@pulumi/aws
Version:
A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.
265 lines • 11.6 kB
JavaScript
;
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.Role = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
* Provides an IAM role.
*
* > **NOTE:** If policies are attached to the role via the `aws.iam.PolicyAttachment` resource and you are modifying the role `name` or `path`, the `forceDetachPolicies` argument must be set to `true` and applied before attempting the operation otherwise you will encounter a `DeleteConflict` error. The `aws.iam.RolePolicyAttachment` resource (recommended) does not have this requirement.
*
* > **NOTE:** If you use this resource's `managedPolicyArns` argument or `inlinePolicy` configuration blocks, this resource will take over exclusive management of the role's respective policy types (e.g., both policy types if both arguments are used). These arguments are incompatible with other ways of managing a role's policies, such as `aws.iam.PolicyAttachment`, `aws.iam.RolePolicyAttachment`, and `aws.iam.RolePolicy`. If you attempt to manage a role's policies by multiple means, you will get resource cycling and/or errors.
*
* > **NOTE:** We suggest using explicit JSON encoding or `aws.iam.getPolicyDocument` when assigning a value to `policy`. They seamlessly translate configuration to JSON, enabling you to maintain consistency within your configuration without the need for context switches. Also, you can sidestep potential complications arising from formatting discrepancies, whitespace inconsistencies, and other nuances inherent to JSON.
*
* ## Example Usage
*
* ### Basic Example
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const testRole = new aws.iam.Role("test_role", {
* name: "test_role",
* assumeRolePolicy: JSON.stringify({
* Version: "2012-10-17",
* Statement: [{
* Action: "sts:AssumeRole",
* Effect: "Allow",
* Sid: "",
* Principal: {
* Service: "ec2.amazonaws.com",
* },
* }],
* }),
* tags: {
* "tag-key": "tag-value",
* },
* });
* ```
*
* ### Example of Using Data Source for Assume Role Policy
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const instanceAssumeRolePolicy = aws.iam.getPolicyDocument({
* statements: [{
* actions: ["sts:AssumeRole"],
* principals: [{
* type: "Service",
* identifiers: ["ec2.amazonaws.com"],
* }],
* }],
* });
* const instance = new aws.iam.Role("instance", {
* name: "instance_role",
* path: "/system/",
* assumeRolePolicy: instanceAssumeRolePolicy.then(instanceAssumeRolePolicy => instanceAssumeRolePolicy.json),
* });
* ```
*
* ### Example of Exclusive Inline Policies
*
* > The `inlinePolicy` argument is deprecated. Use the `aws.iam.RolePolicy` resource instead. If Pulumi should exclusively manage all inline policy associations (the current behavior of this argument), use the `aws.iam.RolePoliciesExclusive` resource as well.
*
* This example creates an IAM role with two inline IAM policies. If someone adds another inline policy out-of-band, on the next apply, this provider will remove that policy. If someone deletes these policies out-of-band, this provider will recreate them.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const inlinePolicy = aws.iam.getPolicyDocument({
* statements: [{
* actions: ["ec2:DescribeAccountAttributes"],
* resources: ["*"],
* }],
* });
* const example = new aws.iam.Role("example", {
* name: "yak_role",
* assumeRolePolicy: instanceAssumeRolePolicy.json,
* inlinePolicies: [
* {
* name: "my_inline_policy",
* policy: JSON.stringify({
* Version: "2012-10-17",
* Statement: [{
* Action: ["ec2:Describe*"],
* Effect: "Allow",
* Resource: "*",
* }],
* }),
* },
* {
* name: "policy-8675309",
* policy: inlinePolicy.then(inlinePolicy => inlinePolicy.json),
* },
* ],
* });
* ```
*
* ### Example of Removing Inline Policies
*
* > The `inlinePolicy` argument is deprecated. Use the `aws.iam.RolePolicy` resource instead. If Pulumi should exclusively manage all inline policy associations (the current behavior of this argument), use the `aws.iam.RolePoliciesExclusive` resource as well.
*
* This example creates an IAM role with what appears to be empty IAM `inlinePolicy` argument instead of using `inlinePolicy` as a configuration block. The result is that if someone were to add an inline policy out-of-band, on the next apply, this provider will remove that policy.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.iam.Role("example", {
* inlinePolicies: [{}],
* name: "yak_role",
* assumeRolePolicy: instanceAssumeRolePolicy.json,
* });
* ```
*
* ### Example of Exclusive Managed Policies
*
* > The `managedPolicyArns` argument is deprecated. Use the `aws.iam.RolePolicyAttachment` resource instead. If Pulumi should exclusively manage all managed policy attachments (the current behavior of this argument), use the `aws.iam.RolePolicyAttachmentsExclusive` resource as well.
