solve this, any help would be appreciated.

"RegistrySyncEcrPushImagesRoleDefaultPolicyD43C38C0": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret"
       ],
       "Effect": "Allow",
       "Resource": {
        "Ref": "DockerCreds87A00671"
       }
      },
      {
       "Action": "secretsmanager:GetSecretValue",
       "Effect": "Allow",
       "Resource": "${Token[Fn"  <---- here
      },
      {
       "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
       ],
       "Effect": "Allow",
       "Resource": [
        {...

full code sample TS file

export interface EcrProps extends DeploymentStackProps {}

/**
 * CloudFormation Stack containing EcrMirror logic to replicate
 *  docker jsii/superchain to ECR within the account.
 */
export class Ecr extends DeploymentStack {
  readonly ecrMirror: EcrMirror;

  constructor(scope: App, id: string, props: EcrProps) {
    super(scope, id, props);

    const credentials = new Secret(this, "foo", {
      secretName: "foo-credentials",
      description: "Contains the Docker Login Credentials for foo.",
    });

    // // docker image repo
    this.ecrMirror = new EcrMirror(this, "RegistrySync", {
      sources: [MirrorSource.fromDockerHub("jsii/superchain", "1-buster-slim-node16"), MirrorSource.fromDockerHub("python", "3.6")],
      dockerHubCredentials: {
        secret: credentials,
        usernameKey: "user",
        passwordKey: "pass",
      },
      schedule: Schedule.cron({
        minute: "0",
        hour: "23",
      }),
    });
  }

}

[doiron]

just tried to update to the latest as of today "version": "14.0.28" with same results.

[doiron]

I was able to overcome this by removing the Secret object from this stack and then leveraging Secret.fromSecretPartialArn for the DockerHubCredentials/secret field. Similar to what the unit tests appear to be doing in this package.

dockerHubCredentials: {
        secret: Secret.fromSecretPartialArn(
          this,
          "foo-credentials",
          "arn:aws:secretsmanager:us-east-1:111111111111:secret:foo-credentials",
        ),
        ...

however would be nice to be able to supply the Secret object directly instead as in my example.

[github-actions]

This issue is now marked as stale because it hasn't seen activity for a while. Add a comment or it will be closed soon. If you wish to exclude this issue from being marked as stale, add the "backlog" label.

[github-actions]

Closing this issue as it hasn't seen activity for a while. Please add a comment @mentioning a maintainer to reopen. If you wish to exclude this issue from being marked as stale, add the "backlog" label.