diff --git a/packages/@aws-cdk/aws-iam/lib/policy-statement.ts b/packages/@aws-cdk/aws-iam/lib/policy-statement.ts index 2c07104874c1a..425a69e6b8a4d 100644 --- a/packages/@aws-cdk/aws-iam/lib/policy-statement.ts +++ b/packages/@aws-cdk/aws-iam/lib/policy-statement.ts @@ -167,7 +167,8 @@ export class PolicyStatement { * Add a condition to the Policy */ public addCondition(key: string, value: any) { - this.condition[key] = value; + const existingValue = this.condition[key]; + this.condition[key] = existingValue ? { ...existingValue, ...value } : value; } /** diff --git a/packages/@aws-cdk/aws-iam/test/policy-document.test.ts b/packages/@aws-cdk/aws-iam/test/policy-document.test.ts index 3f5388e6d75de..1b4e359e98d4b 100644 --- a/packages/@aws-cdk/aws-iam/test/policy-document.test.ts +++ b/packages/@aws-cdk/aws-iam/test/policy-document.test.ts @@ -572,4 +572,19 @@ describe('IAM polocy document', () => { expect(stack.resolve(doc1)).toEqual(stack.resolve(doc2)); }); + + test('adding another condition with the same operator does not delete the original', () => { + const stack = new Stack(); + + const p = new PolicyStatement(); + + p.addCondition('StringEquals', { 'kms:ViaService': 'service' }); + + p.addAccountCondition('12221121221'); + + expect(stack.resolve(p.toStatementJson())).toEqual({ + Effect: 'Allow', + Condition: { StringEquals: { 'kms:ViaService': 'service', 'sts:ExternalId': '12221121221' } } + }); + }); });