*
* This example creates an IAM role and attaches two managed IAM policies. If someone attaches another managed policy out-of-band, on the next apply, this provider will detach that policy. If someone detaches these policies out-of-band, this provider will attach them again.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const policyOne = new aws.iam.Policy("policy_one", {
* name: "policy-618033",
* policy: JSON.stringify({
* Version: "2012-10-17",
* Statement: [{
* Action: ["ec2:Describe*"],
* Effect: "Allow",
* Resource: "*",
* }],
* }),
* });
* const policyTwo = new aws.iam.Policy("policy_two", {
* name: "policy-381966",
* policy: JSON.stringify({
* Version: "2012-10-17",
* Statement: [{
* Action: [
* "s3:ListAllMyBuckets",
* "s3:ListBucket",
* "s3:HeadBucket",
* ],
* Effect: "Allow",
* Resource: "*",
* }],
* }),
* });
* const example = new aws.iam.Role("example", {
* name: "yak_role",
* assumeRolePolicy: instanceAssumeRolePolicy.json,
* managedPolicyArns: [
* policyOne.arn,
* policyTwo.arn,
* ],
* });
* ```
*
* ### Example of Removing Managed Policies
*
* > The `managedPolicyArns` argument is deprecated. Use the `aws.iam.RolePolicyAttachment` resource instead. If Pulumi should exclusively manage all managed policy attachments (the current behavior of this argument), use the `aws.iam.RolePolicyAttachmentsExclusive` resource as well.
*
* This example creates an IAM role with an empty `managedPolicyArns` argument. If someone attaches a policy out-of-band, on the next apply, this provider will detach that policy.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.iam.Role("example", {
* name: "yak_role",
* assumeRolePolicy: instanceAssumeRolePolicy.json,
* managedPolicyArns: [],
* });
* ```
*
* ## Import
*
* Using `pulumi import`, import IAM Roles using the `name`. For example:
*
* ```sh
* $ pulumi import aws:iam/role:Role developer developer_name
* ```
*/
class Role extends pulumi.CustomResource {
/**
* Get an existing Role resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name, id, state, opts) {
return new Role(name, state, { ...opts, id: id });
}
/**
* Returns true if the given object is an instance of Role. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj) {
if (obj === undefined || obj === null) {
return false;
}
return obj['__pulumiType'] === Role.__pulumiType;
}
constructor(name, argsOrState, opts) {
let resourceInputs = {};
opts = opts || {};
if (opts.id) {
const state = argsOrState;
resourceInputs["arn"] = state?.arn;
resourceInputs["assumeRolePolicy"] = state?.assumeRolePolicy;
resourceInputs["createDate"] = state?.createDate;
resourceInputs["description"] = state?.description;
resourceInputs["forceDetachPolicies"] = state?.forceDetachPolicies;
resourceInputs["inlinePolicies"] = state?.inlinePolicies;
resourceInputs["managedPolicyArns"] = state?.managedPolicyArns;
resourceInputs["maxSessionDuration"] = state?.maxSessionDuration;
resourceInputs["name"] = state?.name;
resourceInputs["namePrefix"] = state?.namePrefix;
resourceInputs["path"] = state?.path;
resourceInputs["permissionsBoundary"] = state?.permissionsBoundary;
resourceInputs["tags"] = state?.tags;
resourceInputs["tagsAll"] = state?.tagsAll;
resourceInputs["uniqueId"] = state?.uniqueId;
}
else {
const args = argsOrState;
if (args?.assumeRolePolicy === undefined && !opts.urn) {
throw new Error("Missing required property 'assumeRolePolicy'");
}
resourceInputs["assumeRolePolicy"] = args?.assumeRolePolicy;
resourceInputs["description"] = args?.description;
resourceInputs["forceDetachPolicies"] = args?.forceDetachPolicies;
resourceInputs["inlinePolicies"] = args?.inlinePolicies;
resourceInputs["managedPolicyArns"] = args?.managedPolicyArns;
resourceInputs["maxSessionDuration"] = args?.maxSessionDuration;
resourceInputs["name"] = args?.name;
resourceInputs["namePrefix"] = args?.namePrefix;
resourceInputs["path"] = args?.path;
resourceInputs["permissionsBoundary"] = args?.permissionsBoundary;
resourceInputs["tags"] = args?.tags;
resourceInputs["arn"] = undefined /*out*/;
resourceInputs["createDate"] = undefined /*out*/;
resourceInputs["tagsAll"] = undefined /*out*/;
resourceInputs["uniqueId"] = undefined /*out*/;
}
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
super(Role.__pulumiType, name, resourceInputs, opts);
}
}
exports.Role = Role;
/** @internal */
Role.__pulumiType = 'aws:iam/role:Role';
//# sourceMappingURL=role.js.map