@pulumi/aws
Version:
A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.
347 lines (346 loc) • 18.7 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
* Manages a CloudFormation StackSet. StackSets allow CloudFormation templates to be easily deployed across multiple accounts and regions via StackSet Instances (`aws.cloudformation.StackSetInstance` resource). Additional information about StackSets can be found in the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html).
*
* > **NOTE:** All template parameters, including those with a `Default`, must be configured or ignored with the `lifecycle` configuration block `ignoreChanges` argument.
*
* > **NOTE:** All `NoEcho` template parameters must be ignored with the `lifecycle` configuration block `ignoreChanges` argument.
*
* > **NOTE:** When using a delegated administrator account, ensure that your IAM User or Role has the `organizations:ListDelegatedAdministrators` permission. Otherwise, you may get an error like `ValidationError: Account used is not a delegated administrator`.
*
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const aWSCloudFormationStackSetAdministrationRoleAssumeRolePolicy = aws.iam.getPolicyDocument({
* statements: [{
* actions: ["sts:AssumeRole"],
* effect: "Allow",
* principals: [{
* identifiers: ["cloudformation.amazonaws.com"],
* type: "Service",
* }],
* }],
* });
* const aWSCloudFormationStackSetAdministrationRole = new aws.iam.Role("AWSCloudFormationStackSetAdministrationRole", {
* assumeRolePolicy: aWSCloudFormationStackSetAdministrationRoleAssumeRolePolicy.then(aWSCloudFormationStackSetAdministrationRoleAssumeRolePolicy => aWSCloudFormationStackSetAdministrationRoleAssumeRolePolicy.json),
* name: "AWSCloudFormationStackSetAdministrationRole",
* });
* const example = new aws.cloudformation.StackSet("example", {
* administrationRoleArn: aWSCloudFormationStackSetAdministrationRole.arn,
* name: "example",
* parameters: {
* VPCCidr: "10.0.0.0/16",
* },
* templateBody: JSON.stringify({
* Parameters: {
* VPCCidr: {
* Type: "String",
* Default: "10.0.0.0/16",
* Description: "Enter the CIDR block for the VPC. Default is 10.0.0.0/16.",
* },
* },
* Resources: {
* myVpc: {
* Type: "AWS::EC2::VPC",
* Properties: {
* CidrBlock: {
* Ref: "VPCCidr",
* },
* Tags: [{
* Key: "Name",
* Value: "Primary_CF_VPC",
* }],
* },
* },
* },
* }),
* });
* const aWSCloudFormationStackSetAdministrationRoleExecutionPolicy = aws.iam.getPolicyDocumentOutput({
* statements: [{
* actions: ["sts:AssumeRole"],
* effect: "Allow",
* resources: [pulumi.interpolate`arn:aws:iam::*:role/${example.executionRoleName}`],
* }],
* });
* const aWSCloudFormationStackSetAdministrationRoleExecutionPolicyRolePolicy = new aws.iam.RolePolicy("AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy", {
* name: "ExecutionPolicy",
* policy: aWSCloudFormationStackSetAdministrationRoleExecutionPolicy.apply(aWSCloudFormationStackSetAdministrationRoleExecutionPolicy => aWSCloudFormationStackSetAdministrationRoleExecutionPolicy.json),
* role: aWSCloudFormationStackSetAdministrationRole.name,
* });
* ```
*
* ## Import
*
* Import CloudFormation StackSets when acting a delegated administrator in a member account using the `name` and `call_as` values separated by a comma (`,`). For example:
*
* Using `pulumi import`, import CloudFormation StackSets using the `name`. For example:
*
* ```sh
* $ pulumi import aws:cloudformation/stackSet:StackSet example example
* ```
* Using `pulumi import`, import CloudFormation StackSets when acting a delegated administrator in a member account using the `name` and `call_as` values separated by a comma (`,`). For example:
*
* ```sh
* $ pulumi import aws:cloudformation/stackSet:StackSet example example,DELEGATED_ADMIN
* ```
*/
export declare class StackSet extends pulumi.CustomResource {
/**
* Get an existing StackSet resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: StackSetState, opts?: pulumi.CustomResourceOptions): StackSet;
/**
* Returns true if the given object is an instance of StackSet. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is StackSet;
/**
* Amazon Resource Number (ARN) of the IAM Role in the administrator account. This must be defined when using the `SELF_MANAGED` permission model.
*/
readonly administrationRoleArn: pulumi.Output<string | undefined>;
/**
* Amazon Resource Name (ARN) of the StackSet.
*/
readonly arn: pulumi.Output<string>;
/**
* Configuration block containing the auto-deployment model for your StackSet. This can only be defined when using the `SERVICE_MANAGED` permission model.
