Documentation
¶
Index ¶
- func AccessKey_IsConstruct(x interface{}) *bool
- func AccessKey_IsOwnedResource(construct constructs.IConstruct) *bool
- func AccessKey_IsResource(construct constructs.IConstruct) *bool
- func CfnAccessKey_CFN_RESOURCE_TYPE_NAME() *string
- func CfnAccessKey_IsCfnElement(x interface{}) *bool
- func CfnAccessKey_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnAccessKey_IsConstruct(x interface{}) *bool
- func CfnGroupPolicy_CFN_RESOURCE_TYPE_NAME() *string
- func CfnGroupPolicy_IsCfnElement(x interface{}) *bool
- func CfnGroupPolicy_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnGroupPolicy_IsConstruct(x interface{}) *bool
- func CfnGroup_CFN_RESOURCE_TYPE_NAME() *string
- func CfnGroup_IsCfnElement(x interface{}) *bool
- func CfnGroup_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnGroup_IsConstruct(x interface{}) *bool
- func CfnInstanceProfile_CFN_RESOURCE_TYPE_NAME() *string
- func CfnInstanceProfile_IsCfnElement(x interface{}) *bool
- func CfnInstanceProfile_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnInstanceProfile_IsConstruct(x interface{}) *bool
- func CfnManagedPolicy_CFN_RESOURCE_TYPE_NAME() *string
- func CfnManagedPolicy_IsCfnElement(x interface{}) *bool
- func CfnManagedPolicy_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnManagedPolicy_IsConstruct(x interface{}) *bool
- func CfnOIDCProvider_CFN_RESOURCE_TYPE_NAME() *string
- func CfnOIDCProvider_IsCfnElement(x interface{}) *bool
- func CfnOIDCProvider_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnOIDCProvider_IsConstruct(x interface{}) *bool
- func CfnPolicy_CFN_RESOURCE_TYPE_NAME() *string
- func CfnPolicy_IsCfnElement(x interface{}) *bool
- func CfnPolicy_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnPolicy_IsConstruct(x interface{}) *bool
- func CfnRolePolicy_CFN_RESOURCE_TYPE_NAME() *string
- func CfnRolePolicy_IsCfnElement(x interface{}) *bool
- func CfnRolePolicy_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnRolePolicy_IsConstruct(x interface{}) *bool
- func CfnRole_CFN_RESOURCE_TYPE_NAME() *string
- func CfnRole_IsCfnElement(x interface{}) *bool
- func CfnRole_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnRole_IsConstruct(x interface{}) *bool
- func CfnSAMLProvider_CFN_RESOURCE_TYPE_NAME() *string
- func CfnSAMLProvider_IsCfnElement(x interface{}) *bool
- func CfnSAMLProvider_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnSAMLProvider_IsConstruct(x interface{}) *bool
- func CfnServerCertificate_CFN_RESOURCE_TYPE_NAME() *string
- func CfnServerCertificate_IsCfnElement(x interface{}) *bool
- func CfnServerCertificate_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnServerCertificate_IsConstruct(x interface{}) *bool
- func CfnServiceLinkedRole_CFN_RESOURCE_TYPE_NAME() *string
- func CfnServiceLinkedRole_IsCfnElement(x interface{}) *bool
- func CfnServiceLinkedRole_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnServiceLinkedRole_IsConstruct(x interface{}) *bool
- func CfnUserPolicy_CFN_RESOURCE_TYPE_NAME() *string
- func CfnUserPolicy_IsCfnElement(x interface{}) *bool
- func CfnUserPolicy_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnUserPolicy_IsConstruct(x interface{}) *bool
- func CfnUserToGroupAddition_CFN_RESOURCE_TYPE_NAME() *string
- func CfnUserToGroupAddition_IsCfnElement(x interface{}) *bool
- func CfnUserToGroupAddition_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnUserToGroupAddition_IsConstruct(x interface{}) *bool
- func CfnUser_CFN_RESOURCE_TYPE_NAME() *string
- func CfnUser_IsCfnElement(x interface{}) *bool
- func CfnUser_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnUser_IsConstruct(x interface{}) *bool
- func CfnVirtualMFADevice_CFN_RESOURCE_TYPE_NAME() *string
- func CfnVirtualMFADevice_IsCfnElement(x interface{}) *bool
- func CfnVirtualMFADevice_IsCfnResource(construct constructs.IConstruct) *bool
- func CfnVirtualMFADevice_IsConstruct(x interface{}) *bool
- func ComparablePrincipal_DedupeStringFor(x IPrincipal) *string
- func ComparablePrincipal_IsComparablePrincipal(x IPrincipal) *bool
- func Group_IsConstruct(x interface{}) *bool
- func Group_IsOwnedResource(construct constructs.IConstruct) *bool
- func Group_IsResource(construct constructs.IConstruct) *bool
- func InstanceProfile_IsConstruct(x interface{}) *bool
- func InstanceProfile_IsOwnedResource(construct constructs.IConstruct) *bool
- func InstanceProfile_IsResource(construct constructs.IConstruct) *bool
- func LazyRole_IsConstruct(x interface{}) *bool
- func LazyRole_IsOwnedResource(construct constructs.IConstruct) *bool
- func LazyRole_IsResource(construct constructs.IConstruct) *bool
- func ManagedPolicy_IsConstruct(x interface{}) *bool
- func ManagedPolicy_IsOwnedResource(construct constructs.IConstruct) *bool
- func ManagedPolicy_IsResource(construct constructs.IConstruct) *bool
- func NewAccessKey_Override(a AccessKey, scope constructs.Construct, id *string, props *AccessKeyProps)
- func NewAccountPrincipal_Override(a AccountPrincipal, accountId interface{})
- func NewAccountRootPrincipal_Override(a AccountRootPrincipal)
- func NewAnyPrincipal_Override(a AnyPrincipal)
- func NewArnPrincipal_Override(a ArnPrincipal, arn *string)
- func NewCanonicalUserPrincipal_Override(c CanonicalUserPrincipal, canonicalUserId *string)
- func NewCfnAccessKey_Override(c CfnAccessKey, scope constructs.Construct, id *string, ...)
- func NewCfnGroupPolicy_Override(c CfnGroupPolicy, scope constructs.Construct, id *string, ...)
- func NewCfnGroup_Override(c CfnGroup, scope constructs.Construct, id *string, props *CfnGroupProps)
- func NewCfnInstanceProfile_Override(c CfnInstanceProfile, scope constructs.Construct, id *string, ...)
- func NewCfnManagedPolicy_Override(c CfnManagedPolicy, scope constructs.Construct, id *string, ...)
- func NewCfnOIDCProvider_Override(c CfnOIDCProvider, scope constructs.Construct, id *string, ...)
- func NewCfnPolicy_Override(c CfnPolicy, scope constructs.Construct, id *string, props *CfnPolicyProps)
- func NewCfnRolePolicy_Override(c CfnRolePolicy, scope constructs.Construct, id *string, ...)
- func NewCfnRole_Override(c CfnRole, scope constructs.Construct, id *string, props *CfnRoleProps)
- func NewCfnSAMLProvider_Override(c CfnSAMLProvider, scope constructs.Construct, id *string, ...)
- func NewCfnServerCertificate_Override(c CfnServerCertificate, scope constructs.Construct, id *string, ...)
- func NewCfnServiceLinkedRole_Override(c CfnServiceLinkedRole, scope constructs.Construct, id *string, ...)
- func NewCfnUserPolicy_Override(c CfnUserPolicy, scope constructs.Construct, id *string, ...)
- func NewCfnUserToGroupAddition_Override(c CfnUserToGroupAddition, scope constructs.Construct, id *string, ...)
- func NewCfnUser_Override(c CfnUser, scope constructs.Construct, id *string, props *CfnUserProps)
- func NewCfnVirtualMFADevice_Override(c CfnVirtualMFADevice, scope constructs.Construct, id *string, ...)
- func NewComparablePrincipal_Override(c ComparablePrincipal)
- func NewCompositeDependable_Override(c CompositeDependable, dependables ...constructs.IDependable)
- func NewCompositePrincipal_Override(c CompositePrincipal, principals ...IPrincipal)
- func NewFederatedPrincipal_Override(f FederatedPrincipal, federated *string, conditions *map[string]interface{}, ...)
- func NewGroup_Override(g Group, scope constructs.Construct, id *string, props *GroupProps)
- func NewInstanceProfile_Override(i InstanceProfile, scope constructs.Construct, id *string, ...)
- func NewLazyRole_Override(l LazyRole, scope constructs.Construct, id *string, props *LazyRoleProps)
- func NewManagedPolicy_Override(m ManagedPolicy, scope constructs.Construct, id *string, ...)
- func NewOpenIdConnectPrincipal_Override(o OpenIdConnectPrincipal, openIdConnectProvider IOpenIdConnectProvider, ...)
- func NewOpenIdConnectProvider_Override(o OpenIdConnectProvider, scope constructs.Construct, id *string, ...)
- func NewOrganizationPrincipal_Override(o OrganizationPrincipal, organizationId *string)
- func NewPolicyDocument_Override(p PolicyDocument, props *PolicyDocumentProps)
- func NewPolicyStatement_Override(p PolicyStatement, props *PolicyStatementProps)
- func NewPolicy_Override(p Policy, scope constructs.Construct, id *string, props *PolicyProps)
- func NewPrincipalBase_Override(p PrincipalBase)
- func NewPrincipalPolicyFragment_Override(p PrincipalPolicyFragment, principalJson *map[string]*[]*string, ...)
- func NewPrincipalWithConditions_Override(p PrincipalWithConditions, principal IPrincipal, ...)
- func NewRole_Override(r Role, scope constructs.Construct, id *string, props *RoleProps)
- func NewSamlConsolePrincipal_Override(s SamlConsolePrincipal, samlProvider ISamlProvider, ...)
- func NewSamlMetadataDocument_Override(s SamlMetadataDocument)
- func NewSamlPrincipal_Override(s SamlPrincipal, samlProvider ISamlProvider, ...)
- func NewSamlProvider_Override(s SamlProvider, scope constructs.Construct, id *string, ...)
- func NewServicePrincipal_Override(s ServicePrincipal, service *string, opts *ServicePrincipalOpts)
- func NewSessionTagsPrincipal_Override(s SessionTagsPrincipal, principal IPrincipal)
- func NewStarPrincipal_Override(s StarPrincipal)
- func NewUnknownPrincipal_Override(u UnknownPrincipal, props *UnknownPrincipalProps)
- func NewUser_Override(u User, scope constructs.Construct, id *string, props *UserProps)
- func NewWebIdentityPrincipal_Override(w WebIdentityPrincipal, identityProvider *string, ...)
- func OpenIdConnectProvider_IsConstruct(x interface{}) *bool
- func OpenIdConnectProvider_IsOwnedResource(construct constructs.IConstruct) *bool
- func OpenIdConnectProvider_IsResource(construct constructs.IConstruct) *bool
- func Policy_IsConstruct(x interface{}) *bool
- func Policy_IsOwnedResource(construct constructs.IConstruct) *bool
- func Policy_IsResource(construct constructs.IConstruct) *bool
- func Role_CustomizeRoles(scope constructs.Construct, options *CustomizeRolesOptions)
- func Role_IsConstruct(x interface{}) *bool
- func Role_IsOwnedResource(construct constructs.IConstruct) *bool
- func Role_IsResource(construct constructs.IConstruct) *bool
- func Role_IsRole(x interface{}) *bool
- func SamlProvider_IsConstruct(x interface{}) *bool
- func SamlProvider_IsOwnedResource(construct constructs.IConstruct) *bool
- func SamlProvider_IsResource(construct constructs.IConstruct) *bool
- func ServicePrincipal_ServicePrincipalName(service *string) *string
- func User_IsConstruct(x interface{}) *bool
- func User_IsOwnedResource(construct constructs.IConstruct) *bool
- func User_IsResource(construct constructs.IConstruct) *bool
- type AccessKey
- type AccessKeyProps
- type AccessKeyStatus
- type AccountPrincipal
- type AccountRootPrincipal
- type AddToPrincipalPolicyResult
- type AddToResourcePolicyResult
- type AnyPrincipal
- type ArnPrincipal
- type CanonicalUserPrincipal
- type CfnAccessKey
- type CfnAccessKeyProps
- type CfnGroup
- type CfnGroupPolicy
- type CfnGroupPolicyProps
- type CfnGroupProps
- type CfnGroup_PolicyProperty
- type CfnInstanceProfile
- type CfnInstanceProfileProps
- type CfnManagedPolicy
- type CfnManagedPolicyProps
- type CfnOIDCProvider
- type CfnOIDCProviderProps
- type CfnPolicy
- type CfnPolicyProps
- type CfnRole
- type CfnRolePolicy
- type CfnRolePolicyProps
- type CfnRoleProps
- type CfnRole_PolicyProperty
- type CfnSAMLProvider
- type CfnSAMLProviderProps
- type CfnServerCertificate
- type CfnServerCertificateProps
- type CfnServiceLinkedRole
- type CfnServiceLinkedRoleProps
- type CfnUser
- type CfnUserPolicy
- type CfnUserPolicyProps
- type CfnUserProps
- type CfnUserToGroupAddition
- type CfnUserToGroupAdditionProps
- type CfnUser_LoginProfileProperty
- type CfnUser_PolicyProperty
- type CfnVirtualMFADevice
- type CfnVirtualMFADeviceProps
- type CommonGrantOptions
- type ComparablePrincipal
- type CompositeDependable
- type CompositePrincipal
- type CustomizeRolesOptions
- type Effect
- type FederatedPrincipal
- type FromRoleArnOptions
- type FromRoleNameOptions
- type Grant
- type GrantOnPrincipalAndResourceOptions
- type GrantOnPrincipalOptions
- type GrantWithResourceOptions
- type Group
- type GroupProps
- type IAccessKey
- type IAssumeRolePrincipal
- type IComparablePrincipal
- type IGrantable
- type IGroup
- type IIdentity
- type IInstanceProfile
- func InstanceProfile_FromInstanceProfileArn(scope constructs.Construct, id *string, instanceProfileArn *string) IInstanceProfile
- func InstanceProfile_FromInstanceProfileAttributes(scope constructs.Construct, id *string, attrs *InstanceProfileAttributes) IInstanceProfile
- func InstanceProfile_FromInstanceProfileName(scope constructs.Construct, id *string, instanceProfileName *string) IInstanceProfile
- type IManagedPolicy
- func ManagedPolicy_FromAwsManagedPolicyName(managedPolicyName *string) IManagedPolicy
- func ManagedPolicy_FromManagedPolicyArn(scope constructs.Construct, id *string, managedPolicyArn *string) IManagedPolicy
- func ManagedPolicy_FromManagedPolicyName(scope constructs.Construct, id *string, managedPolicyName *string) IManagedPolicy
- type IOpenIdConnectProvider
- type IPolicy
- type IPrincipal
- type IResourceWithPolicy
- type IRole
- type ISamlProvider
- type IUser
- type InstanceProfile
- type InstanceProfileAttributes
- type InstanceProfileProps
- type LazyRole
- type LazyRoleProps
- type ManagedPolicy
- type ManagedPolicyProps
- type OpenIdConnectPrincipal
- type OpenIdConnectProvider
- type OpenIdConnectProviderProps
- type OrganizationPrincipal
- type PermissionsBoundary
- type Policy
- type PolicyDocument
- type PolicyDocumentProps
- type PolicyProps
- type PolicyStatement
- type PolicyStatementProps
- type PrincipalBase
- type PrincipalPolicyFragment
- type PrincipalWithConditions
- type Role
- type RoleProps
- type SamlConsolePrincipal
- type SamlMetadataDocument
- type SamlPrincipal
- type SamlProvider
- type SamlProviderProps
- type ServicePrincipal
- type ServicePrincipalOpts
- type SessionTagsPrincipal
- type StarPrincipal
- type UnknownPrincipal
- type UnknownPrincipalProps
- type User
- type UserAttributes
- type UserProps
- type WebIdentityPrincipal
- type WithoutPolicyUpdatesOptions
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AccessKey_IsConstruct ¶ added in v2.7.0
func AccessKey_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func AccessKey_IsOwnedResource ¶ added in v2.32.0
func AccessKey_IsOwnedResource(construct constructs.IConstruct) *bool
Returns true if the construct was created by CDK, and false otherwise.
func AccessKey_IsResource ¶ added in v2.7.0
func AccessKey_IsResource(construct constructs.IConstruct) *bool
Check whether the given construct is a Resource.
