bug: cannot suppress Resource::* on IAM Role with managed policy that uses *-Resource

[ArneOttenVW]

What is the problem?

I get an AwsSolutions-IAM5[Resource:**] error on a Role that is using the AWS managed policy AmazonECSTaskExecutionRolePolicy, even though I am suppressing it. The managed policy is using the *-Resource, which is the error I want to suppress.

Reproduction Steps

const executionRole = new iam.Role(this, 'TaskExecutionRole', {
  roleName: `FrontendExecutionRole`,
  assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
  managedPolicies: [{ managedPolicyArn: 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy' }]
});
NagSuppressions.addResourceSuppressions(executionRole, 
  [
    { id: 'AwsSolutions-IAM4', reason: 'Needed for every task execution role.' },
    { id: 'AwsSolutions-IAM5', reason: 'Managed policy uses * resource identifier.', appliesTo: ['Resource::*'] }
  ],
  true
);

cdk synth --quiet

[Error at /FrontendStack/FrontendService/TaskExecutionRole/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission. Metadata explaining the evidence (e.g. via supporting links) for wildcard permissions allows for transparency to operators. This is a granular rule that returns individual findings that can be suppressed with 'appliesTo'. The findings are in the format 'Action::<action>' for policy actions and 'Resource::<resource>' for resources. Example: appliesTo: ['Action::s3:*'].

What did you expect to happen?

The error should be supressed.

What actually happened?

The error is still showing up, even with the applyToChildren option. The only way I could find to suppress it is to provide the full path with NagSuppressions.addResourceSuppressionsByPath.

cdk-nag version

2.27.167

Language

Typescript

Other information

No response

[dontirun]

I'm unable to reproduce the error with the given snippet as the default policy has not been generated at this point (see below CloudFormation)

 {
 "Resources": {
  "TaskExecutionRole250D2532": {
   "Type": "AWS::IAM::Role",
   "Properties": {
    "AssumeRolePolicyDocument": {
     "Statement": [
      {
       "Action": "sts:AssumeRole",
       "Effect": "Allow",
       "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
       }
      }
     ],
     "Version": "2012-10-17"
    },
    "ManagedPolicyArns": [
     "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
    ],
    "RoleName": "FrontendExecutionRole"
   },
   "Metadata": {
    "aws:cdk:path": "test-iam-stack/TaskExecutionRole/Resource",
    "cdk_nag": {
     "rules_to_suppress": [
      {
       "reason": "Managed policy uses * resource identifier.",
       "id": "AwsSolutions-IAM5",
       "applies_to": [
        "Resource::*"
       ]
      }
     ]
    }
   }
  },

You will need to move the suppression to after the Policy has been created, which in this case is probably after the ECS Task using this role has been initialized

[ArneOttenVW]

I see. I moved the supression down and that solved my issue. Thank you very much!