Apply TCX5-2025 waivers to all remaining policy version instances. If you have questions or concerns, please direct them to the #tcx5-2025 slack channel.

Author: David Souther

v2/guide/best-practices-security.adoc

@@ -52,7 +52,7 @@ To configure the IAM identities in your {aws} account with permission to assume
 [source,json,subs="verbatim,attributes"]
 ----
 {
-  "Version": "2012-10-17",
+  "Version": "2012-10-17",&TCX5-2025-waiver;
   "Statement": [{
     "Sid": "AssumeCDKRoles",
     "Effect": "Allow",

v2/guide/bootstrapping-env.adoc

@@ -257,7 +257,7 @@ When bootstrapping an {aws} environment, the IAM identity performing the bootstr
 [source,json,subs="verbatim,attributes"]
 ----
 {
-    "Version": "2012-10-17",
+    "Version": "2012-10-17",&TCX5-2025-waiver;
     "Statement": [
         {
             "Effect": "Allow",

v2/guide/hello-world.adoc

@@ -1176,7 +1176,7 @@ Resources:
             Effect: Allow
             Principal:
               Service: lambda.amazonaws.com
-        Version: "2012-10-17"
+        Version: "2012-10-17"&TCX5-2025-waiver;
       ManagedPolicyArns:
         - Fn::Join:
             - ""

v2/guide/serverless_example.adoc

@@ -1191,7 +1191,7 @@ Resources:
             Effect: Allow
             Principal:
               Service: lambda.amazonaws.com
-        Version: "2012-10-17"
+        Version: "2012-10-17"&TCX5-2025-waiver;
       ManagedPolicyArns:
         - Fn::Join:
             - ""

v2/guide/testing.adoc

@@ -869,7 +869,7 @@ TypeScript::
       "{aws}::IAM::Role",
       Match.objectEquals({
         AssumeRolePolicyDocument: {
-          Version: "2012-10-17",
+          Version: "2012-10-17",&TCX5-2025-waiver;
           Statement: [
             {
               Action: "sts:AssumeRole",
@@ -898,7 +898,7 @@ JavaScript::
       "{aws}::IAM::Role",
       Match.objectEquals({
         AssumeRolePolicyDocument: {
-          Version: "2012-10-17",
+          Version: "2012-10-17",&TCX5-2025-waiver;
           Statement: [
             {
               Action: "sts:AssumeRole",
@@ -930,7 +930,7 @@ from aws_cdk.assertions import Match
         Match.object_equals(
             {
                 "AssumeRolePolicyDocument": {
-                    "Version": "2012-10-17",
+                    "Version": "2012-10-17",&TCX5-2025-waiver;
                     "Statement": [
                         {
                             "Action": "sts:AssumeRole",
@@ -962,7 +962,7 @@ Java::
         // Fully assert on the state machine's IAM role with matchers.
         template.hasResourceProperties("{aws}::IAM::Role", Match.objectEquals(
                 Collections.singletonMap("AssumeRolePolicyDocument", Map.of(
-                        "Version", "2012-10-17",
+                        "Version", "2012-10-17",&TCX5-2025-waiver;
                         "Statement", Collections.singletonList(Map.of(
                                 "Action", "sts:AssumeRole",
                                 "Effect", "Allow",
@@ -988,11 +988,11 @@ C#::
             {
                 { "AssumeRolePolicyDocument", new ObjectDict
                     {
-                        { "Version", "2012-10-17" },
+                        { "Version", "2012-10-17"&TCX5-2025-waiver; },
                         { "Action", "sts:AssumeRole" },
                         { "Principal", new ObjectDict
                             {
-                                { "Version", "2012-10-17" },
+                                { "Version", "2012-10-17"&TCX5-2025-waiver; },
                                 { "Statement", new object[]
                                     {
                                         new ObjectDict {