func CfnAccessKey_CFN_RESOURCE_TYPE_NAME ¶
func CfnAccessKey_CFN_RESOURCE_TYPE_NAME() *string
func CfnAccessKey_IsCfnElement ¶
func CfnAccessKey_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnAccessKey_IsCfnResource ¶
func CfnAccessKey_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnAccessKey_IsConstruct ¶
func CfnAccessKey_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnGroupPolicy_CFN_RESOURCE_TYPE_NAME ¶ added in v2.89.0
func CfnGroupPolicy_CFN_RESOURCE_TYPE_NAME() *string
func CfnGroupPolicy_IsCfnElement ¶ added in v2.89.0
func CfnGroupPolicy_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnGroupPolicy_IsCfnResource ¶ added in v2.89.0
func CfnGroupPolicy_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnGroupPolicy_IsConstruct ¶ added in v2.89.0
func CfnGroupPolicy_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnGroup_CFN_RESOURCE_TYPE_NAME ¶
func CfnGroup_CFN_RESOURCE_TYPE_NAME() *string
func CfnGroup_IsCfnElement ¶
func CfnGroup_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnGroup_IsCfnResource ¶
func CfnGroup_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnGroup_IsConstruct ¶
func CfnGroup_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnInstanceProfile_CFN_RESOURCE_TYPE_NAME ¶
func CfnInstanceProfile_CFN_RESOURCE_TYPE_NAME() *string
func CfnInstanceProfile_IsCfnElement ¶
func CfnInstanceProfile_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnInstanceProfile_IsCfnResource ¶
func CfnInstanceProfile_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnInstanceProfile_IsConstruct ¶
func CfnInstanceProfile_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnManagedPolicy_CFN_RESOURCE_TYPE_NAME ¶
func CfnManagedPolicy_CFN_RESOURCE_TYPE_NAME() *string
func CfnManagedPolicy_IsCfnElement ¶
func CfnManagedPolicy_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnManagedPolicy_IsCfnResource ¶
func CfnManagedPolicy_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnManagedPolicy_IsConstruct ¶
func CfnManagedPolicy_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnOIDCProvider_CFN_RESOURCE_TYPE_NAME ¶
func CfnOIDCProvider_CFN_RESOURCE_TYPE_NAME() *string
func CfnOIDCProvider_IsCfnElement ¶
func CfnOIDCProvider_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnOIDCProvider_IsCfnResource ¶
func CfnOIDCProvider_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnOIDCProvider_IsConstruct ¶
func CfnOIDCProvider_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnPolicy_CFN_RESOURCE_TYPE_NAME ¶
func CfnPolicy_CFN_RESOURCE_TYPE_NAME() *string
func CfnPolicy_IsCfnElement ¶
func CfnPolicy_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnPolicy_IsCfnResource ¶
func CfnPolicy_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnPolicy_IsConstruct ¶
func CfnPolicy_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnRolePolicy_CFN_RESOURCE_TYPE_NAME ¶ added in v2.89.0
func CfnRolePolicy_CFN_RESOURCE_TYPE_NAME() *string
func CfnRolePolicy_IsCfnElement ¶ added in v2.89.0
func CfnRolePolicy_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnRolePolicy_IsCfnResource ¶ added in v2.89.0
func CfnRolePolicy_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnRolePolicy_IsConstruct ¶ added in v2.89.0
func CfnRolePolicy_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnRole_CFN_RESOURCE_TYPE_NAME ¶
func CfnRole_CFN_RESOURCE_TYPE_NAME() *string
func CfnRole_IsCfnElement ¶
func CfnRole_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnRole_IsCfnResource ¶
func CfnRole_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnRole_IsConstruct ¶
func CfnRole_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnSAMLProvider_CFN_RESOURCE_TYPE_NAME ¶
func CfnSAMLProvider_CFN_RESOURCE_TYPE_NAME() *string
func CfnSAMLProvider_IsCfnElement ¶
func CfnSAMLProvider_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnSAMLProvider_IsCfnResource ¶
func CfnSAMLProvider_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnSAMLProvider_IsConstruct ¶
func CfnSAMLProvider_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnServerCertificate_CFN_RESOURCE_TYPE_NAME ¶
func CfnServerCertificate_CFN_RESOURCE_TYPE_NAME() *string
func CfnServerCertificate_IsCfnElement ¶
func CfnServerCertificate_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnServerCertificate_IsCfnResource ¶
func CfnServerCertificate_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnServerCertificate_IsConstruct ¶
func CfnServerCertificate_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnServiceLinkedRole_CFN_RESOURCE_TYPE_NAME ¶
func CfnServiceLinkedRole_CFN_RESOURCE_TYPE_NAME() *string
func CfnServiceLinkedRole_IsCfnElement ¶
func CfnServiceLinkedRole_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnServiceLinkedRole_IsCfnResource ¶
func CfnServiceLinkedRole_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnServiceLinkedRole_IsConstruct ¶
func CfnServiceLinkedRole_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnUserPolicy_CFN_RESOURCE_TYPE_NAME ¶ added in v2.89.0
func CfnUserPolicy_CFN_RESOURCE_TYPE_NAME() *string
func CfnUserPolicy_IsCfnElement ¶ added in v2.89.0
func CfnUserPolicy_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnUserPolicy_IsCfnResource ¶ added in v2.89.0
func CfnUserPolicy_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnUserPolicy_IsConstruct ¶ added in v2.89.0
func CfnUserPolicy_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnUserToGroupAddition_CFN_RESOURCE_TYPE_NAME ¶
func CfnUserToGroupAddition_CFN_RESOURCE_TYPE_NAME() *string
func CfnUserToGroupAddition_IsCfnElement ¶
func CfnUserToGroupAddition_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnUserToGroupAddition_IsCfnResource ¶
func CfnUserToGroupAddition_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnUserToGroupAddition_IsConstruct ¶
func CfnUserToGroupAddition_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnUser_CFN_RESOURCE_TYPE_NAME ¶
func CfnUser_CFN_RESOURCE_TYPE_NAME() *string
func CfnUser_IsCfnElement ¶
func CfnUser_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnUser_IsCfnResource ¶
func CfnUser_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnUser_IsConstruct ¶
func CfnUser_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func CfnVirtualMFADevice_CFN_RESOURCE_TYPE_NAME ¶
func CfnVirtualMFADevice_CFN_RESOURCE_TYPE_NAME() *string
func CfnVirtualMFADevice_IsCfnElement ¶
func CfnVirtualMFADevice_IsCfnElement(x interface{}) *bool
Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).
Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.
Returns: The construct as a stack element or undefined if it is not a stack element.
func CfnVirtualMFADevice_IsCfnResource ¶
func CfnVirtualMFADevice_IsCfnResource(construct constructs.IConstruct) *bool
Check whether the given construct is a CfnResource.
func CfnVirtualMFADevice_IsConstruct ¶
func CfnVirtualMFADevice_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func ComparablePrincipal_DedupeStringFor ¶ added in v2.26.0
func ComparablePrincipal_DedupeStringFor(x IPrincipal) *string
Return the dedupeString of the given principal, if available.
func ComparablePrincipal_IsComparablePrincipal ¶ added in v2.26.0
func ComparablePrincipal_IsComparablePrincipal(x IPrincipal) *bool
Whether or not the given principal is a comparable principal.
func Group_IsConstruct ¶
func Group_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func Group_IsOwnedResource ¶ added in v2.32.0
func Group_IsOwnedResource(construct constructs.IConstruct) *bool
Returns true if the construct was created by CDK, and false otherwise.
func Group_IsResource ¶
func Group_IsResource(construct constructs.IConstruct) *bool
Check whether the given construct is a Resource.
func InstanceProfile_IsConstruct ¶ added in v2.88.0
func InstanceProfile_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func InstanceProfile_IsOwnedResource ¶ added in v2.88.0
func InstanceProfile_IsOwnedResource(construct constructs.IConstruct) *bool
Returns true if the construct was created by CDK, and false otherwise.
func InstanceProfile_IsResource ¶ added in v2.88.0
func InstanceProfile_IsResource(construct constructs.IConstruct) *bool
Check whether the given construct is a Resource.
func LazyRole_IsConstruct ¶
func LazyRole_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func LazyRole_IsOwnedResource ¶ added in v2.32.0
func LazyRole_IsOwnedResource(construct constructs.IConstruct) *bool
Returns true if the construct was created by CDK, and false otherwise.
func LazyRole_IsResource ¶
func LazyRole_IsResource(construct constructs.IConstruct) *bool
Check whether the given construct is a Resource.
func ManagedPolicy_IsConstruct ¶
func ManagedPolicy_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func ManagedPolicy_IsOwnedResource ¶ added in v2.32.0
func ManagedPolicy_IsOwnedResource(construct constructs.IConstruct) *bool
Returns true if the construct was created by CDK, and false otherwise.
func ManagedPolicy_IsResource ¶
func ManagedPolicy_IsResource(construct constructs.IConstruct) *bool
Check whether the given construct is a Resource.
func NewAccessKey_Override ¶ added in v2.7.0
func NewAccessKey_Override(a AccessKey, scope constructs.Construct, id *string, props *AccessKeyProps)
func NewAccountPrincipal_Override ¶
func NewAccountPrincipal_Override(a AccountPrincipal, accountId interface{})
func NewAccountRootPrincipal_Override ¶
func NewAccountRootPrincipal_Override(a AccountRootPrincipal)
func NewAnyPrincipal_Override ¶
func NewAnyPrincipal_Override(a AnyPrincipal)
func NewArnPrincipal_Override ¶
func NewArnPrincipal_Override(a ArnPrincipal, arn *string)
func NewCanonicalUserPrincipal_Override ¶
func NewCanonicalUserPrincipal_Override(c CanonicalUserPrincipal, canonicalUserId *string)
func NewCfnAccessKey_Override ¶
func NewCfnAccessKey_Override(c CfnAccessKey, scope constructs.Construct, id *string, props *CfnAccessKeyProps)
func NewCfnGroupPolicy_Override ¶ added in v2.89.0
func NewCfnGroupPolicy_Override(c CfnGroupPolicy, scope constructs.Construct, id *string, props *CfnGroupPolicyProps)
func NewCfnGroup_Override ¶
func NewCfnGroup_Override(c CfnGroup, scope constructs.Construct, id *string, props *CfnGroupProps)
func NewCfnInstanceProfile_Override ¶
func NewCfnInstanceProfile_Override(c CfnInstanceProfile, scope constructs.Construct, id *string, props *CfnInstanceProfileProps)
func NewCfnManagedPolicy_Override ¶
func NewCfnManagedPolicy_Override(c CfnManagedPolicy, scope constructs.Construct, id *string, props *CfnManagedPolicyProps)
func NewCfnOIDCProvider_Override ¶
func NewCfnOIDCProvider_Override(c CfnOIDCProvider, scope constructs.Construct, id *string, props *CfnOIDCProviderProps)
func NewCfnPolicy_Override ¶
func NewCfnPolicy_Override(c CfnPolicy, scope constructs.Construct, id *string, props *CfnPolicyProps)
func NewCfnRolePolicy_Override ¶ added in v2.89.0
func NewCfnRolePolicy_Override(c CfnRolePolicy, scope constructs.Construct, id *string, props *CfnRolePolicyProps)
func NewCfnRole_Override ¶
func NewCfnRole_Override(c CfnRole, scope constructs.Construct, id *string, props *CfnRoleProps)
func NewCfnSAMLProvider_Override ¶
func NewCfnSAMLProvider_Override(c CfnSAMLProvider, scope constructs.Construct, id *string, props *CfnSAMLProviderProps)
func NewCfnServerCertificate_Override ¶
func NewCfnServerCertificate_Override(c CfnServerCertificate, scope constructs.Construct, id *string, props *CfnServerCertificateProps)
func NewCfnServiceLinkedRole_Override ¶
func NewCfnServiceLinkedRole_Override(c CfnServiceLinkedRole, scope constructs.Construct, id *string, props *CfnServiceLinkedRoleProps)
func NewCfnUserPolicy_Override ¶ added in v2.89.0
func NewCfnUserPolicy_Override(c CfnUserPolicy, scope constructs.Construct, id *string, props *CfnUserPolicyProps)
func NewCfnUserToGroupAddition_Override ¶
func NewCfnUserToGroupAddition_Override(c CfnUserToGroupAddition, scope constructs.Construct, id *string, props *CfnUserToGroupAdditionProps)
func NewCfnUser_Override ¶
func NewCfnUser_Override(c CfnUser, scope constructs.Construct, id *string, props *CfnUserProps)
func NewCfnVirtualMFADevice_Override ¶
func NewCfnVirtualMFADevice_Override(c CfnVirtualMFADevice, scope constructs.Construct, id *string, props *CfnVirtualMFADeviceProps)
func NewComparablePrincipal_Override ¶ added in v2.26.0
func NewComparablePrincipal_Override(c ComparablePrincipal)
func NewCompositeDependable_Override ¶
func NewCompositeDependable_Override(c CompositeDependable, dependables ...constructs.IDependable)
func NewCompositePrincipal_Override ¶
func NewCompositePrincipal_Override(c CompositePrincipal, principals ...IPrincipal)
func NewFederatedPrincipal_Override ¶
func NewFederatedPrincipal_Override(f FederatedPrincipal, federated *string, conditions *map[string]interface{}, assumeRoleAction *string)
func NewGroup_Override ¶
func NewGroup_Override(g Group, scope constructs.Construct, id *string, props *GroupProps)
func NewInstanceProfile_Override ¶ added in v2.88.0
func NewInstanceProfile_Override(i InstanceProfile, scope constructs.Construct, id *string, props *InstanceProfileProps)
func NewLazyRole_Override ¶
func NewLazyRole_Override(l LazyRole, scope constructs.Construct, id *string, props *LazyRoleProps)
func NewManagedPolicy_Override ¶
func NewManagedPolicy_Override(m ManagedPolicy, scope constructs.Construct, id *string, props *ManagedPolicyProps)
func NewOpenIdConnectPrincipal_Override ¶
func NewOpenIdConnectPrincipal_Override(o OpenIdConnectPrincipal, openIdConnectProvider IOpenIdConnectProvider, conditions *map[string]interface{})
func NewOpenIdConnectProvider_Override ¶
func NewOpenIdConnectProvider_Override(o OpenIdConnectProvider, scope constructs.Construct, id *string, props *OpenIdConnectProviderProps)
Defines an OpenID Connect provider.
func NewOrganizationPrincipal_Override ¶
func NewOrganizationPrincipal_Override(o OrganizationPrincipal, organizationId *string)
func NewPolicyDocument_Override ¶
func NewPolicyDocument_Override(p PolicyDocument, props *PolicyDocumentProps)
func NewPolicyStatement_Override ¶
func NewPolicyStatement_Override(p PolicyStatement, props *PolicyStatementProps)
func NewPolicy_Override ¶
func NewPolicy_Override(p Policy, scope constructs.Construct, id *string, props *PolicyProps)
func NewPrincipalBase_Override ¶
func NewPrincipalBase_Override(p PrincipalBase)
func NewPrincipalPolicyFragment_Override ¶
func NewPrincipalPolicyFragment_Override(p PrincipalPolicyFragment, principalJson *map[string]*[]*string, conditions *map[string]interface{})
func NewPrincipalWithConditions_Override ¶
func NewPrincipalWithConditions_Override(p PrincipalWithConditions, principal IPrincipal, conditions *map[string]interface{})
func NewRole_Override ¶
func NewSamlConsolePrincipal_Override ¶
func NewSamlConsolePrincipal_Override(s SamlConsolePrincipal, samlProvider ISamlProvider, conditions *map[string]interface{})
func NewSamlMetadataDocument_Override ¶
func NewSamlMetadataDocument_Override(s SamlMetadataDocument)
func NewSamlPrincipal_Override ¶
func NewSamlPrincipal_Override(s SamlPrincipal, samlProvider ISamlProvider, conditions *map[string]interface{})
func NewSamlProvider_Override ¶
func NewSamlProvider_Override(s SamlProvider, scope constructs.Construct, id *string, props *SamlProviderProps)
func NewServicePrincipal_Override ¶
func NewServicePrincipal_Override(s ServicePrincipal, service *string, opts *ServicePrincipalOpts)
Reference an AWS service, optionally in a given region.
func NewSessionTagsPrincipal_Override ¶ added in v2.4.0
func NewSessionTagsPrincipal_Override(s SessionTagsPrincipal, principal IPrincipal)
func NewStarPrincipal_Override ¶
func NewStarPrincipal_Override(s StarPrincipal)
func NewUnknownPrincipal_Override ¶
func NewUnknownPrincipal_Override(u UnknownPrincipal, props *UnknownPrincipalProps)
func NewUser_Override ¶
func NewWebIdentityPrincipal_Override ¶
func NewWebIdentityPrincipal_Override(w WebIdentityPrincipal, identityProvider *string, conditions *map[string]interface{})
func OpenIdConnectProvider_IsConstruct ¶
func OpenIdConnectProvider_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func OpenIdConnectProvider_IsOwnedResource ¶ added in v2.32.0
func OpenIdConnectProvider_IsOwnedResource(construct constructs.IConstruct) *bool
Returns true if the construct was created by CDK, and false otherwise.
func OpenIdConnectProvider_IsResource ¶
func OpenIdConnectProvider_IsResource(construct constructs.IConstruct) *bool
Check whether the given construct is a Resource.
func Policy_IsConstruct ¶
func Policy_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func Policy_IsOwnedResource ¶ added in v2.32.0
func Policy_IsOwnedResource(construct constructs.IConstruct) *bool
Returns true if the construct was created by CDK, and false otherwise.
func Policy_IsResource ¶
func Policy_IsResource(construct constructs.IConstruct) *bool
Check whether the given construct is a Resource.
func Role_CustomizeRoles ¶ added in v2.51.0
func Role_CustomizeRoles(scope constructs.Construct, options *CustomizeRolesOptions)
Customize the creation of IAM roles within the given scope.
It is recommended that you **do not** use this method and instead allow CDK to manage role creation. This should only be used in environments where CDK applications are not allowed to created IAM roles.
