bedrock-agentcore: `addToRolePolicy` for runtime with imported role destroys and recreates policies on every deployment

[go-to-k]

Describe the bug

The current addToRolePolicy for Runtime with imported role destroys and recreates policies on every deployment.

The reason is that Date.now() is used for a construct ID of a new Policy in the situation:

https://github.com/aws/aws-cdk/blob/v2.221.0/packages/%40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-base.ts#L253

  public addToRolePolicy(statement: iam.PolicyStatement): IBedrockAgentRuntime {
    // Check if role is a concrete Role instance
    if (this.role instanceof iam.Role) {
      this.role.addToPolicy(statement);
    } else {
      // For imported roles (IRole), we need to attach via a new policy
      const policy = new iam.Policy(this, `CustomPolicy${Date.now()}`, {
        statements: [statement],
      });

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

The diff will not occur.

Current Behavior

The diff will occur and destroy / recreate the policies.

Reproduction Steps

1. Deploy your stack with the following CDK code:

const app = new cdk.App();
const stack = new cdk.Stack(app, 'aws-cdk-bedrock-agentcore-runtime-with-imported-role');

const runtimeArtifact = agentcore.AgentRuntimeArtifact.fromAsset(
  path.join(__dirname, 'testArtifact'),
);

const role = new iam.Role(stack, 'ExecutionRole', {
  assumedBy: new iam.ServicePrincipal('bedrock-agentcore.amazonaws.com'),
});
const imported = iam.Role.fromRoleArn(stack, 'ImportedRole', role.roleArn);

const runtime = new agentcore.Runtime(stack, 'TestRuntime', {
  runtimeName: 'integ_test_runtime',
  agentRuntimeArtifact: runtimeArtifact,
  executionRole: imported,
});

runtime.addToRolePolicy(new iam.PolicyStatement({
  actions: ['dynamodb:Query'],
  resources: ['arn:aws:dynamodb:us-east-1:123456789012:table/my-table'],
}));

2. Deploy or diff the stack with the same CDK code again.

3. The change will occur:

      [-] AWS::IAM::Policy TestRuntimeCustomPolicy1761380931769044921D2 destroy
      [+] AWS::IAM::Policy TestRuntimeCustomPolicy1761381522330E0DC0D40

Possible Solution

Add a policy counter and change the construct ID with the counter:

  /**
   * Counter for policies attached to imported roles
   * @internal
   */
  private _policyCounter: number = 0;

    } else {
      // For imported roles (IRole), we need to attach via a new policy
-      const policy = new iam.Policy(this, `CustomPolicy${Date.now()}`, {
+      const policy = new iam.Policy(this, `CustomPolicy${this._policyCounter++}`, {
        statements: [statement],
      });

The approach has already been used in lambda:

• https://github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-lambda/lib/function-base.ts#L331
• https://github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-lambda/lib/function-base.ts#L432

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

v2.221.0

AWS CDK CLI version

2.1030.0

Node.js Version

v22.14.0

OS

Mac

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Hi @go-to-k,

Thank you for identifying this issue and providing such a thorough analysis with a working fix! The problem you've identified is valid - using Date.now() for construct IDs in the RuntimeBase.addToRolePolicy() method causes policies to be recreated on every deployment when using imported roles.

Your proposed solution of using a counter-based approach is the correct pattern, as evidenced by the same implementation in FunctionBase. The fix in PR #35842 looks good - it includes both unit tests and an integration test that validates the behavior with multiple addToRolePolicy() calls.

The root cause is that construct IDs must be stable across synthesis runs to maintain CloudFormation resource identity. Using Date.now() violates this requirement, while a counter ensures each policy gets a unique but stable identifier (CustomPolicy0, CustomPolicy1, etc.).

We appreciate your contribution to improving the CDK! If you'd like to contribute similar fixes or enhancements in the future, we welcome your PRs as always 💯 .

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.