Repository: noqdev/iambic
Issue: Adding additional statement in IAM Role Trust Relationship shows incorrect diff

**Describe the bug**
I've added an additional statement to the IambicHubRole Trust relationship, but the diff shows that two statements will be added.

**To Reproduce**

**Before:**

```yaml
properties:
  description: This role is used by IAMbic to assume into the spoke role of every account defined in the IAMbic config. Managed via CloudFormation.
  assume_role_policy_document:
    statement:
      - action:
          - sts:AssumeRole
          - sts:SetSourceIdentity
          - sts:TagSession
        effect: Allow
        principal:
          aws: arn:aws:iam::{{var.account_id}}:role/aws-reserved/sso.amazonaws.com/ap-northeast-1/AWSReservedSSO_admin_780c4db1834ee1ea
    version: '2012-10-17'
```

**After:**

```yaml
properties:
  description: This role is used by IAMbic to assume into the spoke role of every account defined in the IAMbic config. Managed via CloudFormation.
  assume_role_policy_document:
    statement:
      - action:
          - sts:AssumeRole
          - sts:SetSourceIdentity
          - sts:TagSession
        effect: Allow
        principal:
          aws: arn:aws:iam::{{var.account_id}}:role/aws-reserved/sso.amazonaws.com/ap-northeast-1/AWSReservedSSO_admin_780c4db1834ee1ea
      - action:
          - sts:AssumeRole
          - sts:TagSession
        effect: Allow
        principal:
          aws: arn:aws:iam::{{var.account_id}}:role/iambic_github_app_lambda_execution
    version: '2012-10-17'
```

**Diff:**

```text
2023/07/08 05:23:14 [info     ] IAMBIC_DOCKER_CONTAINER is set, using /app as writable directory
2023/07/08 05:23:14 [info     ] Loading config...
2023/07/08 05:23:14 [info     ] Setting config metadata...
2023/07/08 05:23:18 [info     ] Plugins loaded successfully...
2023/07/08 05:23:18 [info     ] Scanning for expired resources
2023/07/08 05:23:19 [info     ] Expired resource scan complete.
2023/07/08 05:23:19 [info     ] Detecting changes for resource.
  accounts=[
    "management - (000000000000)"
  ]
  resource_id=IambicHubRole
  resource_type=aws:iam:role
2023/07/08 05:23:21 [info     ] Successfully detected required resource changes.
  accounts=[
    "management - (000000000000)"
  ]
  resource_id=IambicHubRole
  resource_type=aws:iam:role
2023/07/08 05:23:21 [info     ] Finished scanning for changes.
2023/07/08 05:23:21 [info     ] A detailed summary of changes has been saved to proposed_changes.yaml
IAMbic Summary

Change Detection

* 1 distinct actions.
* 1 templates with changes.
* 1 accounts affected.

Exceptions
* 0 exceptions were recorded.
IAMbic Change Details
Update
└── /templates/resources/aws/iam/role/management/iambichubrole.yaml
    └── management - (000000000000)
        └── aws:iam:role // IambicHubRole
            └── assume_role_policy_document:
                +(Add)
                [
                  "2012-10-17",
                  [
                    {
                      "Effect": "Allow",
                      "Principal": {
                        "AWS": "arn:aws:iam::000000000000:role/aws-reserved/sso.amazonaws.com/ap-northeast-1/AWSReservedSSO_admin_780c4db1834ee1ea"
                      },
                      "Action": [
                        "sts:AssumeRole",
                        "sts:SetSourceIdentity",
                        "sts:TagSession"
                      ]
                    },
                    {
                      "Effect": "Allow",
                      "Principal": {
                        "AWS": "arn:aws:iam::000000000000:role/iambic_github_app_lambda_execution"
                      },
                      "Action": [
                        "sts:AssumeRole",
                        "sts:TagSession"
                      ]
                    }
                  ]
                ]


Proceed? [y/N]: y
2023/07/08 05:25:41 [info     ] Applying changes to resource.
  accounts=[
    "management - (000000000000)"
  ]
  resource_id=IambicHubRole
  resource_type=aws:iam:role
2023/07/08 05:25:44 [info     ] Successfully applied resource changes.
  accounts=[
    "management - (000000000000)"
  ]
  resource_id=IambicHubRole
  resource_type=aws:iam:role
2023/07/08 05:25:44 [info     ] Finished applying changes.
```

Note the diff section shows `+(Add)` and then two statements.

**Expected behavior**
I would expect that only the added statement would show, not both.

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Desktop (please complete the following information):**

- OS: ubuntu 22.04
- Version 0.10.1

**Additional context**
Add any other context about the problem here.

**Community Engagement**
Your vote counts! Please support this bug report by adding a 👍 reaction to the original issue, which will aid the community and maintainers in addressing this problem.

Please refrain from adding "+1" or "me too" comments, as these create unnecessary noise for issue followers and do not help in prioritizing the issue. If you wish to contribute to solving this issue or have submitted a pull request, please leave a comment.


Changed files:
iambic/output/models.py

diff --git a/iambic/output/models.py b/iambic/output/models.py
index 49a8080d..b4d3633b 100644
--- a/iambic/output/models.py
+++ b/iambic/output/models.py
@@ -50,7 +50,11 @@ class ProposedChangeDiff(ProposedChange):
             self.current_value = {}
         if self.new_value is None:
             self.new_value = {}
-        if isinstance(self.current_value, dict):
+        if self.change_summary:
+            # oh well... deep diff result is too difficult to mix in with other
+            # easy diff. So, gonna special case here.
+            self.diff = self.change_summary
+        elif isinstance(self.current_value, dict):
             self.diff = list(
                 diff(self.current_value.get(object_attribute, {}), self.new_value)
             )
@@ -60,6 +64,13 @@ class ProposedChangeDiff(ProposedChange):
     @property
     def diff_plus_minus(self) -> List[str]:
         diff_plus_minus = ""
+        # oh well... deep diff result is too difficult to mix in with other
+        # easy diff. So, gonna special case here.
+        if isinstance(self.diff, dict):
+            output_lines = []
+            for key, value in self.diff.items():
+                output_lines.append(f"{self.attribute}:\\n-{key}\\n{value}")
+            return "\\n".join(output_lines)
         for x in self.diff:
             label = self.attribute
             if x[0] == "change":