*/
readonly autoDeployment: pulumi.Output<outputs.cloudformation.StackSetAutoDeployment | undefined>;
/**
* Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. Valid values: `SELF` (default), `DELEGATED_ADMIN`.
*/
readonly callAs: pulumi.Output<string | undefined>;
/**
* A list of capabilities. Valid values: `CAPABILITY_IAM`, `CAPABILITY_NAMED_IAM`, `CAPABILITY_AUTO_EXPAND`.
*/
readonly capabilities: pulumi.Output<string[] | undefined>;
/**
* Description of the StackSet.
*/
readonly description: pulumi.Output<string | undefined>;
/**
* Name of the IAM Role in all target accounts for StackSet operations. Defaults to `AWSCloudFormationStackSetExecutionRole` when using the `SELF_MANAGED` permission model. This should not be defined when using the `SERVICE_MANAGED` permission model.
*/
readonly executionRoleName: pulumi.Output<string>;
/**
* Configuration block to allow StackSets to perform non-conflicting operations concurrently and queues conflicting operations.
*/
readonly managedExecution: pulumi.Output<outputs.cloudformation.StackSetManagedExecution | undefined>;
/**
* Name of the StackSet. The name must be unique in the region where you create your StackSet. The name can contain only alphanumeric characters (case-sensitive) and hyphens. It must start with an alphabetic character and cannot be longer than 128 characters.
*/
readonly name: pulumi.Output<string>;
/**
* Preferences for how AWS CloudFormation performs a stack set update.
*/
readonly operationPreferences: pulumi.Output<outputs.cloudformation.StackSetOperationPreferences | undefined>;
/**
* Key-value map of input parameters for the StackSet template. All template parameters, including those with a `Default`, must be configured or ignored with `lifecycle` configuration block `ignoreChanges` argument. All `NoEcho` template parameters must be ignored with the `lifecycle` configuration block `ignoreChanges` argument.
*/
readonly parameters: pulumi.Output<{
[key: string]: string;
} | undefined>;
/**
* Describes how the IAM roles required for your StackSet are created. Valid values: `SELF_MANAGED` (default), `SERVICE_MANAGED`.
*/
readonly permissionModel: pulumi.Output<string | undefined>;
/**
* Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
*/
readonly region: pulumi.Output<string>;
/**
* Unique identifier of the StackSet.
*/
readonly stackSetId: pulumi.Output<string>;
/**
* Key-value map of tags to associate with this StackSet and the Stacks created from it. AWS CloudFormation also propagates these tags to supported resources that are created in the Stacks. A maximum number of 50 tags can be specified. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
*/
readonly tags: pulumi.Output<{
[key: string]: string;
} | undefined>;
/**
* A map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
*/
readonly tagsAll: pulumi.Output<{
[key: string]: string;
}>;
/**
* String containing the CloudFormation template body. Maximum size: 51,200 bytes. Conflicts with `templateUrl`.
*/
readonly templateBody: pulumi.Output<string>;
/**
* String containing the location of a file containing the CloudFormation template body. The URL must point to a template that is located in an Amazon S3 bucket. Maximum location file size: 460,800 bytes. Conflicts with `templateBody`.
*/
readonly templateUrl: pulumi.Output<string | undefined>;
/**
* Create a StackSet resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args?: StackSetArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering StackSet resources.
*/
export interface StackSetState {
/**
* Amazon Resource Number (ARN) of the IAM Role in the administrator account. This must be defined when using the `SELF_MANAGED` permission model.
*/
administrationRoleArn?: pulumi.Input<string>;
/**
* Amazon Resource Name (ARN) of the StackSet.
*/
arn?: pulumi.Input<string>;
/**
* Configuration block containing the auto-deployment model for your StackSet. This can only be defined when using the `SERVICE_MANAGED` permission model.
*/
autoDeployment?: pulumi.Input<inputs.cloudformation.StackSetAutoDeployment>;
/**
* Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. Valid values: `SELF` (default), `DELEGATED_ADMIN`.
*/
callAs?: pulumi.Input<string>;
/**
* A list of capabilities. Valid values: `CAPABILITY_IAM`, `CAPABILITY_NAMED_IAM`, `CAPABILITY_AUTO_EXPAND`.
*/
capabilities?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Description of the StackSet.
*/
description?: pulumi.Input<string>;
/**
* Name of the IAM Role in all target accounts for StackSet operations. Defaults to `AWSCloudFormationStackSetExecutionRole` when using the `SELF_MANAGED` permission model. This should not be defined when using the `SERVICE_MANAGED` permission model.
*/
executionRoleName?: pulumi.Input<string>;
/**
* Configuration block to allow StackSets to perform non-conflicting operations concurrently and queues conflicting operations.
*/
managedExecution?: pulumi.Input<inputs.cloudformation.StackSetManagedExecution>;
/**
* Name of the StackSet. The name must be unique in the region where you create your StackSet. The name can contain only alphanumeric characters (case-sensitive) and hyphens. It must start with an alphabetic character and cannot be longer than 128 characters.
