fix: set policy effect deny when removing auth (#13523)

aws-amplify · Jan 9, 2024 · 73b08dc · 73b08dc
1 parent 89ae5ad
commit 73b08dc
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json b/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json
@@ -47,6 +47,8 @@
               "            try {",
               "                delete authParamsJson.Statement[0].Condition;",
               "                delete unauthParamsJson.Statement[0].Condition;",
+              "                authParamsJson.Statement[0].Effect = 'Deny'",
+              "                unauthParamsJson.Statement[0].Effect = 'Deny'",
               "                let authParams = {PolicyDocument: JSON.stringify(authParamsJson), RoleName: authRoleName};",
               "                let unauthParams = {PolicyDocument: JSON.stringify(unauthParamsJson), RoleName: unauthRoleName};",
               "                const iam = new IAMClient({region: event.ResourceProperties.region});",