#457 @swamp/aws/iam/role-policy: PolicyDocument schema says string but CloudControl expects JSONObject

Summary

The @swamp/aws/iam/role-policy model type defines PolicyDocument as z.string() in its global arguments schema. Swamp model validation passes when a JSON string is provided. However, at execution time AWS CloudControl rejects it:

Model validation failed (#/PolicyDocument: expected type: JSONObject, found: String)

The CloudFormation resource type AWS::IAM::RolePolicy defines PolicyDocument as type json (object), not string. The swamp extension's Zod schema doesn't match the CloudFormation schema, so the mismatch isn't caught until the create call hits AWS.

Steps to reproduce

1. Create a @swamp/aws/iam/role-policy model instance with PolicyDocument set to a valid JSON string:

   PolicyDocument: |-
     {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:ListBucket"],"Resource":"arn:aws:s3:::some-bucket"}]}

2. Run swamp model validate <name> — passes (5/5).
3. Execute the create method — fails at AWS with expected type: JSONObject, found: String.

Expected behavior

Either:

• The Zod schema should define PolicyDocument as z.object() (or z.record()) so the YAML value is a native object, matching what CloudControl expects.
• Or the create method should JSON.parse() the string before passing it to createResource(), so string input still works.

The first option is preferable since it makes the schema honest and lets operators write readable YAML.

Environment

• @swamp/aws/iam v2026.05.19.1
• swamp CLI 20260526.145459.0
• AWS account in eu-central-1

Upstream repository: https://github.com/systeminit/swamp-extensions

Environment

• Extension: @swamp/aws/iam@2026.05.19.1
• swamp: 20260526.145459.0-sha.335f9a2d
• OS: darwin (aarch64)
• Deno: 2.7.14+19bd3d8
• Shell: /bin/zsh