How to yq select contains on a field with an object with a value of tags and special characters? - aws-cloudformation

Question

I need to add ManagedPolicyArns to many IAM roles in many cloudformation.yaml files. Some already have this policy added so I need to select, in order to add, only those that do not. I'm using yq (https://github.com/mikefarah/yq/) version 4.27.3, which is fantastic.
Command:
yq --from-file add_policy.yq cloudformation.yaml
cloudformation.yaml:
AWSTemplateFormatVersion: "2010-09-09"
Parameters:
MyPrefix:
Description: MyPrefix
Type: String
Resources:
MyRole:
Type: AWS::IAM::Role
Properties:
ManagedPolicyArns:
- Fn::ImportValue: !Sub "${MyPrefix}-my-policy-arn"
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- ecs-tasks.amazonaws.com
- lambda.amazonaws.com
Action:
- sts:AssumeRole
- sts:TagSession
Path: /
Partially working in that it always adds the policy creating duplicates, add_policy.yq:
( .Resources[] |=
select(
(.Properties.AssumeRolePolicyDocument.Statement[].Principal.Service.[] == "ecs-tasks.amazonaws.com"
or .Properties.AssumeRolePolicyDocument.Statement[].Principal.Service.[] == "lambda.amazonaws.com")
and (.Properties.ManagedPolicyArns | contains([{"Fn::ImportValue": "${MyPrefix}-my-policy-arn"}]) | not ) )
.Properties.ManagedPolicyArns += {"Fn::ImportValue": "${MyPrefix}-my-policy-arn" | . tag = "!Sub" }
)
Does does not add the policy at all and fails silently, add_policy.yq
( .Resources[] |=
select(
(.Properties.AssumeRolePolicyDocument.Statement[].Principal.Service.[] == "ecs-tasks.amazonaws.com"
or .Properties.AssumeRolePolicyDocument.Statement[].Principal.Service.[] == "lambda.amazonaws.com")
and (.Properties.ManagedPolicyArns[]."Fn::ImportValue" | contains("${MyPrefix}-my-policy-arn" | . tag = "!Sub") | not) )
.Properties.ManagedPolicyArns += {"Fn::ImportValue": "${MyPrefix}-my-policy-arn" | . tag = "!Sub" }
)
I'm failing to see from the simpler examples in the docs, How do I keep ManagedPolicyArns unique and not add the new entry to it if it already exists?

Answer 1

Thanks to the question "https://stackoverflow.com/questions/42097410/how-to-check-for-presence-of-key-in-jq-before-iterating-over-the-values" and also trying out some various queries to see what output .Resources.Properties.ManagedPolicyArns[] is returning (ie. nulls), I figured it out.
There's a list of null values that it is iterating and that causes the expression to just break and not evaluate. I need to instead return true for items that are null or not matching, then all will be handled and the expression evaluated fully to true or false.
add_policy.yq:
( .Resources[] |=
select(
(.Properties.AssumeRolePolicyDocument.Statement[].Principal.Service.[] == "ecs-tasks.amazonaws.com"
or .Properties.AssumeRolePolicyDocument.Statement[].Principal.Service.[] == "lambda.amazonaws.com")
and (
.Properties.ManagedPolicyArns[] == null
or ( .Properties.ManagedPolicyArns[]."Fn::ImportValue" == "${MyPrefix}-my-policy-arn" | not )
)
)
.Properties.ManagedPolicyArns += {"Fn::ImportValue": "${MyPrefix}-my-policy-arn" | . tag = "!Sub" }
)