cdk-iam-floyd
Version:
AWS IAM policy statement generator with fluent interface for AWS CDK
592 lines (591 loc) • 23.5 kB
TypeScript
import { AccessLevelList } from '../../shared/access-level';
import { PolicyStatement, Operator } from '../../shared';
import { aws_iam as iam } from "aws-cdk-lib";
/**
* Statement provider for service [acm](https://docs.aws.amazon.com/service-authorization/latest/reference/list_acm.html).
*
* @param sid [SID](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html) of the statement
*/
export declare class Acm extends PolicyStatement {
servicePrefix: string;
/**
* Grants permission to add one or more tags to a certificate
*
* Access Level: Tagging, Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_AddTagsToCertificate.html
*/
toAddTagsToCertificate(): this;
/**
* Grants permission to create an ACME domain validation
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_CreateAcmeDomainValidation.html
*/
toCreateAcmeDomainValidation(): this;
/**
* Grants permission to create an ACME endpoint
*
* Access Level: Write
*
* Possible conditions:
* - .ifAwsRequestTag()
* - .ifAwsTagKeys()
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_CreateAcmeEndpoint.html
*/
toCreateAcmeEndpoint(): this;
/**
* Grants permission to create an ACME external account binding
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_CreateAcmeExternalAccountBinding.html
*/
toCreateAcmeExternalAccountBinding(): this;
/**
* Grants permission to delete an ACME domain validation
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_DeleteAcmeDomainValidation.html
*/
toDeleteAcmeDomainValidation(): this;
/**
* Grants permission to delete an ACME endpoint
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_DeleteAcmeEndpoint.html
*/
toDeleteAcmeEndpoint(): this;
/**
* Grants permission to delete an ACME external account binding
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_DeleteAcmeExternalAccountBinding.html
*/
toDeleteAcmeExternalAccountBinding(): this;
/**
* Grants permission to delete a certificate and its associated private key
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_DeleteCertificate.html
*/
toDeleteCertificate(): this;
/**
* Grants permission to retrieve details of an ACME account
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeAcmeAccount.html
*/
toDescribeAcmeAccount(): this;
/**
* Grants permission to retrieve details of an ACME domain validation
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeAcmeDomainValidation.html
*/
toDescribeAcmeDomainValidation(): this;
/**
* Grants permission to retrieve details of an ACME endpoint
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeAcmeEndpoint.html
*/
toDescribeAcmeEndpoint(): this;
/**
* Grants permission to retrieve details of an ACME external account binding
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeAcmeExternalAccountBinding.html
*/
toDescribeAcmeExternalAccountBinding(): this;
/**
* Grants permission to retreive a certificates and its metadata
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeCertificate.html
*/
toDescribeCertificate(): this;
/**
* Grants permission to export an exportable certificate for use anywhere
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_ExportCertificate.html
*/
toExportCertificate(): this;
/**
* Grants permission to retrieve account level configuration from AWS Certificate Manager
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_GetAccountConfiguration.html
*/
toGetAccountConfiguration(): this;
/**
* Grants permission to retrieve credentials for an ACME external account binding
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_GetAcmeExternalAccountBindingCredentials.html
*/
toGetAcmeExternalAccountBindingCredentials(): this;
/**
* Grants permission to retrieve a certificate and certificate chain for a certificate ARN
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_GetCertificate.html
*/
toGetCertificate(): this;
/**
* Grants permission to import a 3rd party certificate into AWS Certificate Manager (ACM)
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_ImportCertificate.html
*/
toImportCertificate(): this;
/**
* Grants permission to list ACME accounts
*
* Access Level: List
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_ListAcmeAccounts.html
*/
toListAcmeAccounts(): this;
/**
* Grants permission to list ACME domain validations
*
* Access Level: List
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_ListAcmeDomainValidations.html
*/
toListAcmeDomainValidations(): this;
/**
* Grants permission to list ACME endpoints
*
* Access Level: List
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_ListAcmeEndpoints.html
*/
toListAcmeEndpoints(): this;