This can be used to prevent the CDK application from creating roles within the given scope and instead replace the references to the roles with precreated role names. A report will be synthesized in the cloud assembly (i.e. cdk.out) that will contain the list of IAM roles that would have been created along with the IAM policy statements that the role should contain. This report can then be used to create the IAM roles outside of CDK and then the created role names can be provided in `usePrecreatedRoles`.
Example:
var app app iam.Role_CustomizeRoles(app, &CustomizeRolesOptions{ UsePrecreatedRoles: map[string]*string{ "ConstructPath/To/Role": jsii.String("my-precreated-role-name"), }, })
func Role_IsConstruct ¶
func Role_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func Role_IsOwnedResource ¶ added in v2.32.0
func Role_IsOwnedResource(construct constructs.IConstruct) *bool
Returns true if the construct was created by CDK, and false otherwise.
func Role_IsResource ¶
func Role_IsResource(construct constructs.IConstruct) *bool
Check whether the given construct is a Resource.
func Role_IsRole ¶ added in v2.68.0
func Role_IsRole(x interface{}) *bool
Return whether the given object is a Role.
func SamlProvider_IsConstruct ¶
func SamlProvider_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func SamlProvider_IsOwnedResource ¶ added in v2.32.0
func SamlProvider_IsOwnedResource(construct constructs.IConstruct) *bool
Returns true if the construct was created by CDK, and false otherwise.
func SamlProvider_IsResource ¶
func SamlProvider_IsResource(construct constructs.IConstruct) *bool
Check whether the given construct is a Resource.
func ServicePrincipal_ServicePrincipalName ¶ added in v2.26.0
Return the service principal name based on the region it's used in.
Some service principal names used to be different for different partitions, and some were not. This method would return the appropriate region-specific service principal name, getting that information from the `region-info` module.
These days all service principal names are standardized, and they are all of the form `<servicename>.amazonaws.com`.
If the feature flag `@aws-cdk/aws-iam:standardizedServicePrincipals` is set, this method will always return its input. If this feature flag is not set, this method will perform the legacy behavior, which appends the region-specific domain suffix for some select services (for example, it would append `.cn` to some service principal names).
Example:
principalName := iam.ServicePrincipal_ServicePrincipalName(jsii.String("ec2.amazonaws.com"))
func User_IsConstruct ¶
func User_IsConstruct(x interface{}) *bool
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.
Returns: true if `x` is an object created from a class which extends `Construct`.
func User_IsOwnedResource ¶ added in v2.32.0
func User_IsOwnedResource(construct constructs.IConstruct) *bool
Returns true if the construct was created by CDK, and false otherwise.
func User_IsResource ¶
func User_IsResource(construct constructs.IConstruct) *bool
Check whether the given construct is a Resource.
Types ¶
type AccessKey ¶ added in v2.7.0
type AccessKey interface { awscdk.Resource IAccessKey // The Access Key ID. AccessKeyId() *string // The environment this resource belongs to. // // For resources that are created and managed by the CDK // (generally, those created by creating new class instances like Role, Bucket, etc.), // this is always the same as the environment of the stack they belong to; // however, for imported resources // (those obtained from static methods like fromRoleArn, fromBucketName, etc.), // that might be different than the stack they were imported into. Env() *awscdk.ResourceEnvironment // The tree node. Node() constructs.Node // Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource. // // This value will resolve to one of the following: // - a concrete value (e.g. `"my-awesome-bucket"`) // - `undefined`, when a name should be generated by CloudFormation // - a concrete name generated automatically during synthesis, in // cross-environment scenarios. PhysicalName() *string // The Secret Access Key. SecretAccessKey() awscdk.SecretValue // The stack in which this resource is defined. Stack() awscdk.Stack // Apply the given removal policy to this resource. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). ApplyRemovalPolicy(policy awscdk.RemovalPolicy) GeneratePhysicalName() *string // Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`). // // Normally, this token will resolve to `arnAttr`, but if the resource is // referenced across environments, `arnComponents` will be used to synthesize // a concrete ARN with the resource's physical name. Make sure to reference // `this.physicalName` in `arnComponents`. GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string // Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`). // // Normally, this token will resolve to `nameAttr`, but if the resource is // referenced across environments, it will be resolved to `this.physicalName`, // which will be a concrete name. GetResourceNameAttribute(nameAttr *string) *string // Returns a string representation of this construct. ToString() *string }
Define a new IAM Access Key.
Example:
// Creates a new IAM user, access and secret keys, and stores the secret access key in a Secret. user := iam.NewUser(this, jsii.String("User")) accessKey := iam.NewAccessKey(this, jsii.String("AccessKey"), &AccessKeyProps{ User: User, }) secret := secretsmanager.NewSecret(this, jsii.String("Secret"), &SecretProps{ SecretStringValue: accessKey.SecretAccessKey, })
func NewAccessKey ¶ added in v2.7.0
func NewAccessKey(scope constructs.Construct, id *string, props *AccessKeyProps) AccessKey
type AccessKeyProps ¶ added in v2.7.0
type AccessKeyProps struct { // The IAM user this key will belong to. // // Changing this value will result in the access key being deleted and a new // access key (with a different ID and secret value) being assigned to the new // user. User IUser `field:"required" json:"user" yaml:"user"` // A CloudFormation-specific value that signifies the access key should be replaced/rotated. // // This value can only be incremented. Incrementing this // value will cause CloudFormation to replace the Access Key resource. // Default: - No serial value. // Serial *float64 `field:"optional" json:"serial" yaml:"serial"` // The status of the access key. // // An Active access key is allowed to be used // to make API calls; An Inactive key cannot. // Default: - The access key is active. // Status AccessKeyStatus `field:"optional" json:"status" yaml:"status"` }
Properties for defining an IAM access key.
Example:
// Creates a new IAM user, access and secret keys, and stores the secret access key in a Secret. user := iam.NewUser(this, jsii.String("User")) accessKey := iam.NewAccessKey(this, jsii.String("AccessKey"), &AccessKeyProps{ User: User, }) secret := secretsmanager.NewSecret(this, jsii.String("Secret"), &SecretProps{ SecretStringValue: accessKey.SecretAccessKey, })
type AccessKeyStatus ¶ added in v2.7.0
type AccessKeyStatus string
Valid statuses for an IAM Access Key.
const ( // An active access key. // // An active key can be used to make API calls. AccessKeyStatus_ACTIVE AccessKeyStatus = "ACTIVE" // An inactive access key. // // An inactive key cannot be used to make API calls. AccessKeyStatus_INACTIVE AccessKeyStatus = "INACTIVE" )
type AccountPrincipal ¶
type AccountPrincipal interface { ArnPrincipal // AWS account ID (i.e. '123456789012'). AccountId() interface{} // Amazon Resource Name (ARN) of the principal entity (i.e. arn:aws:iam::123456789012:user/user-name). Arn() *string // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // A convenience method for adding a condition that the principal is part of the specified AWS Organization. InOrganization(organizationId *string) PrincipalBase // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
Specify AWS account ID as the principal entity in a policy to delegate authority to the account.
Example:
cluster := neptune.NewDatabaseCluster(this, jsii.String("Cluster"), &DatabaseClusterProps{ Vpc: Vpc, InstanceType: neptune.InstanceType_R5_LARGE(), IamAuthentication: jsii.Boolean(true), }) role := iam.NewRole(this, jsii.String("DBRole"), &RoleProps{ AssumedBy: iam.NewAccountPrincipal(this.Account), }) // Use one of the following statements to grant the role the necessary permissions cluster.GrantConnect(role) // Grant the role neptune-db:* access to the DB cluster.Grant(role, jsii.String("neptune-db:ReadDataViaQuery"), jsii.String("neptune-db:WriteDataViaQuery"))
func NewAccountPrincipal ¶
func NewAccountPrincipal(accountId interface{}) AccountPrincipal
type AccountRootPrincipal ¶
type AccountRootPrincipal interface { AccountPrincipal // AWS account ID (i.e. '123456789012'). AccountId() interface{} // Amazon Resource Name (ARN) of the principal entity (i.e. arn:aws:iam::123456789012:user/user-name). Arn() *string // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // A convenience method for adding a condition that the principal is part of the specified AWS Organization. InOrganization(organizationId *string) PrincipalBase // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
Use the AWS account into which a stack is deployed as the principal entity in a policy.
Example:
bucket := s3.NewBucket(this, jsii.String("MyBucket")) result := bucket.AddToResourcePolicy( iam.NewPolicyStatement(&PolicyStatementProps{ Actions: []*string{ jsii.String("s3:GetObject"), }, Resources: []*string{ bucket.ArnForObjects(jsii.String("file.txt")), }, Principals: []iPrincipal{ iam.NewAccountRootPrincipal(), }, }))
func NewAccountRootPrincipal ¶
func NewAccountRootPrincipal() AccountRootPrincipal
type AddToPrincipalPolicyResult ¶
type AddToPrincipalPolicyResult struct { // Whether the statement was added to the identity's policies. StatementAdded *bool `field:"required" json:"statementAdded" yaml:"statementAdded"` // Dependable which allows depending on the policy change being applied. // Default: - Required if `statementAdded` is true. // PolicyDependable constructs.IDependable `field:"optional" json:"policyDependable" yaml:"policyDependable"` }
Result of calling `addToPrincipalPolicy`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" import constructs "github.com/aws/constructs-go/constructs" var dependable iDependable addToPrincipalPolicyResult := &AddToPrincipalPolicyResult{ StatementAdded: jsii.Boolean(false), // the properties below are optional PolicyDependable: dependable, }
type AddToResourcePolicyResult ¶
type AddToResourcePolicyResult struct { // Whether the statement was added. StatementAdded *bool `field:"required" json:"statementAdded" yaml:"statementAdded"` // Dependable which allows depending on the policy change being applied. // Default: - If `statementAdded` is true, the resource object itself. // Otherwise, no dependable. // PolicyDependable constructs.IDependable `field:"optional" json:"policyDependable" yaml:"policyDependable"` }
Result of calling addToResourcePolicy.
Example:
bucket := s3.Bucket_FromBucketName(this, jsii.String("existingBucket"), jsii.String("bucket-name")) // No policy statement will be added to the resource result := bucket.AddToResourcePolicy( iam.NewPolicyStatement(&PolicyStatementProps{ Actions: []*string{ jsii.String("s3:GetObject"), }, Resources: []*string{ bucket.ArnForObjects(jsii.String("file.txt")), }, Principals: []iPrincipal{ iam.NewAccountRootPrincipal(), }, }))
type AnyPrincipal ¶
type AnyPrincipal interface { ArnPrincipal // Amazon Resource Name (ARN) of the principal entity (i.e. arn:aws:iam::123456789012:user/user-name). Arn() *string // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // A convenience method for adding a condition that the principal is part of the specified AWS Organization. InOrganization(organizationId *string) PrincipalBase // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
A principal representing all AWS identities in all accounts.
Some services behave differently when you specify `Principal: '*'` or `Principal: { AWS: "*" }` in their resource policy.
`AnyPrincipal` renders to `Principal: { AWS: "*" }`. This is correct most of the time, but in cases where you need the other principal, use `StarPrincipal` instead.
Example:
topic := sns.NewTopic(this, jsii.String("Topic")) topicPolicy := sns.NewTopicPolicy(this, jsii.String("TopicPolicy"), &TopicPolicyProps{ Topics: []iTopic{ topic, }, }) topicPolicy.Document.AddStatements(iam.NewPolicyStatement(&PolicyStatementProps{ Actions: []*string{ jsii.String("sns:Subscribe"), }, Principals: []iPrincipal{ iam.NewAnyPrincipal(), }, Resources: []*string{ topic.TopicArn, }, }))
func NewAnyPrincipal ¶
func NewAnyPrincipal() AnyPrincipal
type ArnPrincipal ¶
type ArnPrincipal interface { PrincipalBase // Amazon Resource Name (ARN) of the principal entity (i.e. arn:aws:iam::123456789012:user/user-name). Arn() *string // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // A convenience method for adding a condition that the principal is part of the specified AWS Organization. InOrganization(organizationId *string) PrincipalBase // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
Specify a principal by the Amazon Resource Name (ARN).
You can specify AWS accounts, IAM users, Federated SAML users, IAM roles, and specific assumed-role sessions. You cannot specify IAM groups or instance profiles as principals.
Example:
// Option 3: Create a new role that allows the account root principal to assume. Add this role in the `system:masters` and witch to this role from the AWS console. var cluster cluster consoleReadOnlyRole := iam.NewRole(this, jsii.String("ConsoleReadOnlyRole"), &RoleProps{ AssumedBy: iam.NewArnPrincipal(jsii.String("arn_for_trusted_principal")), }) consoleReadOnlyRole.AddToPolicy(iam.NewPolicyStatement(&PolicyStatementProps{ Actions: []*string{ jsii.String("eks:AccessKubernetesApi"), jsii.String("eks:Describe*"), jsii.String("eks:List*"), }, Resources: []*string{ cluster.ClusterArn, }, })) // Add this role to system:masters RBAC group cluster.awsAuth.AddMastersRole(consoleReadOnlyRole)
See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html
func NewArnPrincipal ¶
func NewArnPrincipal(arn *string) ArnPrincipal
type CanonicalUserPrincipal ¶
type CanonicalUserPrincipal interface { PrincipalBase // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // unique identifier assigned by AWS for every account. // // root user and IAM users for an account all see the same ID. // (i.e. 79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be) CanonicalUserId() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
A policy principal for canonicalUserIds - useful for S3 bucket policies that use Origin Access identities.
See https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html
and
for more details.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" canonicalUserPrincipal := awscdk.Aws_iam.NewCanonicalUserPrincipal(jsii.String("canonicalUserId"))
func NewCanonicalUserPrincipal ¶
func NewCanonicalUserPrincipal(canonicalUserId *string) CanonicalUserPrincipal
type CfnAccessKey ¶
type CfnAccessKey interface { awscdk.CfnResource awscdk.IInspectable AttrId() *string // Returns the secret access key for the specified AWS::IAM::AccessKey resource. // // For example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY. AttrSecretAccessKey() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // This value is specific to CloudFormation and can only be *incremented* . Serial() *float64 SetSerial(val *float64) // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // The status of the access key. Status() *string SetStatus(val *string) // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // The name of the IAM user that the new key will belong to. UserName() *string SetUserName(val *string) // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Creates a new AWS secret access key and corresponding AWS access key ID for the specified user.
The default status for new keys is `Active` .
For information about quotas on the number of keys you can create, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *IAM User Guide* .
> To ensure the security of your AWS account , the secret access key is accessible only during key and user creation. You must save the key (for example, in a text file) if you want to be able to access it again. If a secret key is lost, you can rotate access keys by increasing the value of the `serial` property.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnAccessKey := awscdk.Aws_iam.NewCfnAccessKey(this, jsii.String("MyCfnAccessKey"), &CfnAccessKeyProps{ UserName: jsii.String("userName"), // the properties below are optional Serial: jsii.Number(123), Status: jsii.String("status"), })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-accesskey.html
func NewCfnAccessKey ¶
func NewCfnAccessKey(scope constructs.Construct, id *string, props *CfnAccessKeyProps) CfnAccessKey
type CfnAccessKeyProps ¶
type CfnAccessKeyProps struct { // The name of the IAM user that the new key will belong to. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-accesskey.html#cfn-iam-accesskey-username // UserName *string `field:"required" json:"userName" yaml:"userName"` // This value is specific to CloudFormation and can only be *incremented* . // // Incrementing this value notifies CloudFormation that you want to rotate your access key. When you update your stack, CloudFormation will replace the existing access key with a new key. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-accesskey.html#cfn-iam-accesskey-serial // Serial *float64 `field:"optional" json:"serial" yaml:"serial"` // The status of the access key. // // `Active` means that the key is valid for API calls, while `Inactive` means it is not. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-accesskey.html#cfn-iam-accesskey-status // Status *string `field:"optional" json:"status" yaml:"status"` }
Properties for defining a `CfnAccessKey`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnAccessKeyProps := &CfnAccessKeyProps{ UserName: jsii.String("userName"), // the properties below are optional Serial: jsii.Number(123), Status: jsii.String("status"), }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-accesskey.html
type CfnGroup ¶
type CfnGroup interface { awscdk.CfnResource awscdk.IInspectable // Returns the Amazon Resource Name (ARN) for the specified `AWS::IAM::Group` resource. // // For example: `arn:aws:iam::123456789012:group/mystack-mygroup-1DZETITOWEKVO` . AttrArn() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The name of the group to create. // // Do not include the path in this value. GroupName() *string SetGroupName(val *string) // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The Amazon Resource Name (ARN) of the IAM policy you want to attach. ManagedPolicyArns() *[]*string SetManagedPolicyArns(val *[]*string) // The tree node. Node() constructs.Node // The path to the group. // // For more information about paths, see [IAM identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the *IAM User Guide* . Path() *string SetPath(val *string) // Adds or updates an inline policy document that is embedded in the specified IAM group. Policies() interface{} SetPolicies(val interface{}) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Creates a new group.
