Repository: cdklabs/cdk-enterprise-iac (language: python)

Issue:
bug: AddPermissionBoundary aspect breaks on instance profiles with no prefix or name
### What is the problem?

when using `AddPermissionBoundary` and no `instanceProfilePrefix` is provided, a `cdk synth` errors out


### Reproduction Steps

```ts
stack = new Stack();
const pbName = 'test-pb';
const role = new Role(stack, 'TestRole', {
  assumedBy: new ServicePrincipal('ec2.amazonaws.com'),
});
new CfnInstanceProfile(stack, 'TestInstanceProfile', {
  roles: [role.roleName],
});
Aspects.of(stack).add(
  new AddPermissionBoundary({
    permissionsBoundaryPolicyName: pbName,
  })
);
```

In a case where no `instanceProfilePrefix` is provided, a `cdk synth` yields the following

```
TypeError: Cannot read properties of undefined (reading 'replace')

      71 |       node.addPropertyOverride(
      72 |         cfnProp,
    > 73 |         `${prefix}${policySuffix.replace(/\s/g, '')}`.substring(0, length - 1)
         |                                  ^
      74 |       );
      75 |     }
      76 |   }
```

### What did you expect to happen?

No prefix added for the instance profile name , and no `InstanceProfileName` property in the synthesized Cloudformation.

### What actually happened?

Got the error:

```
```
TypeError: Cannot read properties of undefined (reading 'replace')

      71 |       node.addPropertyOverride(
      72 |         cfnProp,
    > 73 |         `${prefix}${policySuffix.replace(/\s/g, '')}`.substring(0, length - 1)
         |                                  ^
      74 |       );
      75 |     }
      76 |   }
```
```

### cdk-enterprise-iac version

0.0.201

### Language

Typescript, Python

### Other information

_No response_


Discussion / hints:

Fix patch:
diff --git a/src/patches/addPermissionsBoundary.ts b/src/patches/addPermissionsBoundary.ts
index 55c2a7d..2120110 100644
--- a/src/patches/addPermissionsBoundary.ts
+++ b/src/patches/addPermissionsBoundary.ts
@@ -65,13 +65,16 @@ export class AddPermissionBoundary implements IAspect {
     cdkProp?: string
   ): void {
     if (!cdkProp?.startsWith(prefix)) {
-      const policySuffix = !Token.isUnresolved(cdkProp)
-        ? (cdkProp as string)
-        : getResourceId(node.node.path);
-      node.addPropertyOverride(
-        cfnProp,
-        `${prefix}${policySuffix.replace(/\s/g, '')}`.substring(0, length - 1)
-      );
+      if (cdkProp != undefined) {
+        const policySuffix = !Token.isUnresolved(cdkProp)
+          ? (cdkProp as string)
+          : getResourceId(node.node.path);
+
+        node.addPropertyOverride(
+          cfnProp,
+          `${prefix}${policySuffix.replace(/\s/g, '')}`.substring(0, length - 1)
+        );
+      }
     }
   }
 


Test patch:
diff --git a/test/patches/addPermissionsBoundary.test.ts b/test/patches/addPermissionsBoundary.test.ts
index be9e826..ada1ac6 100644
--- a/test/patches/addPermissionsBoundary.test.ts
+++ b/test/patches/addPermissionsBoundary.test.ts
@@ -226,5 +226,20 @@ describe('Permissions Boundary patch', () => {
           ),
       });
     });
+    test('Instance Profile works fine when no prefix needed', () => {
+      const role = new Role(stack, 'TestRole', {
+        assumedBy: new ServicePrincipal('ec2.amazonaws.com'),
+      });
+      new CfnInstanceProfile(stack, 'TestInstanceProfile', {
+        roles: [role.roleName],
+      });
+      Aspects.of(stack).add(
+        new AddPermissionBoundary({
+          permissionsBoundaryPolicyName: pbName,
+        })
+      );
+      const template = Template.fromStack(stack);
+      template.resourceCountIs('AWS::IAM::InstanceProfile', 1);
+    });
   });
 });