/**
* Grants permission to list ACME external account bindings
*
* Access Level: List
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_ListAcmeExternalAccountBindings.html
*/
toListAcmeExternalAccountBindings(): this;
/**
* Grants permission to retrieve a list of certificates for specific certificate parameters
*
* Access Level: List
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_ListCertificates.html
*/
toListCertificates(): this;
/**
* Grants permission to lists the tags that have been associated with a certificate
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_ListTagsForCertificate.html
*/
toListTagsForCertificate(): this;
/**
* Grants permission to list tags for a resource
*
* Access Level: Read
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_ListTagsForResource.html
*/
toListTagsForResource(): this;
/**
* Grants permission to update account level configuration in AWS Certificate Manager
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_PutAccountConfiguration.html
*/
toPutAccountConfiguration(): this;
/**
* Grants permission to remove one or more tags from a certificate
*
* Access Level: Tagging, Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_RemoveTagsFromCertificate.html
*/
toRemoveTagsFromCertificate(): this;
/**
* Grants permission to renew an eligible private certificate
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_RenewCertificate.html
*/
toRenewCertificate(): this;
/**
* Grants permission to requests a public or private certificate
*
* Access Level: Write
*
* Possible conditions:
* - .ifCertificateAuthority()
* - .ifCertificateKeyPairOrigin()
* - .ifCertificateTransparencyLogging()
* - .ifDomainNames()
* - .ifExport()
* - .ifKeyAlgorithm()
* - .ifValidationMethod()
* - .ifAwsRequestTag()
* - .ifAwsTagKeys()
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_RequestCertificate.html
*/
toRequestCertificate(): this;
/**
* Grants permission to resend an email to request domain ownership validation
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_ResendValidationEmail.html
*/
toResendValidationEmail(): this;
/**
* Grants permission to revoke an ACME account
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_RevokeAcmeAccount.html
*/
toRevokeAcmeAccount(): this;
/**
* Grants permission to revoke an ACME external account binding
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_RevokeAcmeExternalAccountBinding.html
*/
toRevokeAcmeExternalAccountBinding(): this;
/**
* Grants permission to revoke an exportable certificate
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_RevokeCertificate.html
*/
toRevokeCertificate(): this;
/**
* Grants permission to retrieve a list of certificates matching search criteria
*
* Access Level: List
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_SearchCertificates.html
*/
toSearchCertificates(): this;
/**
* Grants permission to add tags to a resource
*
* Access Level: Tagging, Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_TagResource.html
*/
toTagResource(): this;
/**
* Grants permission to remove tags from a resource
*
* Access Level: Tagging, Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_UntagResource.html
*/
toUntagResource(): this;
/**
* Grants permission to update an ACME domain validation
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_UpdateAcmeDomainValidation.html
*/
toUpdateAcmeDomainValidation(): this;
/**
* Grants permission to update an ACME endpoint
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_UpdateAcmeEndpoint.html
*/
toUpdateAcmeEndpoint(): this;
/**
* Grants permission to update a certificate
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_UpdateCertificate.html
*/
toUpdateCertificate(): this;
/**
* Grants permission to update a certificate configuration. Use this to specify whether to opt in to or out of certificate transparency logging
*
* Access Level: Write
*
* https://docs.aws.amazon.com/acm/latest/APIReference/API_UpdateCertificateOptions.html
*/
toUpdateCertificateOptions(): this;
protected accessLevelList: AccessLevelList;
/**
* Adds a resource of type acme-domain-validation to the statement
*
* https://docs.aws.amazon.com/acm/latest/userguide/acm-acme-domain-validation.html
*
* @param acmeEndpointId - Identifier for the acmeEndpointId.
* @param acmeDomainValidationId - Identifier for the acmeDomainValidationId.
* @param account - Account of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's account.
* @param region - Region of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's region.
* @param partition - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to `aws`, unless using the CDK, where the default is the current Stack's partition.
