@mettlecast/domain-cdk-packer 0.2.50 → 0.2.52

package/dist/DomainStack.js

@@ -452,21 +452,23 @@ export class DomainStack extends cdk.Stack {
             domainBucket.grantReadWrite(fn);
         }
         // Replace the tenant-scoped role trust policy — only domain Lambdas can assume with tenantId tag
+        // Use a single Statement with ArnLike wildcard to stay under the 2048-byte ACL size limit
         const cfnRole = tenantScopedRole.node.defaultChild;
-        cfnRole.assumeRolePolicyDocument = cdk.Lazy.any({
-            produce: () => ({
-                Version: '2012-10-17',
-                Statement: allDomainLambdas.map(fn => ({
+        const accountId = cdk.Stack.of(this).account;
+        const stackPrefix = cdk.Stack.of(this).stackName;
+        cfnRole.assumeRolePolicyDocument = {
+            Version: '2012-10-17',
+            Statement: [{
                     Effect: 'Allow',
-                    Principal: { AWS: fn.role.roleArn },
+                    Principal: { AWS: accountId },
                     Action: ['sts:AssumeRole', 'sts:TagSession'],
                     Condition: {
                         StringLike: { 'aws:RequestTag/tenantId': '*' },
                         'ForAllValues:StringEquals': { 'sts:TransitiveTagKeys': ['tenantId'] },
+                        ArnLike: { 'aws:PrincipalArn': `arn:aws:iam::${accountId}:role/${stackPrefix}*` },
                     },
-                })),
-            }),
-        });
+                }],
+        };
         // Attach tenant-scoped storage policy to the tenant-scoped role
         const tenantStoragePolicies = iamBuilder.forTenantScopedStorage({
             tableArn: domainTable.tableArn,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.50",
+  "version": "0.2.52",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",