fix(cloudformation): AWS::IAM::ManagedPolicy exposes PolicyArn for Fn::GetAtt

[lex00]

Fixes #2082. (Refiles #2055, which was closed for having no description.)

CloudFormation documents PolicyArn as the Fn::GetAtt attribute for AWS::IAM::ManagedPolicy. The provisioner recorded the created policy only under Arn, so Fn::GetAtt [<policy>, PolicyArn] did not resolve and the unresolved literal propagated into whatever consumed it — typically a role's ManagedPolicyArns, which then failed with Policy <logicalId>.PolicyArn does not exist and rolled the stack back, several resources away from the cause.

Both keys are now recorded. Arn stays so anything already reading it is unaffected.

Test: managedPolicyExposesPolicyArnForGetAtt in CloudFormationIamAttachmentProvisionerTest asserts the provisioned resource carries PolicyArn, Arn and the physical id. 28 tests in that class pass.

Found while deploying a CDK-authored estate to Floci for aws-bench, where this rolled back the stack that creates the benchmark's QA roles.

[github-actions]

👋 Thanks for the pull request!

It looks like you now have 20 open pull requests in this repository, which is above our advisory limit of 5. To keep the review backlog focused and make sure every contribution gets proper attention, we ask contributors to shepherd their existing PRs to the finish line before opening new ones — responding to review feedback, rebasing, or closing any that are no longer needed.

Here is your list of open PRs. Nothing is blocked and this PR stays open — this is just a friendly nudge. The over-pr-limit label helps maintainers see at a glance which PRs to prioritize.

If some of these PRs are stacked or intentionally related, just say so here and a maintainer will take that into account.

[greptile-apps]

Greptile Summary

Adds the documented PolicyArn attribute for provisioned AWS::IAM::ManagedPolicy resources while preserving the existing Arn attribute, with unit coverage for both attributes and the physical ID.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/main/java/io/github/hectorvent/floci/services/cloudformation/CloudFormationResourceProvisioner.java	Records the created managed policy ARN under both PolicyArn and the backward-compatible Arn attribute.
src/test/java/io/github/hectorvent/floci/services/cloudformation/CloudFormationIamAttachmentProvisionerTest.java	Verifies that managed-policy provisioning exposes PolicyArn, retains Arn, and uses the ARN as the physical ID.

_{Reviews (2): Last reviewed commit: "fix(cloudformation): AWS::IAM::ManagedPo..." | Re-trigger Greptile}

[hectorvent]

@lex00 Thanks for the PR.
All looks good to me.

Reran the action as failed because a flaky test.

[hectorvent]

🎉 This PR is included in version 1.6.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