(aws-sam): cannot generate string policies for CfnFunction

[spalladino]

The property CfnFunctionProps.policies accepts a list of both objects and strings. However, when I try to generate a list with a string, an empty object is generated instead.

Reproduction Steps

Running cdk synth with the following construct:

new CfnFunction(scope, 'MyFunction', {
  policies: ['AWSLambdaExecute']
});

What did you expect to happen?

  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - AWSLambdaExecute

What actually happened?

  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - {}

Environment

• CDK CLI Version : 1.80.0
• Framework Version:
• Node.js Version: 12.18.3
• OS : Ubuntu 19.10
• Language (Version):

Other

Note that if I use a string, instead of a list of strings, the output is correct.

new CfnFunction(scope, 'MyFunction', {
  policies: 'AWSLambdaExecute'
});

  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Policies: 'AWSLambdaExecute'

---

This is 🐛 Bug Report

[skinny85]

@spalladino you're missing a bunch of required properties in your code, I'm surprised it compiles...

This:

        new sam.CfnFunction(this, 'MyFunction', {
            codeUri: {
                bucket: 'my-bucket',
                key: 'my-key',
            },
            runtime: 'nodejs-12.x',
            handler: 'index.handler',
            policies: 'AWSLambdaExecute',
        });

Produces this for me:

Transform: AWS::Serverless-2016-10-31
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri:
        Bucket: my-bucket
        Key: my-key
      Handler: index.handler
      Runtime: nodejs-12.x
      Policies: AWSLambdaExecute
    Metadata:
      aws:cdk:path: TestStack/MyFunction

[skinny85]

Oh, I see what you're saying. The problem is for an array of strings, not a single string. Let me see.

[spalladino]

Sorry, I guess I went with a too minimal example - I only included the property that was causing trouble. Let me know if you need a more complete example to reproduce.

[skinny85]

No, I'm good, thanks. Let me dig into this one a little bit more. I suspect it might be a bug with our code generation.

[spalladino]

If I had to bet, I'd say the culprit is the SAMPolicyTemplateProperty defined as one of the possible property types before string. Since it doesn't have any required properties, the code generator may be thinking the string can be a valid SAMPolicyTemplateProperty, and thus outputs the empty object. And this doesn't happen when the string is not in an array because the SAMPolicyTemplateProperty is not a possible type then.