For information about the number of groups you can create, see [Limitations on IAM Entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/LimitationsOnEntities.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnGroup := awscdk.Aws_iam.NewCfnGroup(this, jsii.String("MyCfnGroup"), &CfnGroupProps{ GroupName: jsii.String("groupName"), ManagedPolicyArns: []*string{ jsii.String("managedPolicyArns"), }, Path: jsii.String("path"), Policies: []interface{}{ &PolicyProperty{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), }, }, })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-group.html
func NewCfnGroup ¶
func NewCfnGroup(scope constructs.Construct, id *string, props *CfnGroupProps) CfnGroup
type CfnGroupPolicy ¶ added in v2.89.0
type CfnGroupPolicy interface { awscdk.CfnResource awscdk.IInspectable // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The name of the group to associate the policy with. GroupName() *string SetGroupName(val *string) // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // The policy document. PolicyDocument() interface{} SetPolicyDocument(val interface{}) // The name of the policy document. PolicyName() *string SetPolicyName(val *string) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Adds or updates an inline policy document that is embedded in the specified IAM group.
A group can also have managed policies attached to it. To attach a managed policy to a group, use [`AWS::IAM::Group`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-group.html) . To create a new managed policy, use [`AWS::IAM::ManagedPolicy`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html) . For information about policies, see [Managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide* .
For information about the maximum number of inline policies that you can embed in a group, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnGroupPolicy := awscdk.Aws_iam.NewCfnGroupPolicy(this, jsii.String("MyCfnGroupPolicy"), &CfnGroupPolicyProps{ GroupName: jsii.String("groupName"), PolicyName: jsii.String("policyName"), // the properties below are optional PolicyDocument: policyDocument, })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-grouppolicy.html
func NewCfnGroupPolicy ¶ added in v2.89.0
func NewCfnGroupPolicy(scope constructs.Construct, id *string, props *CfnGroupPolicyProps) CfnGroupPolicy
type CfnGroupPolicyProps ¶ added in v2.89.0
type CfnGroupPolicyProps struct { // The name of the group to associate the policy with. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-grouppolicy.html#cfn-iam-grouppolicy-groupname // GroupName *string `field:"required" json:"groupName" yaml:"groupName"` // The name of the policy document. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-grouppolicy.html#cfn-iam-grouppolicy-policyname // PolicyName *string `field:"required" json:"policyName" yaml:"policyName"` // The policy document. // // You must provide policies in JSON format in IAM. However, for AWS CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. AWS CloudFormation always converts a YAML policy to JSON format before submitting it to IAM. // // The [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) used to validate this parameter is a string of characters consisting of the following: // // - Any printable ASCII character ranging from the space character ( `\u0020` ) through the end of the ASCII character range // - The printable characters in the Basic Latin and Latin-1 Supplement character set (through `\u00FF` ) // - The special characters tab ( `\u0009` ), line feed ( `\u000A` ), and carriage return ( `\u000D` ). // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-grouppolicy.html#cfn-iam-grouppolicy-policydocument // PolicyDocument interface{} `field:"optional" json:"policyDocument" yaml:"policyDocument"` }
Properties for defining a `CfnGroupPolicy`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnGroupPolicyProps := &CfnGroupPolicyProps{ GroupName: jsii.String("groupName"), PolicyName: jsii.String("policyName"), // the properties below are optional PolicyDocument: policyDocument, }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-grouppolicy.html
type CfnGroupProps ¶
type CfnGroupProps struct { // The name of the group to create. Do not include the path in this value. // // The group name must be unique within the account. Group names are not distinguished by case. For example, you cannot create groups named both "ADMINS" and "admins". If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the group name. // // > If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name. // // If you specify a name, you must specify the `CAPABILITY_NAMED_IAM` value to acknowledge your template's capabilities. For more information, see [Acknowledging IAM Resources in AWS CloudFormation Templates](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-capabilities) . // // > Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using `Fn::Join` and `AWS::Region` to create a Region-specific name, as in the following example: `{"Fn::Join": ["", [{"Ref": "AWS::Region"}, {"Ref": "MyResourceName"}]]}` . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-group.html#cfn-iam-group-groupname // GroupName *string `field:"optional" json:"groupName" yaml:"groupName"` // The Amazon Resource Name (ARN) of the IAM policy you want to attach. // // For more information about ARNs, see [Amazon Resource Names (ARNs)](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) in the *AWS General Reference* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-group.html#cfn-iam-group-managedpolicyarns // ManagedPolicyArns *[]*string `field:"optional" json:"managedPolicyArns" yaml:"managedPolicyArns"` // The path to the group. For more information about paths, see [IAM identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the *IAM User Guide* . // // This parameter is optional. If it is not included, it defaults to a slash (/). // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( `\u0021` ) through the DEL character ( `\u007F` ), including most punctuation characters, digits, and upper and lowercased letters. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-group.html#cfn-iam-group-path // Path *string `field:"optional" json:"path" yaml:"path"` // Adds or updates an inline policy document that is embedded in the specified IAM group. // // To view AWS::IAM::Group snippets, see [Declaring an IAM Group Resource](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-iam.html#scenario-iam-group) . // // > The name of each inline policy for a role, user, or group must be unique. If you don't choose unique names, updates to the IAM identity will fail. // // For information about limits on the number of inline policies that you can embed in a group, see [Limitations on IAM Entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/LimitationsOnEntities.html) in the *IAM User Guide* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-group.html#cfn-iam-group-policies // Policies interface{} `field:"optional" json:"policies" yaml:"policies"` }
Properties for defining a `CfnGroup`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnGroupProps := &CfnGroupProps{ GroupName: jsii.String("groupName"), ManagedPolicyArns: []*string{ jsii.String("managedPolicyArns"), }, Path: jsii.String("path"), Policies: []interface{}{ &PolicyProperty{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), }, }, }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-group.html
type CfnGroup_PolicyProperty ¶
type CfnGroup_PolicyProperty struct { // The policy document. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-group-policy.html#cfn-iam-group-policy-policydocument // PolicyDocument interface{} `field:"required" json:"policyDocument" yaml:"policyDocument"` // The friendly name (not ARN) identifying the policy. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-group-policy.html#cfn-iam-group-policy-policyname // PolicyName *string `field:"required" json:"policyName" yaml:"policyName"` }
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role.
For more information about managed policies, see [Managed Policies and Inline Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} policyProperty := &PolicyProperty{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-group-policy.html
type CfnInstanceProfile ¶
type CfnInstanceProfile interface { awscdk.CfnResource awscdk.IInspectable // Returns the Amazon Resource Name (ARN) for the instance profile. For example:. // // `{"Fn::GetAtt" : ["MyProfile", "Arn"] }` // // This returns a value such as `arn:aws:iam::1234567890:instance-profile/MyProfile-ASDNSDLKJ` . AttrArn() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The name of the instance profile to create. InstanceProfileName() *string SetInstanceProfileName(val *string) // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // The path to the instance profile. Path() *string SetPath(val *string) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The name of the role to associate with the instance profile. Roles() *[]*string SetRoles(val *[]*string) // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Creates a new instance profile. For information about instance profiles, see [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) .
For information about the number of instance profiles you can create, see [IAM object quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnInstanceProfile := awscdk.Aws_iam.NewCfnInstanceProfile(this, jsii.String("MyCfnInstanceProfile"), &CfnInstanceProfileProps{ Roles: []*string{ jsii.String("roles"), }, // the properties below are optional InstanceProfileName: jsii.String("instanceProfileName"), Path: jsii.String("path"), })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-instanceprofile.html
func NewCfnInstanceProfile ¶
func NewCfnInstanceProfile(scope constructs.Construct, id *string, props *CfnInstanceProfileProps) CfnInstanceProfile
type CfnInstanceProfileProps ¶
type CfnInstanceProfileProps struct { // The name of the role to associate with the instance profile. // // Only one role can be assigned to an EC2 instance at a time, and all applications on the instance share the same role and permissions. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-instanceprofile.html#cfn-iam-instanceprofile-roles // Roles *[]*string `field:"required" json:"roles" yaml:"roles"` // The name of the instance profile to create. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-instanceprofile.html#cfn-iam-instanceprofile-instanceprofilename // InstanceProfileName *string `field:"optional" json:"instanceProfileName" yaml:"instanceProfileName"` // The path to the instance profile. // // For more information about paths, see [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the *IAM User Guide* . // // This parameter is optional. If it is not included, it defaults to a slash (/). // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( `\u0021` ) through the DEL character ( `\u007F` ), including most punctuation characters, digits, and upper and lowercased letters. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-instanceprofile.html#cfn-iam-instanceprofile-path // Path *string `field:"optional" json:"path" yaml:"path"` }
Properties for defining a `CfnInstanceProfile`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnInstanceProfileProps := &CfnInstanceProfileProps{ Roles: []*string{ jsii.String("roles"), }, // the properties below are optional InstanceProfileName: jsii.String("instanceProfileName"), Path: jsii.String("path"), }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-instanceprofile.html
type CfnManagedPolicy ¶
type CfnManagedPolicy interface { awscdk.CfnResource awscdk.IInspectable // The number of principal entities (users, groups, and roles) that the policy is attached to. AttrAttachmentCount() *float64 // The date and time, in [ISO 8601 date-time format](https://docs.aws.amazon.com/http://www.iso.org/iso/iso8601) , when the policy was created. AttrCreateDate() *string // The identifier for the version of the policy that is set as the default (operative) version. // // For more information about policy versions, see [Versioning for managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-versions.html) in the *IAM User Guide* . AttrDefaultVersionId() *string // Specifies whether the policy can be attached to an IAM user, group, or role. AttrIsAttachable() awscdk.IResolvable // The number of entities (users and roles) for which the policy is used as the permissions boundary. // // For more information about permissions boundaries, see [Permissions boundaries for IAM identities](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the *IAM User Guide* . AttrPermissionsBoundaryUsageCount() *float64 // Amazon Resource Name (ARN) of the managed policy. AttrPolicyArn() *string // The stable and unique string identifying the policy. // // For more information about IDs, see [IAM identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the *IAM User Guide* . AttrPolicyId() *string // The date and time, in [ISO 8601 date-time format](https://docs.aws.amazon.com/http://www.iso.org/iso/iso8601) , when the policy was last updated. // // When a policy has only one version, this field contains the date and time when the policy was created. When a policy has more than one version, this field contains the date and time when the most recent policy version was created. AttrUpdateDate() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // A friendly description of the policy. Description() *string SetDescription(val *string) // The name (friendly name, not ARN) of the group to attach the policy to. Groups() *[]*string SetGroups(val *[]*string) // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The friendly name of the policy. ManagedPolicyName() *string SetManagedPolicyName(val *string) // The tree node. Node() constructs.Node // The path for the policy. Path() *string SetPath(val *string) // The JSON policy document that you want to use as the content for the new policy. PolicyDocument() interface{} SetPolicyDocument(val interface{}) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The name (friendly name, not ARN) of the role to attach the policy to. Roles() *[]*string SetRoles(val *[]*string) // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // The name (friendly name, not ARN) of the IAM user to attach the policy to. Users() *[]*string SetUsers(val *[]*string) // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Creates a new managed policy for your AWS account .
This operation creates a policy version with a version identifier of `v1` and sets v1 as the policy's default version. For more information about policy versions, see [Versioning for managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-versions.html) in the *IAM User Guide* .
As a best practice, you can validate your IAM policies. To learn more, see [Validating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_policy-validator.html) in the *IAM User Guide* .
For more information about managed policies in general, see [Managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnManagedPolicy := awscdk.Aws_iam.NewCfnManagedPolicy(this, jsii.String("MyCfnManagedPolicy"), &CfnManagedPolicyProps{ PolicyDocument: policyDocument, // the properties below are optional Description: jsii.String("description"), Groups: []*string{ jsii.String("groups"), }, ManagedPolicyName: jsii.String("managedPolicyName"), Path: jsii.String("path"), Roles: []*string{ jsii.String("roles"), }, Users: []*string{ jsii.String("users"), }, })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html
func NewCfnManagedPolicy ¶
func NewCfnManagedPolicy(scope constructs.Construct, id *string, props *CfnManagedPolicyProps) CfnManagedPolicy
type CfnManagedPolicyProps ¶
type CfnManagedPolicyProps struct { // The JSON policy document that you want to use as the content for the new policy. // // You must provide policies in JSON format in IAM. However, for AWS CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. AWS CloudFormation always converts a YAML policy to JSON format before submitting it to IAM. // // The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see [IAM and AWS STS character quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-quotas-entity-length) . // // To learn more about JSON policy grammar, see [Grammar of the IAM JSON policy language](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_grammar.html) in the *IAM User Guide* . // // The [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) used to validate this parameter is a string of characters consisting of the following: // // - Any printable ASCII character ranging from the space character ( `\u0020` ) through the end of the ASCII character range // - The printable characters in the Basic Latin and Latin-1 Supplement character set (through `\u00FF` ) // - The special characters tab ( `\u0009` ), line feed ( `\u000A` ), and carriage return ( `\u000D` ). // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html#cfn-iam-managedpolicy-policydocument // PolicyDocument interface{} `field:"required" json:"policyDocument" yaml:"policyDocument"` // A friendly description of the policy. // // Typically used to store information about the permissions defined in the policy. For example, "Grants access to production DynamoDB tables." // // The policy description is immutable. After a value is assigned, it cannot be changed. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html#cfn-iam-managedpolicy-description // Description *string `field:"optional" json:"description" yaml:"description"` // The name (friendly name, not ARN) of the group to attach the policy to. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html#cfn-iam-managedpolicy-groups // Groups *[]*string `field:"optional" json:"groups" yaml:"groups"` // The friendly name of the policy. // // > If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name. // // If you specify a name, you must specify the `CAPABILITY_NAMED_IAM` value to acknowledge your template's capabilities. For more information, see [Acknowledging IAM Resources in AWS CloudFormation Templates](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-capabilities) . // // > Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using `Fn::Join` and `AWS::Region` to create a Region-specific name, as in the following example: `{"Fn::Join": ["", [{"Ref": "AWS::Region"}, {"Ref": "MyResourceName"}]]}` . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html#cfn-iam-managedpolicy-managedpolicyname // ManagedPolicyName *string `field:"optional" json:"managedPolicyName" yaml:"managedPolicyName"` // The path for the policy. // // For more information about paths, see [IAM identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the *IAM User Guide* . // // This parameter is optional. If it is not included, it defaults to a slash (/). // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( `\u0021` ) through the DEL character ( `\u007F` ), including most punctuation characters, digits, and upper and lowercased letters. // // > You cannot use an asterisk (*) in the path name. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html#cfn-iam-managedpolicy-path // Path *string `field:"optional" json:"path" yaml:"path"` // The name (friendly name, not ARN) of the role to attach the policy to. // // This parameter allows (per its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // // > If an external policy (such as `AWS::IAM::Policy` or `AWS::IAM::ManagedPolicy` ) has a `Ref` to a role and if a resource (such as `AWS::ECS::Service` ) also has a `Ref` to the same role, add a `DependsOn` attribute to the resource to make the resource depend on the external policy. This dependency ensures that the role's policy is available throughout the resource's lifecycle. For example, when you delete a stack with an `AWS::ECS::Service` resource, the `DependsOn` attribute ensures that AWS CloudFormation deletes the `AWS::ECS::Service` resource before deleting its role's policy. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html#cfn-iam-managedpolicy-roles // Roles *[]*string `field:"optional" json:"roles" yaml:"roles"` // The name (friendly name, not ARN) of the IAM user to attach the policy to. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html#cfn-iam-managedpolicy-users // Users *[]*string `field:"optional" json:"users" yaml:"users"` }
Properties for defining a `CfnManagedPolicy`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnManagedPolicyProps := &CfnManagedPolicyProps{ PolicyDocument: policyDocument, // the properties below are optional Description: jsii.String("description"), Groups: []*string{ jsii.String("groups"), }, ManagedPolicyName: jsii.String("managedPolicyName"), Path: jsii.String("path"), Roles: []*string{ jsii.String("roles"), }, Users: []*string{ jsii.String("users"), }, }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html
type CfnOIDCProvider ¶
type CfnOIDCProvider interface { awscdk.CfnResource awscdk.IInspectable awscdk.ITaggable // Returns the Amazon Resource Name (ARN) for the specified `AWS::IAM::OIDCProvider` resource. AttrArn() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // A list of client IDs (also known as audiences) that are associated with the specified IAM OIDC provider resource object. ClientIdList() *[]*string SetClientIdList(val *[]*string) // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Tag Manager which manages the tags for this resource. Tags() awscdk.TagManager // A list of tags that are attached to the specified IAM OIDC provider. TagsRaw() *[]*awscdk.CfnTag SetTagsRaw(val *[]*awscdk.CfnTag) // A list of certificate thumbprints that are associated with the specified IAM OIDC provider resource object. ThumbprintList() *[]*string SetThumbprintList(val *[]*string) // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // The URL that the IAM OIDC provider resource object is associated with. Url() *string SetUrl(val *string) // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Creates or updates an IAM entity to describe an identity provider (IdP) that supports [OpenID Connect (OIDC)](https://docs.aws.amazon.com/http://openid.net/connect/) .
The OIDC provider that you create with this operation can be used as a principal in a role's trust policy. Such a policy establishes a trust relationship between AWS and the OIDC provider.
When you create the IAM OIDC provider, you specify the following:
- The URL of the OIDC identity provider (IdP) to trust - A list of client IDs (also known as audiences) that identify the application or applications that are allowed to authenticate using the OIDC provider - A list of tags that are attached to the specified IAM OIDC provider - A list of thumbprints of one or more server certificates that the IdP uses
You get all of this information from the OIDC IdP that you want to use to access AWS .
