@pulumi/aws
Version:
A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.
139 lines • 6.57 kB
JavaScript
;
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.PodIdentityAssociation = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
* Resource for managing an AWS EKS (Elastic Kubernetes) Pod Identity Association.
*
* Creates an EKS Pod Identity association between a service account in an Amazon EKS cluster and an IAM role with EKS Pod Identity. Use EKS Pod Identity to give temporary IAM credentials to pods and the credentials are rotated automatically.
*
* Amazon EKS Pod Identity associations provide the ability to manage credentials for your applications, similar to the way that EC2 instance profiles provide credentials to Amazon EC2 instances.
*
* If a pod uses a service account that has an association, Amazon EKS sets environment variables in the containers of the pod. The environment variables configure the Amazon Web Services SDKs, including the Command Line Interface, to use the EKS Pod Identity credentials.
*
* Pod Identity is a simpler method than IAM roles for service accounts, as this method doesn’t use OIDC identity providers. Additionally, you can configure a role for Pod Identity once, and reuse it across clusters.
*
* ## Example Usage
*
* ### Basic Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const assumeRole = aws.iam.getPolicyDocument({
* statements: [{
* effect: "Allow",
* principals: [{
* type: "Service",
* identifiers: ["pods.eks.amazonaws.com"],
* }],
* actions: [
* "sts:AssumeRole",
* "sts:TagSession",
* ],
* }],
* });
* const example = new aws.iam.Role("example", {
* name: "eks-pod-identity-example",
* assumeRolePolicy: assumeRole.then(assumeRole => assumeRole.json),
* });
* const exampleS3 = new aws.iam.RolePolicyAttachment("example_s3", {
* policyArn: "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
* role: example.name,
* });
* const examplePodIdentityAssociation = new aws.eks.PodIdentityAssociation("example", {
* clusterName: exampleAwsEksCluster.name,
* namespace: "example",
* serviceAccount: "example-sa",
* roleArn: example.arn,
* });
* ```
*
* ## Import
*
* Using `pulumi import`, import EKS (Elastic Kubernetes) Pod Identity Association using the `cluster_name` and `association_id` separated by a comma (`,`). For example:
*
* ```sh
* $ pulumi import aws:eks/podIdentityAssociation:PodIdentityAssociation example example,a-12345678
* ```
*/
class PodIdentityAssociation extends pulumi.CustomResource {
/**
* Get an existing PodIdentityAssociation resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name, id, state, opts) {
return new PodIdentityAssociation(name, state, { ...opts, id: id });
}
/**
* Returns true if the given object is an instance of PodIdentityAssociation. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj) {
if (obj === undefined || obj === null) {
return false;
}
return obj['__pulumiType'] === PodIdentityAssociation.__pulumiType;
}
constructor(name, argsOrState, opts) {
let resourceInputs = {};
opts = opts || {};
if (opts.id) {
const state = argsOrState;
resourceInputs["associationArn"] = state?.associationArn;
resourceInputs["associationId"] = state?.associationId;
resourceInputs["clusterName"] = state?.clusterName;
resourceInputs["disableSessionTags"] = state?.disableSessionTags;
resourceInputs["externalId"] = state?.externalId;
resourceInputs["namespace"] = state?.namespace;
resourceInputs["region"] = state?.region;
resourceInputs["roleArn"] = state?.roleArn;
resourceInputs["serviceAccount"] = state?.serviceAccount;
resourceInputs["tags"] = state?.tags;
resourceInputs["tagsAll"] = state?.tagsAll;
resourceInputs["targetRoleArn"] = state?.targetRoleArn;
}
else {
const args = argsOrState;
if (args?.clusterName === undefined && !opts.urn) {
throw new Error("Missing required property 'clusterName'");
}
if (args?.namespace === undefined && !opts.urn) {
throw new Error("Missing required property 'namespace'");
}
if (args?.roleArn === undefined && !opts.urn) {
throw new Error("Missing required property 'roleArn'");
}
if (args?.serviceAccount === undefined && !opts.urn) {
throw new Error("Missing required property 'serviceAccount'");
}
resourceInputs["clusterName"] = args?.clusterName;
resourceInputs["disableSessionTags"] = args?.disableSessionTags;
resourceInputs["namespace"] = args?.namespace;
resourceInputs["region"] = args?.region;
resourceInputs["roleArn"] = args?.roleArn;
resourceInputs["serviceAccount"] = args?.serviceAccount;
resourceInputs["tags"] = args?.tags;
resourceInputs["targetRoleArn"] = args?.targetRoleArn;
resourceInputs["associationArn"] = undefined /*out*/;
resourceInputs["associationId"] = undefined /*out*/;
resourceInputs["externalId"] = undefined /*out*/;
resourceInputs["tagsAll"] = undefined /*out*/;
}
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
super(PodIdentityAssociation.__pulumiType, name, resourceInputs, opts);
}
}
exports.PodIdentityAssociation = PodIdentityAssociation;
/** @internal */
PodIdentityAssociation.__pulumiType = 'aws:eks/podIdentityAssociation:PodIdentityAssociation';
//# sourceMappingURL=podIdentityAssociation.js.map