IAM: Python show error of type ServicePrincipal

[canle1404]

Describe the bug

I'm using pyright and it shows this error message. However, my stack is still able to be deployed.

Argument of type "ServicePrincipal" cannot be assigned to parameter "assumed_by" of type "IPrincipal" in function "__init__" Pyright (reportArgumentType) [33, 24]
     "ServicePrincipal" is incompatible with protocol "IPrincipal" 
       "IPrincipal" is incompatible with "ServicePrincipal" 
       "IPrincipal" is incompatible with "ServicePrincipal" 
       "IPrincipal" is incompatible with "ServicePrincipal" 
       "add_to_principal_policy" is an incompatible type 
         Type "(_statement: PolicyStatement) -> AddToPrincipalPolicyResult" is incompatible with type "(statement: PolicyStatement) -> AddToPrincipalPolicyResult" 
           Parameter name mismatch: "statement" versus "_statement" 
       "IGrantable" is incompatible with "ServicePrincipal" 

Expected Behavior

No error message

Current Behavior

error message

Reproduction Steps

• Install pyright
• Init a Python CDK project
• Create a role, e.g

from aws_cdk import Stack, aws_iam as iam
from constructs import Construct

class PycdkStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        role = iam.Role(
            self, "Role", assumed_by=iam.ServicePrincipal("ec2.amazonaws.com")
        )

• Run pyright ./stack.py

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.144.0 (build 5fb15bc)

Framework Version

No response

Node.js Version

v20.12.1

OS

Ubuntu 22.04

Language

Python

Language Version

3.10.12

Other information

pyright 1.1.365

[ashishdhingra]

@canle1404 Good morning. The above code synthesizes successfully using cdk synth giving below output:

Resources:
  Role1ABCC5F0:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
        Version: "2012-10-17"
    Metadata:
      aws:cdk:path: PythonStack/Role/Resource
...
...

Running pyright <<stack.py>> returns the below error:

error: Argument of type "ServicePrincipal" cannot be assigned to parameter "assumed_by" of type "IPrincipal" in function "__init__"
    "ServicePrincipal" is incompatible with protocol "IPrincipal"
      "IPrincipal" is incompatible with "ServicePrincipal"
      "IPrincipal" is incompatible with "ServicePrincipal"
      "IPrincipal" is incompatible with "ServicePrincipal"
      "add_to_principal_policy" is an incompatible type
        Type "(_statement: PolicyStatement) -> AddToPrincipalPolicyResult" is incompatible with type "(statement: PolicyStatement) -> AddToPrincipalPolicyResult"
          Parameter name mismatch: "statement" versus "_statement"
      "IGrantable" is incompatible with "ServicePrincipal" (reportArgumentType)

However,

• iam.assumedBy is of type IPrincipal
• ServicePrincipal extends PrincipalBase, which further implements IAssumeRolePrincipal > IPrincipal.

Per inheritance and polymorphism rules, it should be possible to assign ServicePrincipal concrete type to interface type IPrincipal (not vice versa).

The pyright static type checker is also checking the parameter names like Parameter name mismatch: "statement" versus "_statement". I'm unsure if it is possible to limit the scope of the pyright to the current code stack, rather than installed libraries. Perhaps, you could try opening discussion in https://github.com/microsoft/pyright repository for guidance.

Thanks,
Ashish

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[shea-parkes]

I suppose it's too much to ask Amazon devs and Microsoft devs to work together to fix this one? (Amazon devs on this CDK and Microsoft devs on pyright...)

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.