When you update the IAM OIDC provider, you specify the following:
- The URL of the OIDC identity provider (IdP) to trust - A list of client IDs (also known as audiences) that replaces the existing list of client IDs associated with the OIDC IdP - A list of tags that replaces the existing list of tags attached to the specified IAM OIDC provider - A list of thumbprints that replaces the existing list of server certificates thumbprints that the IdP uses
> The trust for the OIDC provider is derived from the IAM provider that this operation creates. Therefore, it is best to limit access to the [CreateOpenIDConnectProvider](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateOpenIDConnectProvider.html) operation to highly privileged users.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnOIDCProvider := awscdk.Aws_iam.NewCfnOIDCProvider(this, jsii.String("MyCfnOIDCProvider"), &CfnOIDCProviderProps{ ThumbprintList: []*string{ jsii.String("thumbprintList"), }, // the properties below are optional ClientIdList: []*string{ jsii.String("clientIdList"), }, Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, Url: jsii.String("url"), })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-oidcprovider.html
func NewCfnOIDCProvider ¶
func NewCfnOIDCProvider(scope constructs.Construct, id *string, props *CfnOIDCProviderProps) CfnOIDCProvider
type CfnOIDCProviderProps ¶
type CfnOIDCProviderProps struct { // A list of certificate thumbprints that are associated with the specified IAM OIDC provider resource object. // // For more information, see [CreateOpenIDConnectProvider](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateOpenIDConnectProvider.html) . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-oidcprovider.html#cfn-iam-oidcprovider-thumbprintlist // ThumbprintList *[]*string `field:"required" json:"thumbprintList" yaml:"thumbprintList"` // A list of client IDs (also known as audiences) that are associated with the specified IAM OIDC provider resource object. // // For more information, see [CreateOpenIDConnectProvider](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateOpenIDConnectProvider.html) . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-oidcprovider.html#cfn-iam-oidcprovider-clientidlist // ClientIdList *[]*string `field:"optional" json:"clientIdList" yaml:"clientIdList"` // A list of tags that are attached to the specified IAM OIDC provider. // // The returned list of tags is sorted by tag key. For more information about tagging, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *IAM User Guide* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-oidcprovider.html#cfn-iam-oidcprovider-tags // Tags *[]*awscdk.CfnTag `field:"optional" json:"tags" yaml:"tags"` // The URL that the IAM OIDC provider resource object is associated with. // // For more information, see [CreateOpenIDConnectProvider](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateOpenIDConnectProvider.html) . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-oidcprovider.html#cfn-iam-oidcprovider-url // Url *string `field:"optional" json:"url" yaml:"url"` }
Properties for defining a `CfnOIDCProvider`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnOIDCProviderProps := &CfnOIDCProviderProps{ ThumbprintList: []*string{ jsii.String("thumbprintList"), }, // the properties below are optional ClientIdList: []*string{ jsii.String("clientIdList"), }, Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, Url: jsii.String("url"), }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-oidcprovider.html
type CfnPolicy ¶
type CfnPolicy interface { awscdk.CfnResource awscdk.IInspectable // The provider-assigned unique ID for this resource. AttrId() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The name of the group to associate the policy with. Groups() *[]*string SetGroups(val *[]*string) // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // The policy document. PolicyDocument() interface{} SetPolicyDocument(val interface{}) // The name of the policy document. PolicyName() *string SetPolicyName(val *string) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The name of the role to associate the policy with. Roles() *[]*string SetRoles(val *[]*string) // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // The name of the user to associate the policy with. Users() *[]*string SetUsers(val *[]*string) // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Adds or updates an inline policy document that is embedded in the specified IAM group, user or role.
An IAM user can also have a managed policy attached to it. For information about policies, see [Managed Policies and Inline Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide* .
The Groups, Roles, and Users properties are optional. However, you must specify at least one of these properties.
For information about policy documents see [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the *IAM User Guide* .
For information about limits on the number of inline policies that you can embed in an identity, see [Limitations on IAM Entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/LimitationsOnEntities.html) in the *IAM User Guide* .
> This resource does not support [drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html) . The following inline policy resource types support drift detection: > > - [`AWS::IAM::GroupPolicy`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-grouppolicy.html) > - [`AWS::IAM::RolePolicy`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-rolepolicy.html) > - [`AWS::IAM::UserPolicy`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-userpolicy.html)
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnPolicy := awscdk.Aws_iam.NewCfnPolicy(this, jsii.String("MyCfnPolicy"), &CfnPolicyProps{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), // the properties below are optional Groups: []*string{ jsii.String("groups"), }, Roles: []*string{ jsii.String("roles"), }, Users: []*string{ jsii.String("users"), }, })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
func NewCfnPolicy ¶
func NewCfnPolicy(scope constructs.Construct, id *string, props *CfnPolicyProps) CfnPolicy
type CfnPolicyProps ¶
type CfnPolicyProps struct { // The policy document. // // You must provide policies in JSON format in IAM. However, for AWS CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. AWS CloudFormation always converts a YAML policy to JSON format before submitting it to IAM. // // The [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) used to validate this parameter is a string of characters consisting of the following: // // - Any printable ASCII character ranging from the space character ( `\u0020` ) through the end of the ASCII character range // - The printable characters in the Basic Latin and Latin-1 Supplement character set (through `\u00FF` ) // - The special characters tab ( `\u0009` ), line feed ( `\u000A` ), and carriage return ( `\u000D` ). // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html#cfn-iam-policy-policydocument // PolicyDocument interface{} `field:"required" json:"policyDocument" yaml:"policyDocument"` // The name of the policy document. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html#cfn-iam-policy-policyname // PolicyName *string `field:"required" json:"policyName" yaml:"policyName"` // The name of the group to associate the policy with. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html#cfn-iam-policy-groups // Groups *[]*string `field:"optional" json:"groups" yaml:"groups"` // The name of the role to associate the policy with. // // This parameter allows (per its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // // > If an external policy (such as `AWS::IAM::Policy` or `AWS::IAM::ManagedPolicy` ) has a `Ref` to a role and if a resource (such as `AWS::ECS::Service` ) also has a `Ref` to the same role, add a `DependsOn` attribute to the resource to make the resource depend on the external policy. This dependency ensures that the role's policy is available throughout the resource's lifecycle. For example, when you delete a stack with an `AWS::ECS::Service` resource, the `DependsOn` attribute ensures that AWS CloudFormation deletes the `AWS::ECS::Service` resource before deleting its role's policy. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html#cfn-iam-policy-roles // Roles *[]*string `field:"optional" json:"roles" yaml:"roles"` // The name of the user to associate the policy with. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html#cfn-iam-policy-users // Users *[]*string `field:"optional" json:"users" yaml:"users"` }
Properties for defining a `CfnPolicy`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnPolicyProps := &CfnPolicyProps{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), // the properties below are optional Groups: []*string{ jsii.String("groups"), }, Roles: []*string{ jsii.String("roles"), }, Users: []*string{ jsii.String("users"), }, }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
type CfnRole ¶
type CfnRole interface { awscdk.CfnResource awscdk.IInspectable awscdk.ITaggable // The trust policy that is associated with this role. AssumeRolePolicyDocument() interface{} SetAssumeRolePolicyDocument(val interface{}) // Returns the Amazon Resource Name (ARN) for the role. For example:. // // `{"Fn::GetAtt" : ["MyRole", "Arn"] }` // // This will return a value such as `arn:aws:iam::1234567890:role/MyRole-AJJHDSKSDF` . AttrArn() *string // Returns the stable and unique string identifying the role. For example, `AIDAJQABLZS4A3QDU576Q` . // // For more information about IDs, see [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html) in the *IAM User Guide* . AttrRoleId() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // A description of the role that you provide. Description() *string SetDescription(val *string) // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // A list of Amazon Resource Names (ARNs) of the IAM managed policies that you want to attach to the role. ManagedPolicyArns() *[]*string SetManagedPolicyArns(val *[]*string) // The maximum session duration (in seconds) that you want to set for the specified role. MaxSessionDuration() *float64 SetMaxSessionDuration(val *float64) // The tree node. Node() constructs.Node // The path to the role. // // For more information about paths, see [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the *IAM User Guide* . Path() *string SetPath(val *string) // The ARN of the policy used to set the permissions boundary for the role. PermissionsBoundary() *string SetPermissionsBoundary(val *string) // Adds or updates an inline policy document that is embedded in the specified IAM role. Policies() interface{} SetPolicies(val interface{}) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // A name for the IAM role, up to 64 characters in length. RoleName() *string SetRoleName(val *string) // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Tag Manager which manages the tags for this resource. Tags() awscdk.TagManager // A list of tags that are attached to the role. TagsRaw() *[]*awscdk.CfnTag SetTagsRaw(val *[]*awscdk.CfnTag) // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Creates a new role for your AWS account .
For more information about roles, see [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) in the *IAM User Guide* . For information about quotas for role names and the number of roles you can create, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var assumeRolePolicyDocument interface{} var policyDocument interface{} cfnRole := awscdk.Aws_iam.NewCfnRole(this, jsii.String("MyCfnRole"), &CfnRoleProps{ AssumeRolePolicyDocument: assumeRolePolicyDocument, // the properties below are optional Description: jsii.String("description"), ManagedPolicyArns: []*string{ jsii.String("managedPolicyArns"), }, MaxSessionDuration: jsii.Number(123), Path: jsii.String("path"), PermissionsBoundary: jsii.String("permissionsBoundary"), Policies: []interface{}{ &PolicyProperty{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), }, }, RoleName: jsii.String("roleName"), Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html
func NewCfnRole ¶
func NewCfnRole(scope constructs.Construct, id *string, props *CfnRoleProps) CfnRole
type CfnRolePolicy ¶ added in v2.89.0
type CfnRolePolicy interface { awscdk.CfnResource awscdk.IInspectable // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // The policy document. PolicyDocument() interface{} SetPolicyDocument(val interface{}) // The name of the policy document. PolicyName() *string SetPolicyName(val *string) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The name of the role to associate the policy with. RoleName() *string SetRoleName(val *string) // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Adds or updates an inline policy document that is embedded in the specified IAM role.
When you embed an inline policy in a role, the inline policy is used as part of the role's access (permissions) policy. The role's trust policy is created at the same time as the role, using [`CreateRole`](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html) . You can update a role's trust policy using [`UpdateAssumeRolePolicy`](https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAssumeRolePolicy.html) . For information about roles, see [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-toplevel.html) in the *IAM User Guide* .
A role can also have a managed policy attached to it. To attach a managed policy to a role, use [`AWS::IAM::Role`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html) . To create a new managed policy, use [`AWS::IAM::ManagedPolicy`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html) . For information about policies, see [Managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide* .
For information about the maximum number of inline policies that you can embed with a role, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnRolePolicy := awscdk.Aws_iam.NewCfnRolePolicy(this, jsii.String("MyCfnRolePolicy"), &CfnRolePolicyProps{ PolicyName: jsii.String("policyName"), RoleName: jsii.String("roleName"), // the properties below are optional PolicyDocument: policyDocument, })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-rolepolicy.html
func NewCfnRolePolicy ¶ added in v2.89.0
func NewCfnRolePolicy(scope constructs.Construct, id *string, props *CfnRolePolicyProps) CfnRolePolicy
type CfnRolePolicyProps ¶ added in v2.89.0
type CfnRolePolicyProps struct { // The name of the policy document. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-rolepolicy.html#cfn-iam-rolepolicy-policyname // PolicyName *string `field:"required" json:"policyName" yaml:"policyName"` // The name of the role to associate the policy with. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-rolepolicy.html#cfn-iam-rolepolicy-rolename // RoleName *string `field:"required" json:"roleName" yaml:"roleName"` // The policy document. // // You must provide policies in JSON format in IAM. However, for AWS CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. AWS CloudFormation always converts a YAML policy to JSON format before submitting it to IAM. // // The [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) used to validate this parameter is a string of characters consisting of the following: // // - Any printable ASCII character ranging from the space character ( `\u0020` ) through the end of the ASCII character range // - The printable characters in the Basic Latin and Latin-1 Supplement character set (through `\u00FF` ) // - The special characters tab ( `\u0009` ), line feed ( `\u000A` ), and carriage return ( `\u000D` ). // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-rolepolicy.html#cfn-iam-rolepolicy-policydocument // PolicyDocument interface{} `field:"optional" json:"policyDocument" yaml:"policyDocument"` }
Properties for defining a `CfnRolePolicy`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnRolePolicyProps := &CfnRolePolicyProps{ PolicyName: jsii.String("policyName"), RoleName: jsii.String("roleName"), // the properties below are optional PolicyDocument: policyDocument, }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-rolepolicy.html
type CfnRoleProps ¶
type CfnRoleProps struct { // The trust policy that is associated with this role. // // Trust policies define which entities can assume the role. You can associate only one trust policy with a role. For an example of a policy that can be used to assume a role, see [Template Examples](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#aws-resource-iam-role--examples) . For more information about the elements that you can use in an IAM policy, see [IAM Policy Elements Reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html) in the *IAM User Guide* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-assumerolepolicydocument // AssumeRolePolicyDocument interface{} `field:"required" json:"assumeRolePolicyDocument" yaml:"assumeRolePolicyDocument"` // A description of the role that you provide. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-description // Description *string `field:"optional" json:"description" yaml:"description"` // A list of Amazon Resource Names (ARNs) of the IAM managed policies that you want to attach to the role. // // For more information about ARNs, see [Amazon Resource Names (ARNs) and AWS Service Namespaces](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) in the *AWS General Reference* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-managedpolicyarns // ManagedPolicyArns *[]*string `field:"optional" json:"managedPolicyArns" yaml:"managedPolicyArns"` // The maximum session duration (in seconds) that you want to set for the specified role. // // If you do not specify a value for this setting, the default value of one hour is applied. This setting can have a value from 1 hour to 12 hours. // // Anyone who assumes the role from the AWS CLI or API can use the `DurationSeconds` API parameter or the `duration-seconds` AWS CLI parameter to request a longer session. The `MaxSessionDuration` setting determines the maximum duration that can be requested using the `DurationSeconds` parameter. If users don't specify a value for the `DurationSeconds` parameter, their security credentials are valid for one hour by default. This applies when you use the `AssumeRole*` API operations or the `assume-role*` AWS CLI operations but does not apply when you use those operations to create a console URL. For more information, see [Using IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html) in the *IAM User Guide* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-maxsessionduration // MaxSessionDuration *float64 `field:"optional" json:"maxSessionDuration" yaml:"maxSessionDuration"` // The path to the role. For more information about paths, see [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the *IAM User Guide* . // // This parameter is optional. If it is not included, it defaults to a slash (/). // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( `\u0021` ) through the DEL character ( `\u007F` ), including most punctuation characters, digits, and upper and lowercased letters. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-path // // Default: - "/". // Path *string `field:"optional" json:"path" yaml:"path"` // The ARN of the policy used to set the permissions boundary for the role. // // For more information about permissions boundaries, see [Permissions boundaries for IAM identities](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the *IAM User Guide* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-permissionsboundary // PermissionsBoundary *string `field:"optional" json:"permissionsBoundary" yaml:"permissionsBoundary"` // Adds or updates an inline policy document that is embedded in the specified IAM role. // // When you embed an inline policy in a role, the inline policy is used as part of the role's access (permissions) policy. The role's trust policy is created at the same time as the role. You can update a role's trust policy later. For more information about IAM roles, go to [Using Roles to Delegate Permissions and Federate Identities](https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-toplevel.html) . // // A role can also have an attached managed policy. For information about policies, see [Managed Policies and Inline Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide* . // // For information about limits on the number of inline policies that you can embed with a role, see [Limitations on IAM Entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/LimitationsOnEntities.html) in the *IAM User Guide* . // // > If an external policy (such as `AWS::IAM::Policy` or `AWS::IAM::ManagedPolicy` ) has a `Ref` to a role and if a resource (such as `AWS::ECS::Service` ) also has a `Ref` to the same role, add a `DependsOn` attribute to the resource to make the resource depend on the external policy. This dependency ensures that the role's policy is available throughout the resource's lifecycle. For example, when you delete a stack with an `AWS::ECS::Service` resource, the `DependsOn` attribute ensures that AWS CloudFormation deletes the `AWS::ECS::Service` resource before deleting its role's policy. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-policies // Policies interface{} `field:"optional" json:"policies" yaml:"policies"` // A name for the IAM role, up to 64 characters in length. // // For valid values, see the `RoleName` parameter for the [`CreateRole`](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html) action in the *IAM User Guide* . // // This parameter allows (per its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-. The role name must be unique within the account. Role names are not distinguished by case. For example, you cannot create roles named both "Role1" and "role1". // // If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the role name. // // If you specify a name, you must specify the `CAPABILITY_NAMED_IAM` value to acknowledge your template's capabilities. For more information, see [Acknowledging IAM Resources in AWS CloudFormation Templates](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-capabilities) . // // > Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using `Fn::Join` and `AWS::Region` to create a Region-specific name, as in the following example: `{"Fn::Join": ["", [{"Ref": "AWS::Region"}, {"Ref": "MyResourceName"}]]}` . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-rolename // RoleName *string `field:"optional" json:"roleName" yaml:"roleName"` // A list of tags that are attached to the role. // // For more information about tagging, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *IAM User Guide* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-tags // Tags *[]*awscdk.CfnTag `field:"optional" json:"tags" yaml:"tags"` }
Properties for defining a `CfnRole`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var assumeRolePolicyDocument interface{} var policyDocument interface{} cfnRoleProps := &CfnRoleProps{ AssumeRolePolicyDocument: assumeRolePolicyDocument, // the properties below are optional Description: jsii.String("description"), ManagedPolicyArns: []*string{ jsii.String("managedPolicyArns"), }, MaxSessionDuration: jsii.Number(123), Path: jsii.String("path"), PermissionsBoundary: jsii.String("permissionsBoundary"), Policies: []interface{}{ &PolicyProperty{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), }, }, RoleName: jsii.String("roleName"), Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html
type CfnRole_PolicyProperty ¶
type CfnRole_PolicyProperty struct { // The entire contents of the policy that defines permissions. // // For more information, see [Overview of JSON policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json) . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-role-policy.html#cfn-iam-role-policy-policydocument // PolicyDocument interface{} `field:"required" json:"policyDocument" yaml:"policyDocument"` // The friendly name (not ARN) identifying the policy. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-role-policy.html#cfn-iam-role-policy-policyname // PolicyName *string `field:"required" json:"policyName" yaml:"policyName"` }
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role.
