fix(secretsmanager): update the resource policy document atomically - #168
Merged
JeroenSoeters merged 1 commit intoAug 10, 2026
Merged
Conversation
A resource policy is a single document applied wholesale; diffing its Statement array with set semantics lets a patch-mode update add a changed statement alongside the old one instead of replacing the document.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A resource policy is one document applied wholesale (PutResourcePolicy), but
resourcePolicycarried noupdateMethodhint, so itsStatementarray diffed with default set semantics. A patch-mode update that modifies a statement then ensures the new statement exists without removing the old one: the live policy ends up with both. Marking the fieldAtomic(same asiam/managedpolicy.policyDocumentand the CloudTrail event-selector fields) makes any change replace the whole document.This was previously masked: the conformance update phase for this fixture used to execute a hidden delete+create (the createOnly
secretIdreference diffed against the provider echo, planning a replacement on every update), which rebuilt the policy exactly. With the reference-vs-echo diff fixed in formae core (platform-engineering-labs/formae#617), the update runs in place for the first time and exposed the missing hint. Verified with a debug-conformance run against that formae branch.