in aws-sso-permissionset/src/main/java/software/amazon/sso/permissionset/actionProxy/ManagedPolicyAttachmentProxy.java [33:52]
public void updateManagedPolicyAttachment(String instanceArn,
String permissionSetArn,
List<String> updatedManagedPolicies) {
if (updatedManagedPolicies != null && updatedManagedPolicies.size() > 0) {
//This is set to match IAM hard limit of role managed policy attachment policy.
if (updatedManagedPolicies.size() > 20) {
throw new CfnServiceLimitExceededException(ResourceModel.TYPE_NAME, MANAGED_POLICIES_LIMIT_EXCEED_MESSAGE);
}
List<String> attachedManagedPolicies = getAttachedManagedPolicies(instanceArn, permissionSetArn);
Set<String> previousManagedPolicies = new HashSet<>(attachedManagedPolicies);
Set<String> newManagedPolicies = new HashSet<>(updatedManagedPolicies);
Set<String> managedPoliciesToDetach = Sets.difference(previousManagedPolicies, newManagedPolicies);
Set<String> managedPoliciesToAttach = Sets.difference(newManagedPolicies, previousManagedPolicies);
detachManagedPolicies(managedPoliciesToDetach, instanceArn, permissionSetArn);
attachManagedPolicies(managedPoliciesToAttach, instanceArn, permissionSetArn);
}
}