For more information about managed policies, refer to [Managed Policies and Inline Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} policyProperty := &PolicyProperty{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-role-policy.html
type CfnSAMLProvider ¶
type CfnSAMLProvider interface { awscdk.CfnResource awscdk.IInspectable awscdk.ITaggable // Returns the Amazon Resource Name (ARN) for the specified `AWS::IAM::SAMLProvider` resource. AttrArn() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The name of the provider to create. Name() *string SetName(val *string) // The tree node. Node() constructs.Node // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your organization's IdP. SamlMetadataDocument() *string SetSamlMetadataDocument(val *string) // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Tag Manager which manages the tags for this resource. Tags() awscdk.TagManager // A list of tags that you want to attach to the new IAM SAML provider. TagsRaw() *[]*awscdk.CfnTag SetTagsRaw(val *[]*awscdk.CfnTag) // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Creates an IAM resource that describes an identity provider (IdP) that supports SAML 2.0.
The SAML provider resource that you create with this operation can be used as a principal in an IAM role's trust policy. Such a policy can enable federated users who sign in using the SAML IdP to assume the role. You can create an IAM role that supports Web-based single sign-on (SSO) to the AWS Management Console or one that supports API access to AWS .
When you create the SAML provider resource, you upload a SAML metadata document that you get from your IdP. That document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that the IdP sends. You must generate the metadata document using the identity management software that is used as your organization's IdP.
> This operation requires [Signature Version 4](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html) .
For more information, see [Enabling SAML 2.0 federated users to access the AWS Management Console](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html) and [About SAML 2.0-based federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnSAMLProvider := awscdk.Aws_iam.NewCfnSAMLProvider(this, jsii.String("MyCfnSAMLProvider"), &CfnSAMLProviderProps{ SamlMetadataDocument: jsii.String("samlMetadataDocument"), // the properties below are optional Name: jsii.String("name"), Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-samlprovider.html
func NewCfnSAMLProvider ¶
func NewCfnSAMLProvider(scope constructs.Construct, id *string, props *CfnSAMLProviderProps) CfnSAMLProvider
type CfnSAMLProviderProps ¶
type CfnSAMLProviderProps struct { // An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your organization's IdP. // // For more information, see [About SAML 2.0-based federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html) in the *IAM User Guide* // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-samlprovider.html#cfn-iam-samlprovider-samlmetadatadocument // SamlMetadataDocument *string `field:"required" json:"samlMetadataDocument" yaml:"samlMetadataDocument"` // The name of the provider to create. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-samlprovider.html#cfn-iam-samlprovider-name // Name *string `field:"optional" json:"name" yaml:"name"` // A list of tags that you want to attach to the new IAM SAML provider. // // Each tag consists of a key name and an associated value. For more information about tagging, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *IAM User Guide* . // // > If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-samlprovider.html#cfn-iam-samlprovider-tags // Tags *[]*awscdk.CfnTag `field:"optional" json:"tags" yaml:"tags"` }
Properties for defining a `CfnSAMLProvider`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnSAMLProviderProps := &CfnSAMLProviderProps{ SamlMetadataDocument: jsii.String("samlMetadataDocument"), // the properties below are optional Name: jsii.String("name"), Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-samlprovider.html
type CfnServerCertificate ¶
type CfnServerCertificate interface { awscdk.CfnResource awscdk.IInspectable awscdk.ITaggable // Returns the Amazon Resource Name (ARN) for the specified `AWS::IAM::ServerCertificate` resource. AttrArn() *string // The contents of the public key certificate. CertificateBody() *string SetCertificateBody(val *string) // The contents of the public key certificate chain. CertificateChain() *string SetCertificateChain(val *string) // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // The path for the server certificate. Path() *string SetPath(val *string) // The contents of the private key in PEM-encoded format. PrivateKey() *string SetPrivateKey(val *string) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The name for the server certificate. ServerCertificateName() *string SetServerCertificateName(val *string) // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Tag Manager which manages the tags for this resource. Tags() awscdk.TagManager // A list of tags that are attached to the server certificate. TagsRaw() *[]*awscdk.CfnTag SetTagsRaw(val *[]*awscdk.CfnTag) // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Uploads a server certificate entity for the AWS account .
The server certificate entity includes a public key certificate, a private key, and an optional certificate chain, which should all be PEM-encoded.
We recommend that you use [AWS Certificate Manager](https://docs.aws.amazon.com/acm/) to provision, manage, and deploy your server certificates. With ACM you can request a certificate, deploy it to AWS resources, and let ACM handle certificate renewals for you. Certificates provided by ACM are free. For more information about using ACM, see the [AWS Certificate Manager User Guide](https://docs.aws.amazon.com/acm/latest/userguide/) .
For more information about working with server certificates, see [Working with server certificates](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html) in the *IAM User Guide* . This topic includes a list of AWS services that can use the server certificates that you manage with IAM.
For information about the number of server certificates you can upload, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *IAM User Guide* .
> Because the body of the public key certificate, private key, and the certificate chain can be large, you should use POST rather than GET when calling `UploadServerCertificate` . For information about setting up signatures and authorization through the API, see [Signing AWS API requests](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) in the *AWS General Reference* . For general information about using the Query API with IAM, see [Calling the API by making HTTP query requests](https://docs.aws.amazon.com/IAM/latest/UserGuide/programming.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnServerCertificate := awscdk.Aws_iam.NewCfnServerCertificate(this, jsii.String("MyCfnServerCertificate"), &CfnServerCertificateProps{ CertificateBody: jsii.String("certificateBody"), CertificateChain: jsii.String("certificateChain"), Path: jsii.String("path"), PrivateKey: jsii.String("privateKey"), ServerCertificateName: jsii.String("serverCertificateName"), Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, })
func NewCfnServerCertificate ¶
func NewCfnServerCertificate(scope constructs.Construct, id *string, props *CfnServerCertificateProps) CfnServerCertificate
type CfnServerCertificateProps ¶
type CfnServerCertificateProps struct { // The contents of the public key certificate. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servercertificate.html#cfn-iam-servercertificate-certificatebody // CertificateBody *string `field:"optional" json:"certificateBody" yaml:"certificateBody"` // The contents of the public key certificate chain. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servercertificate.html#cfn-iam-servercertificate-certificatechain // CertificateChain *string `field:"optional" json:"certificateChain" yaml:"certificateChain"` // The path for the server certificate. // // For more information about paths, see [IAM identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the *IAM User Guide* . // // This parameter is optional. If it is not included, it defaults to a slash (/). This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( `\u0021` ) through the DEL character ( `\u007F` ), including most punctuation characters, digits, and upper and lowercased letters. // // > If you are uploading a server certificate specifically for use with Amazon CloudFront distributions, you must specify a path using the `path` parameter. The path must begin with `/cloudfront` and must include a trailing slash (for example, `/cloudfront/test/` ). // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servercertificate.html#cfn-iam-servercertificate-path // Path *string `field:"optional" json:"path" yaml:"path"` // The contents of the private key in PEM-encoded format. // // The [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) used to validate this parameter is a string of characters consisting of the following: // // - Any printable ASCII character ranging from the space character ( `\u0020` ) through the end of the ASCII character range // - The printable characters in the Basic Latin and Latin-1 Supplement character set (through `\u00FF` ) // - The special characters tab ( `\u0009` ), line feed ( `\u000A` ), and carriage return ( `\u000D` ). // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servercertificate.html#cfn-iam-servercertificate-privatekey // PrivateKey *string `field:"optional" json:"privateKey" yaml:"privateKey"` // The name for the server certificate. // // Do not include the path in this value. The name of the certificate cannot contain any spaces. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servercertificate.html#cfn-iam-servercertificate-servercertificatename // ServerCertificateName *string `field:"optional" json:"serverCertificateName" yaml:"serverCertificateName"` // A list of tags that are attached to the server certificate. // // For more information about tagging, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *IAM User Guide* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servercertificate.html#cfn-iam-servercertificate-tags // Tags *[]*awscdk.CfnTag `field:"optional" json:"tags" yaml:"tags"` }
Properties for defining a `CfnServerCertificate`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnServerCertificateProps := &CfnServerCertificateProps{ CertificateBody: jsii.String("certificateBody"), CertificateChain: jsii.String("certificateChain"), Path: jsii.String("path"), PrivateKey: jsii.String("privateKey"), ServerCertificateName: jsii.String("serverCertificateName"), Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, }
type CfnServiceLinkedRole ¶
type CfnServiceLinkedRole interface { awscdk.CfnResource awscdk.IInspectable // Returns the friendly name that identifies the role. // // For example, `AWSServiceRoleForAutoScaling` or `AWSServiceRoleForAutoScaling_TestSuffix` if a `CustomSuffix` is specified. AttrRoleName() *string // The service principal for the AWS service to which this role is attached. AwsServiceName() *string SetAwsServiceName(val *string) // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // A string that you provide, which is combined with the service-provided prefix to form the complete role name. CustomSuffix() *string SetCustomSuffix(val *string) // The description of the role. Description() *string SetDescription(val *string) // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Creates an IAM role that is linked to a specific AWS service.
The service controls the attached policies and when the role can be deleted. This helps ensure that the service is not broken by an unexpectedly changed or deleted role, which could put your AWS resources into an unknown state. Allowing the service to control the role helps improve service stability and proper cleanup when a service and its role are no longer needed. For more information, see [Using service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html) in the *IAM User Guide* .
To attach a policy to this service-linked role, you must make the request using the AWS service that depends on this role.
Example:
slr := iam.NewCfnServiceLinkedRole(this, jsii.String("ElasticSLR"), &CfnServiceLinkedRoleProps{ AwsServiceName: jsii.String("es.amazonaws.com"), })
func NewCfnServiceLinkedRole ¶
func NewCfnServiceLinkedRole(scope constructs.Construct, id *string, props *CfnServiceLinkedRoleProps) CfnServiceLinkedRole
type CfnServiceLinkedRoleProps ¶
type CfnServiceLinkedRoleProps struct { // The service principal for the AWS service to which this role is attached. // // You use a string similar to a URL but without the http:// in front. For example: `elasticbeanstalk.amazonaws.com` . // // Service principals are unique and case-sensitive. To find the exact service principal for your service-linked role, see [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) in the *IAM User Guide* . Look for the services that have *Yes* in the *Service-Linked Role* column. Choose the *Yes* link to view the service-linked role documentation for that service. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servicelinkedrole.html#cfn-iam-servicelinkedrole-awsservicename // AwsServiceName *string `field:"optional" json:"awsServiceName" yaml:"awsServiceName"` // A string that you provide, which is combined with the service-provided prefix to form the complete role name. // // If you make multiple requests for the same service, then you must supply a different `CustomSuffix` for each request. Otherwise the request fails with a duplicate role name error. For example, you could add `-1` or `-debug` to the suffix. // // Some services do not support the `CustomSuffix` parameter. If you provide an optional suffix and the operation fails, try the operation again without the suffix. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servicelinkedrole.html#cfn-iam-servicelinkedrole-customsuffix // CustomSuffix *string `field:"optional" json:"customSuffix" yaml:"customSuffix"` // The description of the role. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servicelinkedrole.html#cfn-iam-servicelinkedrole-description // Description *string `field:"optional" json:"description" yaml:"description"` }
Properties for defining a `CfnServiceLinkedRole`.
Example:
slr := iam.NewCfnServiceLinkedRole(this, jsii.String("ElasticSLR"), &CfnServiceLinkedRoleProps{ AwsServiceName: jsii.String("es.amazonaws.com"), })
type CfnUser ¶
type CfnUser interface { awscdk.CfnResource awscdk.IInspectable awscdk.ITaggable // Returns the Amazon Resource Name (ARN) for the specified `AWS::IAM::User` resource. // // For example: `arn:aws:iam::123456789012:user/mystack-myuser-1CCXAFG2H2U4D` . AttrArn() *string AttrId() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // A list of group names to which you want to add the user. Groups() *[]*string SetGroups(val *[]*string) // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // Creates a password for the specified IAM user. LoginProfile() interface{} SetLoginProfile(val interface{}) // A list of Amazon Resource Names (ARNs) of the IAM managed policies that you want to attach to the user. ManagedPolicyArns() *[]*string SetManagedPolicyArns(val *[]*string) // The tree node. Node() constructs.Node // The path for the user name. Path() *string SetPath(val *string) // The ARN of the managed policy that is used to set the permissions boundary for the user. PermissionsBoundary() *string SetPermissionsBoundary(val *string) // Adds or updates an inline policy document that is embedded in the specified IAM user. Policies() interface{} SetPolicies(val interface{}) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Tag Manager which manages the tags for this resource. Tags() awscdk.TagManager // A list of tags that you want to attach to the new user. TagsRaw() *[]*awscdk.CfnTag SetTagsRaw(val *[]*awscdk.CfnTag) // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // The name of the user to create. // // Do not include the path in this value. UserName() *string SetUserName(val *string) // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Creates a new IAM user for your AWS account .
For information about quotas for the number of IAM users you can create, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnUser := awscdk.Aws_iam.NewCfnUser(this, jsii.String("MyCfnUser"), &CfnUserProps{ Groups: []*string{ jsii.String("groups"), }, LoginProfile: &LoginProfileProperty{ Password: jsii.String("password"), // the properties below are optional PasswordResetRequired: jsii.Boolean(false), }, ManagedPolicyArns: []*string{ jsii.String("managedPolicyArns"), }, Path: jsii.String("path"), PermissionsBoundary: jsii.String("permissionsBoundary"), Policies: []interface{}{ &PolicyProperty{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), }, }, Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, UserName: jsii.String("userName"), })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html
func NewCfnUser ¶
func NewCfnUser(scope constructs.Construct, id *string, props *CfnUserProps) CfnUser
type CfnUserPolicy ¶ added in v2.89.0
type CfnUserPolicy interface { awscdk.CfnResource awscdk.IInspectable // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // The policy document. PolicyDocument() interface{} SetPolicyDocument(val interface{}) // The name of the policy document. PolicyName() *string SetPolicyName(val *string) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // The name of the user to associate the policy with. UserName() *string SetUserName(val *string) // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Adds or updates an inline policy document that is embedded in the specified IAM user.
An IAM user can also have a managed policy attached to it. To attach a managed policy to a user, use [`AWS::IAM::User`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user.html) . To create a new managed policy, use [`AWS::IAM::ManagedPolicy`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html) . For information about policies, see [Managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide* .
