How can I create a valid SQS Arn with aws-cdk-lib.Arn.format()?

[egriffith]

Describe the bug

It does not appear to actually be possible to craft an SQS queue arn using the available formatters in aws-cdk-lib.Arn.format() and aws-cdk-lib.ArnFormat.

The docs define an SQS queue arn as being:

arn:aws:sqs:region:account_id:queue_name

Notice that there is no resource-type name and the separator between account id and the resource itself is -exclusively- a colon.

I'm using the following TypeScript snippet:

import * as cdk from 'aws-cdk-lib';

const QueueArn = cdk.Arn.format(
    {
        arnFormat: cdk.ArnFormat.NO_RESOURCE_NAME
        region: "us-east-1",
        service: "sqs",
        account: "111122223333",
        resource: "",
        resourceName: "AutoAckQueue-gamma",
    }, this
)

This arn then gets used to craft an IAM policy. The resulting IAM policy however ends up looking like this..

   "Resource": {
    "Fn::Join": [
     "",
     [
      "arn:",
      {
       "Ref": "AWS::Partition"
      },
      ":sqs:us-east-1:111122223333:/AutoAckQueue-gamma"
     ]
    ]
   }

Note that there is a leading slash inserted before the resource identifier.

I see two problems with the current behavior.

1. aws-cdk-lib.Arn.Format() does not accept a "sep" argument where we could override that "sep" should be a "" rather than "/"

2. aws-cdk-lib.Arn.Format() has "resource" as a mandatory argument while most other arguments are optional, despite the fact that there are ARNs which do not include a resource name.

Expected Behavior

A leading slash should not be forcible inserted prior to the queue name at a minimum.

Current Behavior

A leading slash IS forcibly inserted prior to the queue name, and an argument that should be optional is required.

Reproduction Steps

See above code snippet

Possible Solution

Include an optional "sep" argument to aws-cdk-lib.Arn.format() that allows for overriding sep="/" with sep = ""

Additional Information/Context

No response

CDK CLI Version

2.27.0

Framework Version

No response

Node.js Version

NodeJS 14.x

OS

Amazon Linux 2

Language

Typescript

Language Version

No response

Other information

No response

[mrgrain]

Hi @egriffith

You can create a correct SQS Arn like this:

    const QueueArn = cdk.Arn.format(
      {
        arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
        region: "us-east-1",
        service: "sqs",
        account: "111122223333",
        resource: "AutoAckQueue-gamma",
      },
      this
    );

This results in the correct format:
➡️ arn:aws:sqs:us-east-1:111122223333:AutoAckQueue-gamma

See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsqs.html#amazonsqs-resources-for-iam-policies

PS: I've converted this to a discussion topic, since it appears to be more of a question. Please let me know if you disagree.

[Isaac-Kleinman]

seems a bit hacky to use resource property for what is actually resourceName

[mrgrain]

seems a bit hacky to use resource property for what is actually resourceName

The resource prop is overloaded. This has been well documented, see
https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.ArnComponents.html#resource