*
* Possible conditions:
* - .ifAwsResourceTag()
*/
onAcmeDomainValidation(acmeEndpointId: string, acmeDomainValidationId: string, account?: string, region?: string, partition?: string): this;
/**
* Adds a resource of type acme-endpoint to the statement
*
* https://docs.aws.amazon.com/acm/latest/userguide/acm-acme-endpoints.html
*
* @param acmeEndpointId - Identifier for the acmeEndpointId.
* @param account - Account of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's account.
* @param region - Region of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's region.
* @param partition - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to `aws`, unless using the CDK, where the default is the current Stack's partition.
*
* Possible conditions:
* - .ifAwsResourceTag()
*/
onAcmeEndpoint(acmeEndpointId: string, account?: string, region?: string, partition?: string): this;
/**
* Adds a resource of type acme-external-account-binding to the statement
*
* https://docs.aws.amazon.com/acm/latest/userguide/acm-acme-eab.html
*
* @param acmeEndpointId - Identifier for the acmeEndpointId.
* @param externalAccountBindingId - Identifier for the externalAccountBindingId.
* @param account - Account of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's account.
* @param region - Region of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's region.
* @param partition - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to `aws`, unless using the CDK, where the default is the current Stack's partition.
*
* Possible conditions:
* - .ifAwsResourceTag()
*/
onAcmeExternalAccountBinding(acmeEndpointId: string, externalAccountBindingId: string, account?: string, region?: string, partition?: string): this;
/**
* Adds a resource of type certificate to the statement
*
* https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-acm-cert
*
* @param certificateId - Identifier for the certificateId.
* @param account - Account of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's account.
* @param region - Region of the resource; defaults to `*`, unless using the CDK, where the default is the current Stack's region.
* @param partition - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to `aws`, unless using the CDK, where the default is the current Stack's partition.
*
* Possible conditions:
* - .ifAwsResourceTag()
*/
onCertificate(certificateId: string, account?: string, region?: string, partition?: string): this;
/**
* Filters access by certificateAuthority in the request. Can be used to restrict which Certificate Authorites certificates can be issued from
*
* https://docs.aws.amazon.com/acm/latest/userguide/security-iam.html
*
* Applies to actions:
* - .toRequestCertificate()
*
* @param value The value(s) to check
* @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
*/
ifCertificateAuthority(value: string | string[], operator?: Operator | string): this;
/**
* Filters access by certificateKeyPairOrigin in the request. Can be used to restrict which certificate provisioning paths are permitted
*
* https://docs.aws.amazon.com/acm/latest/userguide/security-iam.html
*
* Applies to actions:
* - .toAddTagsToCertificate()
* - .toDeleteCertificate()
* - .toRequestCertificate()
* - .toRevokeCertificate()
* - .toUpdateCertificate()
*
* @param value The value(s) to check
* @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
*/
ifCertificateKeyPairOrigin(value: string | string[], operator?: Operator | string): this;
/**
* Filters access by certificateTransparencyLogging option in the request. Default 'ENABLED' if no key is present in the request
*
* https://docs.aws.amazon.com/acm/latest/userguide/security-iam.html
*
* Applies to actions:
* - .toRequestCertificate()
*
* @param value The value(s) to check
* @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
*/
ifCertificateTransparencyLogging(value: string | string[], operator?: Operator | string): this;
/**
* Filters access by domainNames in the request. This key can be used to restrict which domains can be in certificate requests
*
* https://docs.aws.amazon.com/acm/latest/userguide/security-iam.html
*
* Applies to actions:
* - .toExportCertificate()
* - .toRequestCertificate()
* - .toRevokeCertificate()
*
* @param value The value(s) to check