For information about the maximum number of inline policies that you can embed in a user, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnUserPolicy := awscdk.Aws_iam.NewCfnUserPolicy(this, jsii.String("MyCfnUserPolicy"), &CfnUserPolicyProps{ PolicyName: jsii.String("policyName"), UserName: jsii.String("userName"), // the properties below are optional PolicyDocument: policyDocument, })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-userpolicy.html
func NewCfnUserPolicy ¶ added in v2.89.0
func NewCfnUserPolicy(scope constructs.Construct, id *string, props *CfnUserPolicyProps) CfnUserPolicy
type CfnUserPolicyProps ¶ added in v2.89.0
type CfnUserPolicyProps struct { // The name of the policy document. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-userpolicy.html#cfn-iam-userpolicy-policyname // PolicyName *string `field:"required" json:"policyName" yaml:"policyName"` // The name of the user to associate the policy with. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-userpolicy.html#cfn-iam-userpolicy-username // UserName *string `field:"required" json:"userName" yaml:"userName"` // The policy document. // // You must provide policies in JSON format in IAM. However, for AWS CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. AWS CloudFormation always converts a YAML policy to JSON format before submitting it to IAM. // // The [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) used to validate this parameter is a string of characters consisting of the following: // // - Any printable ASCII character ranging from the space character ( `\u0020` ) through the end of the ASCII character range // - The printable characters in the Basic Latin and Latin-1 Supplement character set (through `\u00FF` ) // - The special characters tab ( `\u0009` ), line feed ( `\u000A` ), and carriage return ( `\u000D` ). // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-userpolicy.html#cfn-iam-userpolicy-policydocument // PolicyDocument interface{} `field:"optional" json:"policyDocument" yaml:"policyDocument"` }
Properties for defining a `CfnUserPolicy`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnUserPolicyProps := &CfnUserPolicyProps{ PolicyName: jsii.String("policyName"), UserName: jsii.String("userName"), // the properties below are optional PolicyDocument: policyDocument, }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-userpolicy.html
type CfnUserProps ¶
type CfnUserProps struct { // A list of group names to which you want to add the user. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html#cfn-iam-user-groups // Groups *[]*string `field:"optional" json:"groups" yaml:"groups"` // Creates a password for the specified IAM user. // // A password allows an IAM user to access AWS services through the AWS Management Console . // // You can use the AWS CLI , the AWS API, or the *Users* page in the IAM console to create a password for any IAM user. Use [ChangePassword](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ChangePassword.html) to update your own existing password in the *My Security Credentials* page in the AWS Management Console . // // For more information about managing passwords, see [Managing passwords](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_ManagingLogins.html) in the *IAM User Guide* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html#cfn-iam-user-loginprofile // LoginProfile interface{} `field:"optional" json:"loginProfile" yaml:"loginProfile"` // A list of Amazon Resource Names (ARNs) of the IAM managed policies that you want to attach to the user. // // For more information about ARNs, see [Amazon Resource Names (ARNs) and AWS Service Namespaces](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) in the *AWS General Reference* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html#cfn-iam-user-managedpolicyarns // ManagedPolicyArns *[]*string `field:"optional" json:"managedPolicyArns" yaml:"managedPolicyArns"` // The path for the user name. // // For more information about paths, see [IAM identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the *IAM User Guide* . // // This parameter is optional. If it is not included, it defaults to a slash (/). // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( `\u0021` ) through the DEL character ( `\u007F` ), including most punctuation characters, digits, and upper and lowercased letters. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html#cfn-iam-user-path // Path *string `field:"optional" json:"path" yaml:"path"` // The ARN of the managed policy that is used to set the permissions boundary for the user. // // A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions. Permissions boundaries do not define the maximum permissions that a resource-based policy can grant to an entity. To learn more, see [Permissions boundaries for IAM entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the *IAM User Guide* . // // For more information about policy types, see [Policy types](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types) in the *IAM User Guide* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html#cfn-iam-user-permissionsboundary // PermissionsBoundary *string `field:"optional" json:"permissionsBoundary" yaml:"permissionsBoundary"` // Adds or updates an inline policy document that is embedded in the specified IAM user. // // To view AWS::IAM::User snippets, see [Declaring an IAM User Resource](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-iam.html#scenario-iam-user) . // // > The name of each policy for a role, user, or group must be unique. If you don't choose unique names, updates to the IAM identity will fail. // // For information about limits on the number of inline policies that you can embed in a user, see [Limitations on IAM Entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/LimitationsOnEntities.html) in the *IAM User Guide* . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html#cfn-iam-user-policies // Policies interface{} `field:"optional" json:"policies" yaml:"policies"` // A list of tags that you want to attach to the new user. // // Each tag consists of a key name and an associated value. For more information about tagging, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *IAM User Guide* . // // > If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html#cfn-iam-user-tags // Tags *[]*awscdk.CfnTag `field:"optional" json:"tags" yaml:"tags"` // The name of the user to create. Do not include the path in this value. // // This parameter allows (per its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-. The user name must be unique within the account. User names are not distinguished by case. For example, you cannot create users named both "John" and "john". // // If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the user name. // // If you specify a name, you must specify the `CAPABILITY_NAMED_IAM` value to acknowledge your template's capabilities. For more information, see [Acknowledging IAM Resources in AWS CloudFormation Templates](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-capabilities) . // // > Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using `Fn::Join` and `AWS::Region` to create a Region-specific name, as in the following example: `{"Fn::Join": ["", [{"Ref": "AWS::Region"}, {"Ref": "MyResourceName"}]]}` . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html#cfn-iam-user-username // UserName *string `field:"optional" json:"userName" yaml:"userName"` }
Properties for defining a `CfnUser`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} cfnUserProps := &CfnUserProps{ Groups: []*string{ jsii.String("groups"), }, LoginProfile: &LoginProfileProperty{ Password: jsii.String("password"), // the properties below are optional PasswordResetRequired: jsii.Boolean(false), }, ManagedPolicyArns: []*string{ jsii.String("managedPolicyArns"), }, Path: jsii.String("path"), PermissionsBoundary: jsii.String("permissionsBoundary"), Policies: []interface{}{ &PolicyProperty{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), }, }, Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, UserName: jsii.String("userName"), }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html
type CfnUserToGroupAddition ¶
type CfnUserToGroupAddition interface { awscdk.CfnResource awscdk.IInspectable AttrId() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The name of the group to update. GroupName() *string SetGroupName(val *string) // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // A list of the names of the users that you want to add to the group. Users() *[]*string SetUsers(val *[]*string) // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Adds the specified user to the specified group.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnUserToGroupAddition := awscdk.Aws_iam.NewCfnUserToGroupAddition(this, jsii.String("MyCfnUserToGroupAddition"), &CfnUserToGroupAdditionProps{ GroupName: jsii.String("groupName"), Users: []*string{ jsii.String("users"), }, })
func NewCfnUserToGroupAddition ¶
func NewCfnUserToGroupAddition(scope constructs.Construct, id *string, props *CfnUserToGroupAdditionProps) CfnUserToGroupAddition
type CfnUserToGroupAdditionProps ¶
type CfnUserToGroupAdditionProps struct { // The name of the group to update. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-usertogroupaddition.html#cfn-iam-usertogroupaddition-groupname // GroupName *string `field:"required" json:"groupName" yaml:"groupName"` // A list of the names of the users that you want to add to the group. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-usertogroupaddition.html#cfn-iam-usertogroupaddition-users // Users *[]*string `field:"required" json:"users" yaml:"users"` }
Properties for defining a `CfnUserToGroupAddition`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnUserToGroupAdditionProps := &CfnUserToGroupAdditionProps{ GroupName: jsii.String("groupName"), Users: []*string{ jsii.String("users"), }, }
type CfnUser_LoginProfileProperty ¶
type CfnUser_LoginProfileProperty struct { // The user's password. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user-loginprofile.html#cfn-iam-user-loginprofile-password // Password *string `field:"required" json:"password" yaml:"password"` // Specifies whether the user is required to set a new password on next sign-in. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user-loginprofile.html#cfn-iam-user-loginprofile-passwordresetrequired // PasswordResetRequired interface{} `field:"optional" json:"passwordResetRequired" yaml:"passwordResetRequired"` }
Creates a password for the specified user, giving the user the ability to access AWS services through the AWS Management Console .
For more information about managing passwords, see [Managing Passwords](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_ManagingLogins.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" loginProfileProperty := &LoginProfileProperty{ Password: jsii.String("password"), // the properties below are optional PasswordResetRequired: jsii.Boolean(false), }
type CfnUser_PolicyProperty ¶
type CfnUser_PolicyProperty struct { // The entire contents of the policy that defines permissions. // // For more information, see [Overview of JSON policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json) . // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user-policy.html#cfn-iam-user-policy-policydocument // PolicyDocument interface{} `field:"required" json:"policyDocument" yaml:"policyDocument"` // The friendly name (not ARN) identifying the policy. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user-policy.html#cfn-iam-user-policy-policyname // PolicyName *string `field:"required" json:"policyName" yaml:"policyName"` }
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role.
For more information about managed policies, refer to [Managed Policies and Inline Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide* .
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var policyDocument interface{} policyProperty := &PolicyProperty{ PolicyDocument: policyDocument, PolicyName: jsii.String("policyName"), }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user-policy.html
type CfnVirtualMFADevice ¶
type CfnVirtualMFADevice interface { awscdk.CfnResource awscdk.IInspectable awscdk.ITaggable // Returns the serial number for the specified `AWS::IAM::VirtualMFADevice` resource. AttrSerialNumber() *string // Options for this resource, such as condition, update policy etc. CfnOptions() awscdk.ICfnResourceOptions CfnProperties() *map[string]interface{} // AWS resource type. CfnResourceType() *string // Returns: the stack trace of the point where this Resource was created from, sourced // from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most // node +internal+ entries filtered. CreationStack() *[]*string // The logical ID for this CloudFormation stack element. // // The logical ID of the element // is calculated from the path of the resource node in the construct tree. // // To override this value, use `overrideLogicalId(newLogicalId)`. // // Returns: the logical ID as a stringified token. This value will only get // resolved during synthesis. LogicalId() *string // The tree node. Node() constructs.Node // The path for the virtual MFA device. Path() *string SetPath(val *string) // Return a string that will be resolved to a CloudFormation `{ Ref }` for this element. // // If, by any chance, the intrinsic reference of a resource is not a string, you could // coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`. Ref() *string // The stack in which this element is defined. // // CfnElements must be defined within a stack scope (directly or indirectly). Stack() awscdk.Stack // Tag Manager which manages the tags for this resource. Tags() awscdk.TagManager // A list of tags that you want to attach to the new IAM virtual MFA device. TagsRaw() *[]*awscdk.CfnTag SetTagsRaw(val *[]*awscdk.CfnTag) // Deprecated. // Deprecated: use `updatedProperties` // // Return properties modified after initiation // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperites() *map[string]interface{} // Return properties modified after initiation. // // Resources that expose mutable properties should override this function to // collect and return the properties object for this resource. UpdatedProperties() *map[string]interface{} // The IAM user associated with this virtual MFA device. Users() *[]*string SetUsers(val *[]*string) // The name of the virtual MFA device, which must be unique. VirtualMfaDeviceName() *string SetVirtualMfaDeviceName(val *string) // Syntactic sugar for `addOverride(path, undefined)`. AddDeletionOverride(path *string) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // // This can be used for resources across stacks (or nested stack) boundaries // and the dependency will automatically be transferred to the relevant scope. AddDependency(target awscdk.CfnResource) // Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned. // Deprecated: use addDependency. AddDependsOn(target awscdk.CfnResource) // Add a value to the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // AddMetadata(key *string, value interface{}) // Adds an override to the synthesized CloudFormation resource. // // To add a // property override, either use `addPropertyOverride` or prefix `path` with // "Properties." (i.e. `Properties.TopicName`). // // If the override is nested, separate each nested level using a dot (.) in the path parameter. // If there is an array as part of the nesting, specify the index in the path. // // To include a literal `.` in the property name, prefix with a `\`. In most // programming languages you will need to write this as `"\\."` because the // `\` itself will need to be escaped. // // For example, // “`typescript // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']); // cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE'); // “` // would add the overrides // “`json // "Properties": { // "GlobalSecondaryIndexes": [ // { // "Projection": { // "NonKeyAttributes": [ "myattribute" ] // ... // } // ... // }, // { // "ProjectionType": "INCLUDE" // ... // }, // ] // ... // } // “` // // The `value` argument to `addOverride` will not be processed or translated // in any way. Pass raw JSON values in here with the correct capitalization // for CloudFormation. If you pass CDK classes or structs, they will be // rendered with lowercased key names, and CloudFormation will reject the // template. AddOverride(path *string, value interface{}) // Adds an override that deletes the value of a property from the resource definition. AddPropertyDeletionOverride(propertyPath *string) // Adds an override to a resource property. // // Syntactic sugar for `addOverride("Properties.<...>", value)`. AddPropertyOverride(propertyPath *string, value interface{}) // Sets the deletion policy of the resource based on the removal policy specified. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some // cases, a snapshot can be taken of the resource prior to deletion // (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy // can be found in the following link:. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options // ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions) // Returns a token for an runtime attribute of this resource. // // Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility // in case there is no generated attribute. GetAtt(attributeName *string, typeHint awscdk.ResolutionTypeHint) awscdk.Reference // Retrieve a value value from the CloudFormation Resource Metadata. // See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html // // Note that this is a different set of metadata from CDK node metadata; this // metadata ends up in the stack template under the resource, whereas CDK // node metadata ends up in the Cloud Assembly. // GetMetadata(key *string) interface{} // Examines the CloudFormation resource and discloses attributes. Inspect(inspector awscdk.TreeInspector) // Retrieves an array of resources this resource depends on. // // This assembles dependencies on resources across stacks (including nested stacks) // automatically. ObtainDependencies() *[]interface{} // Get a shallow copy of dependencies between this resource and other resources in the same stack. ObtainResourceDependencies() *[]awscdk.CfnResource // Overrides the auto-generated logical ID with a specific ID. OverrideLogicalId(newLogicalId *string) // Indicates that this resource no longer depends on another resource. // // This can be used for resources across stacks (including nested stacks) // and the dependency will automatically be removed from the relevant scope. RemoveDependency(target awscdk.CfnResource) RenderProperties(props *map[string]interface{}) *map[string]interface{} // Replaces one dependency with another. ReplaceDependency(target awscdk.CfnResource, newTarget awscdk.CfnResource) // Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template. // // Returns: `true` if the resource should be included or `false` is the resource // should be omitted. ShouldSynthesize() *bool // Returns a string representation of this construct. // // Returns: a string representation of this resource. ToString() *string ValidateProperties(_properties interface{}) }
Creates a new virtual MFA device for the AWS account .
After creating the virtual MFA, use [EnableMFADevice](https://docs.aws.amazon.com/IAM/latest/APIReference/API_EnableMFADevice.html) to attach the MFA device to an IAM user. For more information about creating and working with virtual MFA devices, see [Using a virtual MFA device](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_VirtualMFA.html) in the *IAM User Guide* .
For information about the maximum number of MFA devices you can create, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *IAM User Guide* .
> The seed information contained in the QR code and the Base32 string should be treated like any other secret access information. In other words, protect the seed information as you would your AWS access keys or your passwords. After you provision your virtual device, you should ensure that the information is destroyed following secure procedures.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnVirtualMFADevice := awscdk.Aws_iam.NewCfnVirtualMFADevice(this, jsii.String("MyCfnVirtualMFADevice"), &CfnVirtualMFADeviceProps{ Users: []*string{ jsii.String("users"), }, // the properties below are optional Path: jsii.String("path"), Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, VirtualMfaDeviceName: jsii.String("virtualMfaDeviceName"), })
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-virtualmfadevice.html
func NewCfnVirtualMFADevice ¶
func NewCfnVirtualMFADevice(scope constructs.Construct, id *string, props *CfnVirtualMFADeviceProps) CfnVirtualMFADevice
type CfnVirtualMFADeviceProps ¶
type CfnVirtualMFADeviceProps struct { // The IAM user associated with this virtual MFA device. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-virtualmfadevice.html#cfn-iam-virtualmfadevice-users // Users *[]*string `field:"required" json:"users" yaml:"users"` // The path for the virtual MFA device. // // For more information about paths, see [IAM identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the *IAM User Guide* . // // This parameter is optional. If it is not included, it defaults to a slash (/). // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( `\u0021` ) through the DEL character ( `\u007F` ), including most punctuation characters, digits, and upper and lowercased letters. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-virtualmfadevice.html#cfn-iam-virtualmfadevice-path // Path *string `field:"optional" json:"path" yaml:"path"` // A list of tags that you want to attach to the new IAM virtual MFA device. // // Each tag consists of a key name and an associated value. For more information about tagging, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *IAM User Guide* . // // > If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created. // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-virtualmfadevice.html#cfn-iam-virtualmfadevice-tags // Tags *[]*awscdk.CfnTag `field:"optional" json:"tags" yaml:"tags"` // The name of the virtual MFA device, which must be unique. // // Use with path to uniquely identify a virtual MFA device. // // This parameter allows (through its [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- // See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-virtualmfadevice.html#cfn-iam-virtualmfadevice-virtualmfadevicename // VirtualMfaDeviceName *string `field:"optional" json:"virtualMfaDeviceName" yaml:"virtualMfaDeviceName"` }
Properties for defining a `CfnVirtualMFADevice`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" cfnVirtualMFADeviceProps := &CfnVirtualMFADeviceProps{ Users: []*string{ jsii.String("users"), }, // the properties below are optional Path: jsii.String("path"), Tags: []cfnTag{ &cfnTag{ Key: jsii.String("key"), Value: jsii.String("value"), }, }, VirtualMfaDeviceName: jsii.String("virtualMfaDeviceName"), }
See: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-virtualmfadevice.html
type CommonGrantOptions ¶
type CommonGrantOptions struct { // The actions to grant. Actions *[]*string `field:"required" json:"actions" yaml:"actions"` // The principal to grant to. // Default: if principal is undefined, no work is done. // Grantee IGrantable `field:"required" json:"grantee" yaml:"grantee"` // The resource ARNs to grant to. ResourceArns *[]*string `field:"required" json:"resourceArns" yaml:"resourceArns"` // Any conditions to attach to the grant. // Default: - No conditions. // Conditions *map[string]*map[string]interface{} `field:"optional" json:"conditions" yaml:"conditions"` }
Basic options for a grant operation.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var conditions interface{} var grantable iGrantable commonGrantOptions := &CommonGrantOptions{ Actions: []*string{ jsii.String("actions"), }, Grantee: grantable, ResourceArns: []*string{ jsii.String("resourceArns"), }, // the properties below are optional Conditions: map[string]map[string]interface{}{ "conditionsKey": map[string]interface{}{ "conditionsKey": conditions, }, }, }
type ComparablePrincipal ¶ added in v2.26.0
type ComparablePrincipal interface { }
Helper class for working with `IComparablePrincipal`s.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" comparablePrincipal := awscdk.Aws_iam.NewComparablePrincipal()
func NewComparablePrincipal ¶ added in v2.26.0
func NewComparablePrincipal() ComparablePrincipal
type CompositeDependable ¶
type CompositeDependable interface { constructs.IDependable }
Composite dependable.