*/
name?: pulumi.Input<string>;
/**
* Preferences for how AWS CloudFormation performs a stack set update.
*/
operationPreferences?: pulumi.Input<inputs.cloudformation.StackSetOperationPreferences>;
/**
* Key-value map of input parameters for the StackSet template. All template parameters, including those with a `Default`, must be configured or ignored with `lifecycle` configuration block `ignoreChanges` argument. All `NoEcho` template parameters must be ignored with the `lifecycle` configuration block `ignoreChanges` argument.
*/
parameters?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* Describes how the IAM roles required for your StackSet are created. Valid values: `SELF_MANAGED` (default), `SERVICE_MANAGED`.
*/
permissionModel?: pulumi.Input<string>;
/**
* Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
*/
region?: pulumi.Input<string>;
/**
* Unique identifier of the StackSet.
*/
stackSetId?: pulumi.Input<string>;
/**
* Key-value map of tags to associate with this StackSet and the Stacks created from it. AWS CloudFormation also propagates these tags to supported resources that are created in the Stacks. A maximum number of 50 tags can be specified. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
*/
tags?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* A map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
*/
tagsAll?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* String containing the CloudFormation template body. Maximum size: 51,200 bytes. Conflicts with `templateUrl`.
*/
templateBody?: pulumi.Input<string>;
/**
* String containing the location of a file containing the CloudFormation template body. The URL must point to a template that is located in an Amazon S3 bucket. Maximum location file size: 460,800 bytes. Conflicts with `templateBody`.
*/
templateUrl?: pulumi.Input<string>;
}
/**
* The set of arguments for constructing a StackSet resource.
*/
export interface StackSetArgs {
/**
* Amazon Resource Number (ARN) of the IAM Role in the administrator account. This must be defined when using the `SELF_MANAGED` permission model.
*/
administrationRoleArn?: pulumi.Input<string>;
/**
* Configuration block containing the auto-deployment model for your StackSet. This can only be defined when using the `SERVICE_MANAGED` permission model.
*/
autoDeployment?: pulumi.Input<inputs.cloudformation.StackSetAutoDeployment>;
/**
* Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. Valid values: `SELF` (default), `DELEGATED_ADMIN`.
*/
callAs?: pulumi.Input<string>;
/**
* A list of capabilities. Valid values: `CAPABILITY_IAM`, `CAPABILITY_NAMED_IAM`, `CAPABILITY_AUTO_EXPAND`.
*/
capabilities?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Description of the StackSet.
*/
description?: pulumi.Input<string>;
/**
* Name of the IAM Role in all target accounts for StackSet operations. Defaults to `AWSCloudFormationStackSetExecutionRole` when using the `SELF_MANAGED` permission model. This should not be defined when using the `SERVICE_MANAGED` permission model.
*/
executionRoleName?: pulumi.Input<string>;
/**
* Configuration block to allow StackSets to perform non-conflicting operations concurrently and queues conflicting operations.
*/
managedExecution?: pulumi.Input<inputs.cloudformation.StackSetManagedExecution>;
/**
* Name of the StackSet. The name must be unique in the region where you create your StackSet. The name can contain only alphanumeric characters (case-sensitive) and hyphens. It must start with an alphabetic character and cannot be longer than 128 characters.
*/
name?: pulumi.Input<string>;
/**
* Preferences for how AWS CloudFormation performs a stack set update.
*/
operationPreferences?: pulumi.Input<inputs.cloudformation.StackSetOperationPreferences>;
/**
* Key-value map of input parameters for the StackSet template. All template parameters, including those with a `Default`, must be configured or ignored with `lifecycle` configuration block `ignoreChanges` argument. All `NoEcho` template parameters must be ignored with the `lifecycle` configuration block `ignoreChanges` argument.
*/
parameters?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* Describes how the IAM roles required for your StackSet are created. Valid values: `SELF_MANAGED` (default), `SERVICE_MANAGED`.
*/
permissionModel?: pulumi.Input<string>;
/**
* Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
*/
region?: pulumi.Input<string>;
/**
* Key-value map of tags to associate with this StackSet and the Stacks created from it. AWS CloudFormation also propagates these tags to supported resources that are created in the Stacks. A maximum number of 50 tags can be specified. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
*/
tags?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* String containing the CloudFormation template body. Maximum size: 51,200 bytes. Conflicts with `templateUrl`.
*/
templateBody?: pulumi.Input<string>;
/**
* String containing the location of a file containing the CloudFormation template body. The URL must point to a template that is located in an Amazon S3 bucket. Maximum location file size: 460,800 bytes. Conflicts with `templateBody`.
*/
templateUrl?: pulumi.Input<string>;
}