policy.addAwsAccountPrincipal() throwing MalformedPolicyDocument error - amazon-web-services

Question

I am trying to create a role using CDK and here's requirements
1. access to api gateway(GET,DELETE,PUT,POST)
2. has a trust relationship with an aws account, "1234567"
Here's my CDK typescript code:
const role = new iam.Role(this, 'IMAAPIGatewayAccessRole', {
roleName: 'IMAAPIGatewayAccessRole',
assumedBy: new iam.AnyPrincipal(),
});
role.addToPolicy(new PolicyStatement(iam.PolicyStatementEffect.Allow)
.addAwsAccountPrincipal('1234567')
.addActions(
"apigateway:GET",
"apigateway:POST",
"apigateway:PUT",
"apigateway:DELETE"
)
.addAllResources()
);
But I am having MalformedPolicyDocument error
But I am not getting it without addAwsAccountPrincipal().
AssumeRolepolicy contained an invalid principal: "STAR":"*". (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: cb4073ee-aa5d-11e9-b299-c7ffa44eb0ca)
new Role (/Users//workspace/cdk/node_modules/#aws-cdk/aws-iam/lib/role.ts:200:18)
\_ new Ims (/Users//workspace/cdk/bin/cdk.ts:25:22)
\_ Object.<anonymous> (/Users//workspace/cdk/bin/cdk.ts:285:1)
\_ Module._compile (internal/modules/cjs/loader.js:774:30)
\_ Module.m._compile (/Users//workspace/cdk/node_modules/ts-node/src/index.ts:439:23)
\_ Module._extensions..js (internal/modules/cjs/loader.js:785:10)
\_ Object.require.extensions.<computed> [as .ts] (/Users//workspace/cdk/node_modules/ts-node/src/index.ts:442:12)
\_ Module.load (internal/modules/cjs/loader.js:641:32)
\_ Function.Module._load (internal/modules/cjs/loader.js:556:12)
\_ Function.Module.runMain (internal/modules/cjs/loader.js:837:10)
\_ Object.<anonymous> (/Users//workspace/cdk/node_modules/ts-node/src/bin.ts:154:12)
\_ Module._compile (internal/modules/cjs/loader.js:774:30)
\_ Object.Module._extensions..js (internal/modules/cjs/loader.js:785:10)
\_ Module.load (internal/modules/cjs/loader.js:641:32)
\_ Function.Module._load (internal/modules/cjs/loader.js:556:12)
\_ Function.Module.runMain (internal/modules/cjs/loader.js:837:10)
\_ /usr/local/lib/node_modules/npm/node_modules/libnpx/index.js:268:14
What is wrong with my code?

Answer 1

addAwsAccountPrincipal('1234567') doesn't actually work for me. Maybe it's a bug.
Instead, below worked for me.
const allowedAccountPrincipals = subscriberAccountIds.map(id => new AccountPrincipal(id));
const [firstPrincipal, ...additionalAllowedPrincipal] = allowedAccountPrincipals;
const allowedPrincipals = new CompositePrincipal(firstPrincipal, ...additionalAllowedPrincipal);
const role = new iam.Role(this, 'IMAAPIGatewayAccessRole', {
roleName: 'IMAAPIGatewayAccessRole',
assumedBy: allowedPrincipals,
});