* @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
*/
ifDomainNames(value: string | string[], operator?: Operator | string): this;
/**
* Filters access by the export option in the request. Can be used to restrict creation of certificates that can be exported
*
* https://docs.aws.amazon.com/acm/latest/userguide/security-iam.html
*
* Applies to actions:
* - .toRequestCertificate()
*
* @param value The value(s) to check
* @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
*/
ifExport(value: string | string[], operator?: Operator | string): this;
/**
* Filters access by keyAlgorithm in the request
*
* https://docs.aws.amazon.com/acm/latest/userguide/security-iam.html
*
* Applies to actions:
* - .toRequestCertificate()
*
* @param value The value(s) to check
* @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
*/
ifKeyAlgorithm(value: string | string[], operator?: Operator | string): this;
/**
* Filters access by validationMethod in the request. Default 'EMAIL' if no key is present in the request
*
* https://docs.aws.amazon.com/acm/latest/userguide/security-iam.html
*
* Applies to actions:
* - .toRequestCertificate()
*
* @param value The value(s) to check
* @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
*/
ifValidationMethod(value: string | string[], operator?: Operator | string): this;
/**
* Filters access by the presence of tag key-value pairs in the request
*
* https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag
*
* Applies to actions:
* - .toAddTagsToCertificate()
* - .toCreateAcmeDomainValidation()
* - .toCreateAcmeEndpoint()
* - .toCreateAcmeExternalAccountBinding()
* - .toImportCertificate()
* - .toRemoveTagsFromCertificate()
* - .toRequestCertificate()
* - .toTagResource()
*
* @param tagKey The tag key to check
* @param value The value(s) to check
* @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
*/
ifAwsRequestTag(tagKey: string, value: string | string[], operator?: Operator | string): this;
/**
* Filters access by tag key-value pairs attached to the resource
*
* https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag
*
* Applies to actions:
* - .toAddTagsToCertificate()
* - .toCreateAcmeDomainValidation()
* - .toCreateAcmeExternalAccountBinding()
* - .toDeleteAcmeDomainValidation()
* - .toDeleteAcmeEndpoint()
* - .toDeleteAcmeExternalAccountBinding()
* - .toDeleteCertificate()
* - .toDescribeAcmeAccount()
* - .toDescribeAcmeDomainValidation()
* - .toDescribeAcmeEndpoint()
* - .toDescribeAcmeExternalAccountBinding()
* - .toDescribeCertificate()
* - .toExportCertificate()
* - .toGetAcmeExternalAccountBindingCredentials()
* - .toGetCertificate()
* - .toImportCertificate()
* - .toListAcmeAccounts()
* - .toListAcmeDomainValidations()
* - .toListAcmeExternalAccountBindings()
* - .toListTagsForCertificate()
* - .toListTagsForResource()
* - .toRemoveTagsFromCertificate()
* - .toRenewCertificate()
* - .toResendValidationEmail()
* - .toRevokeAcmeAccount()
* - .toRevokeAcmeExternalAccountBinding()
* - .toRevokeCertificate()
* - .toTagResource()
* - .toUntagResource()
* - .toUpdateAcmeDomainValidation()
* - .toUpdateAcmeEndpoint()
* - .toUpdateCertificate()
* - .toUpdateCertificateOptions()
*
* Applies to resource types:
* - acme-domain-validation
* - acme-endpoint
* - acme-external-account-binding
* - certificate
*
* @param tagKey The tag key to check
* @param value The value(s) to check
* @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
*/
ifAwsResourceTag(tagKey: string, value: string | string[], operator?: Operator | string): this;
/**
* Filters access by the presence of tag keys in the request
*
* https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys
*
* Applies to actions:
* - .toAddTagsToCertificate()
* - .toCreateAcmeDomainValidation()
* - .toCreateAcmeEndpoint()
* - .toCreateAcmeExternalAccountBinding()
* - .toImportCertificate()
* - .toRemoveTagsFromCertificate()
* - .toRequestCertificate()
* - .toTagResource()
* - .toUntagResource()
*
* @param value The value(s) to check
* @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
*/
ifAwsTagKeys(value: string | string[], operator?: Operator | string): this;
/**
* Statement provider for service [acm](https://docs.aws.amazon.com/service-authorization/latest/reference/list_acm.html).
*
*/
constructor(props?: iam.PolicyStatementProps);
}