Not as simple as eagerly getting the dependency roots from the inner dependables, as they may be mutable so we need to defer the query.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" import constructs "github.com/aws/constructs-go/constructs" var dependable iDependable compositeDependable := awscdk.Aws_iam.NewCompositeDependable(dependable)
func NewCompositeDependable ¶
func NewCompositeDependable(dependables ...constructs.IDependable) CompositeDependable
type CompositePrincipal ¶
type CompositePrincipal interface { PrincipalBase // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Returns the principals that make up the CompositePrincipal. Principals() *[]IPrincipal // Adds IAM principals to the composite principal. // // Composite principals cannot have // conditions. AddPrincipals(principals ...IPrincipal) CompositePrincipal // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(doc PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
Represents a principal that has multiple types of principals.
A composite principal cannot have conditions. i.e. multiple ServicePrincipals that form a composite principal
Example:
var build build role := iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewCompositePrincipal(iam.NewServicePrincipal(jsii.String("gamelift.amazonaws.com"))), }) role.AddManagedPolicy(iam.ManagedPolicy_FromAwsManagedPolicyName(jsii.String("CloudWatchAgentServerPolicy"))) fleet := gamelift.NewBuildFleet(this, jsii.String("Game server fleet"), &BuildFleetProps{ FleetName: jsii.String("test-fleet"), Content: build, InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_C5, ec2.InstanceSize_LARGE), RuntimeConfiguration: &RuntimeConfiguration{ ServerProcesses: []serverProcess{ &serverProcess{ LaunchPath: jsii.String("/local/game/GameLiftExampleServer.x86_64"), }, }, }, Role: role, }) // Actions can also be grantted through dedicated method fleet.Grant(role, jsii.String("gamelift:ListFleets"))
func NewCompositePrincipal ¶
func NewCompositePrincipal(principals ...IPrincipal) CompositePrincipal
type CustomizeRolesOptions ¶ added in v2.51.0
type CustomizeRolesOptions struct { // Whether or not to synthesize the resource into the CFN template. // // Set this to `false` if you still want to create the resources _and_ // you also want to create the policy report. // Default: true. // PreventSynthesis *bool `field:"optional" json:"preventSynthesis" yaml:"preventSynthesis"` // A list of precreated IAM roles to substitute for roles that CDK is creating. // // The constructPath can be either a relative or absolute path // from the scope that `customizeRoles` is used on to the role being created. // // Example: // var app app // // // stack := awscdk.Newstack(app, jsii.String("MyStack")) // iam.NewRole(stack, jsii.String("MyRole"), &RoleProps{ // AssumedBy: iam.NewAccountPrincipal(jsii.String("1111111111")), // }) // // iam.Role_CustomizeRoles(stack, &CustomizeRolesOptions{ // UsePrecreatedRoles: map[string]*string{ // // absolute path // "MyStack/MyRole": jsii.String("my-precreated-role-name"), // // or relative path from `stack` // "MyRole": jsii.String("my-precreated-role"), // }, // }) // // Default: - there are no precreated roles. Synthesis will fail if `preventSynthesis=true` // UsePrecreatedRoles *map[string]*string `field:"optional" json:"usePrecreatedRoles" yaml:"usePrecreatedRoles"` }
Options for customizing IAM role creation.
Example:
var app app stack := awscdk.Newstack(app, jsii.String("MyStack")) iam.Role_CustomizeRoles(this, &CustomizeRolesOptions{ UsePrecreatedRoles: map[string]*string{ "MyStack/MyLambda/ServiceRole": jsii.String("my-role-name"), }, })
type Effect ¶
type Effect string
The Effect element of an IAM policy.
Example:
var books resource var iamUser user getBooks := books.AddMethod(jsii.String("GET"), apigateway.NewHttpIntegration(jsii.String("http://amazon.com")), &MethodOptions{ AuthorizationType: apigateway.AuthorizationType_IAM, }) iamUser.AttachInlinePolicy(iam.NewPolicy(this, jsii.String("AllowBooks"), &PolicyProps{ Statements: []policyStatement{ iam.NewPolicyStatement(&PolicyStatementProps{ Actions: []*string{ jsii.String("execute-api:Invoke"), }, Effect: iam.Effect_ALLOW, Resources: []*string{ getBooks.methodArn, }, }), }, }))
See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_effect.html
const ( // Allows access to a resource in an IAM policy statement. // // By default, access to resources are denied. Effect_ALLOW Effect = "ALLOW" // Explicitly deny access to a resource. // // By default, all requests are denied implicitly. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html // Effect_DENY Effect = "DENY" )
type FederatedPrincipal ¶
type FederatedPrincipal interface { PrincipalBase // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The conditions under which the policy is in effect. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html // Conditions() *map[string]interface{} // federated identity provider (i.e. 'cognito-identity.amazonaws.com' for users authenticated through Cognito). Federated() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
Principal entity that represents a federated identity provider such as Amazon Cognito, that can be used to provide temporary security credentials to users who have been authenticated.
Additional condition keys are available when the temporary security credentials are used to make a request. You can use these keys to write policies that limit the access of federated users.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var conditions interface{} federatedPrincipal := awscdk.Aws_iam.NewFederatedPrincipal(jsii.String("federated"), map[string]interface{}{ "conditionsKey": conditions, }, jsii.String("assumeRoleAction"))
func NewFederatedPrincipal ¶
func NewFederatedPrincipal(federated *string, conditions *map[string]interface{}, assumeRoleAction *string) FederatedPrincipal
type FromRoleArnOptions ¶
type FromRoleArnOptions struct { // For immutable roles: add grants to resources instead of dropping them. // // If this is `false` or not specified, grant permissions added to this role are ignored. // It is your own responsibility to make sure the role has the required permissions. // // If this is `true`, any grant permissions will be added to the resource instead. // Default: false. // AddGrantsToResources *bool `field:"optional" json:"addGrantsToResources" yaml:"addGrantsToResources"` // Any policies created by this role will use this value as their ID, if specified. // // Specify this if importing the same role in multiple stacks, and granting it // different permissions in at least two stacks. If this is not specified // (or if the same name is specified in more than one stack), // a CloudFormation issue will result in the policy created in whichever stack // is deployed last overwriting the policies created by the others. // Default: 'Policy'. // DefaultPolicyName *string `field:"optional" json:"defaultPolicyName" yaml:"defaultPolicyName"` // Whether the imported role can be modified by attaching policy resources to it. // Default: true. // Mutable *bool `field:"optional" json:"mutable" yaml:"mutable"` }
Options allowing customizing the behavior of `Role.fromRoleArn`.
Example:
role := iam.Role_FromRoleArn(this, jsii.String("Role"), jsii.String("arn:aws:iam::123456789012:role/MyExistingRole"), &FromRoleArnOptions{ // Set 'mutable' to 'false' to use the role as-is and prevent adding new // policies to it. The default is 'true', which means the role may be // modified as part of the deployment. Mutable: jsii.Boolean(false), })
type FromRoleNameOptions ¶ added in v2.29.0
type FromRoleNameOptions struct { // For immutable roles: add grants to resources instead of dropping them. // // If this is `false` or not specified, grant permissions added to this role are ignored. // It is your own responsibility to make sure the role has the required permissions. // // If this is `true`, any grant permissions will be added to the resource instead. // Default: false. // AddGrantsToResources *bool `field:"optional" json:"addGrantsToResources" yaml:"addGrantsToResources"` // Any policies created by this role will use this value as their ID, if specified. // // Specify this if importing the same role in multiple stacks, and granting it // different permissions in at least two stacks. If this is not specified // (or if the same name is specified in more than one stack), // a CloudFormation issue will result in the policy created in whichever stack // is deployed last overwriting the policies created by the others. // Default: 'Policy'. // DefaultPolicyName *string `field:"optional" json:"defaultPolicyName" yaml:"defaultPolicyName"` // Whether the imported role can be modified by attaching policy resources to it. // Default: true. // Mutable *bool `field:"optional" json:"mutable" yaml:"mutable"` }
Options allowing customizing the behavior of `Role.fromRoleName`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" fromRoleNameOptions := &FromRoleNameOptions{ AddGrantsToResources: jsii.Boolean(false), DefaultPolicyName: jsii.String("defaultPolicyName"), Mutable: jsii.Boolean(false), }
type Grant ¶
type Grant interface { constructs.IDependable // The statement that was added to the principal's policy. // Deprecated: Use `principalStatements` instead. PrincipalStatement() PolicyStatement // The statements that were added to the principal's policy. PrincipalStatements() *[]PolicyStatement // The statement that was added to the resource policy. // Deprecated: Use `resourceStatements` instead. ResourceStatement() PolicyStatement // The statements that were added to the principal's policy. ResourceStatements() *[]PolicyStatement // Whether the grant operation was successful. Success() *bool // Make sure this grant is applied before the given constructs are deployed. // // The same as construct.node.addDependency(grant), but slightly nicer to read. ApplyBefore(constructs ...constructs.IConstruct) // Throw an error if this grant wasn't successful. AssertSuccess() // Combine two grants into a new one. Combine(rhs Grant) Grant }
Result of a grant() operation.
This class is not instantiable by consumers on purpose, so that they will be required to call the Grant factory functions.
Example:
var instance instance var volume volume attachGrant := volume.grantAttachVolumeByResourceTag(instance.GrantPrincipal, []construct{ instance, }) detachGrant := volume.grantDetachVolumeByResourceTag(instance.GrantPrincipal, []construct{ instance, })
func Grant_AddToPrincipal ¶
func Grant_AddToPrincipal(options *GrantOnPrincipalOptions) Grant
Try to grant the given permissions to the given principal.
Absence of a principal leads to a warning, but failing to add the permissions to a present principal is not an error.
func Grant_AddToPrincipalAndResource ¶
func Grant_AddToPrincipalAndResource(options *GrantOnPrincipalAndResourceOptions) Grant
Add a grant both on the principal and on the resource.
As long as any principal is given, granting on the principal may fail (in case of a non-identity principal), but granting on the resource will never fail.
Statement will be the resource statement.
func Grant_AddToPrincipalOrResource ¶
func Grant_AddToPrincipalOrResource(options *GrantWithResourceOptions) Grant
Grant the given permissions to the principal.
The permissions will be added to the principal policy primarily, falling back to the resource policy if necessary. The permissions must be granted somewhere.
- Trying to grant permissions to a principal that does not admit adding to the principal policy while not providing a resource with a resource policy is an error.
- Trying to grant permissions to an absent principal (possible in the case of imported resources) leads to a warning being added to the resource construct.
func Grant_Drop ¶
func Grant_Drop(grantee IGrantable, _intent *string) Grant
Returns a "no-op" `Grant` object which represents a "dropped grant".
This can be used for e.g. imported resources where you may not be able to modify the resource's policy or some underlying policy which you don't know about.
type GrantOnPrincipalAndResourceOptions ¶
type GrantOnPrincipalAndResourceOptions struct { // The actions to grant. Actions *[]*string `field:"required" json:"actions" yaml:"actions"` // The principal to grant to. // Default: if principal is undefined, no work is done. // Grantee IGrantable `field:"required" json:"grantee" yaml:"grantee"` // The resource ARNs to grant to. ResourceArns *[]*string `field:"required" json:"resourceArns" yaml:"resourceArns"` // Any conditions to attach to the grant. // Default: - No conditions. // Conditions *map[string]*map[string]interface{} `field:"optional" json:"conditions" yaml:"conditions"` // The resource with a resource policy. // // The statement will always be added to the resource policy. Resource IResourceWithPolicy `field:"required" json:"resource" yaml:"resource"` // The principal to use in the statement for the resource policy. // Default: - the principal of the grantee will be used. // ResourcePolicyPrincipal IPrincipal `field:"optional" json:"resourcePolicyPrincipal" yaml:"resourcePolicyPrincipal"` // When referring to the resource in a resource policy, use this as ARN. // // (Depending on the resource type, this needs to be '*' in a resource policy). // Default: Same as regular resource ARNs. // ResourceSelfArns *[]*string `field:"optional" json:"resourceSelfArns" yaml:"resourceSelfArns"` }
Options for a grant operation to both identity and resource.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var conditions interface{} var grantable iGrantable var principal iPrincipal var resourceWithPolicy iResourceWithPolicy grantOnPrincipalAndResourceOptions := &GrantOnPrincipalAndResourceOptions{ Actions: []*string{ jsii.String("actions"), }, Grantee: grantable, Resource: resourceWithPolicy, ResourceArns: []*string{ jsii.String("resourceArns"), }, // the properties below are optional Conditions: map[string]map[string]interface{}{ "conditionsKey": map[string]interface{}{ "conditionsKey": conditions, }, }, ResourcePolicyPrincipal: principal, ResourceSelfArns: []*string{ jsii.String("resourceSelfArns"), }, }
type GrantOnPrincipalOptions ¶
type GrantOnPrincipalOptions struct { // The actions to grant. Actions *[]*string `field:"required" json:"actions" yaml:"actions"` // The principal to grant to. // Default: if principal is undefined, no work is done. // Grantee IGrantable `field:"required" json:"grantee" yaml:"grantee"` // The resource ARNs to grant to. ResourceArns *[]*string `field:"required" json:"resourceArns" yaml:"resourceArns"` // Any conditions to attach to the grant. // Default: - No conditions. // Conditions *map[string]*map[string]interface{} `field:"optional" json:"conditions" yaml:"conditions"` // Construct to report warnings on in case grant could not be registered. // Default: - the construct in which this construct is defined. // Scope constructs.IConstruct `field:"optional" json:"scope" yaml:"scope"` }
Options for a grant operation that only applies to principals.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" import constructs "github.com/aws/constructs-go/constructs" var conditions interface{} var construct construct var grantable iGrantable grantOnPrincipalOptions := &GrantOnPrincipalOptions{ Actions: []*string{ jsii.String("actions"), }, Grantee: grantable, ResourceArns: []*string{ jsii.String("resourceArns"), }, // the properties below are optional Conditions: map[string]map[string]interface{}{ "conditionsKey": map[string]interface{}{ "conditionsKey": conditions, }, }, Scope: construct, }
type GrantWithResourceOptions ¶
type GrantWithResourceOptions struct { // The actions to grant. Actions *[]*string `field:"required" json:"actions" yaml:"actions"` // The principal to grant to. // Default: if principal is undefined, no work is done. // Grantee IGrantable `field:"required" json:"grantee" yaml:"grantee"` // The resource ARNs to grant to. ResourceArns *[]*string `field:"required" json:"resourceArns" yaml:"resourceArns"` // Any conditions to attach to the grant. // Default: - No conditions. // Conditions *map[string]*map[string]interface{} `field:"optional" json:"conditions" yaml:"conditions"` // The resource with a resource policy. // // The statement will be added to the resource policy if it couldn't be // added to the principal policy. Resource IResourceWithPolicy `field:"required" json:"resource" yaml:"resource"` // When referring to the resource in a resource policy, use this as ARN. // // (Depending on the resource type, this needs to be '*' in a resource policy). // Default: Same as regular resource ARNs. // ResourceSelfArns *[]*string `field:"optional" json:"resourceSelfArns" yaml:"resourceSelfArns"` }
Options for a grant operation.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var conditions interface{} var grantable iGrantable var resourceWithPolicy iResourceWithPolicy grantWithResourceOptions := &GrantWithResourceOptions{ Actions: []*string{ jsii.String("actions"), }, Grantee: grantable, Resource: resourceWithPolicy, ResourceArns: []*string{ jsii.String("resourceArns"), }, // the properties below are optional Conditions: map[string]map[string]interface{}{ "conditionsKey": map[string]interface{}{ "conditionsKey": conditions, }, }, ResourceSelfArns: []*string{ jsii.String("resourceSelfArns"), }, }
type Group ¶
type Group interface { awscdk.Resource IGroup // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The environment this resource belongs to. // // For resources that are created and managed by the CDK // (generally, those created by creating new class instances like Role, Bucket, etc.), // this is always the same as the environment of the stack they belong to; // however, for imported resources // (those obtained from static methods like fromRoleArn, fromBucketName, etc.), // that might be different than the stack they were imported into. Env() *awscdk.ResourceEnvironment // The principal to grant permissions to. GrantPrincipal() IPrincipal // Returns the IAM Group ARN. GroupArn() *string // Returns the IAM Group Name. GroupName() *string // The tree node. Node() constructs.Node // Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource. // // This value will resolve to one of the following: // - a concrete value (e.g. `"my-awesome-bucket"`) // - `undefined`, when a name should be generated by CloudFormation // - a concrete name generated automatically during synthesis, in // cross-environment scenarios. PhysicalName() *string // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // The stack in which this resource is defined. Stack() awscdk.Stack // Attaches a managed policy to this group. // // See [IAM and AWS STS quotas, name requirements, and character limits] // (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-quotas-entities) // for quota of managed policies attached to an IAM group. AddManagedPolicy(policy IManagedPolicy) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Adds an IAM statement to the default policy. AddToPrincipalPolicy(statement PolicyStatement) *AddToPrincipalPolicyResult // Adds a user to this group. AddUser(user IUser) // Apply the given removal policy to this resource. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). ApplyRemovalPolicy(policy awscdk.RemovalPolicy) // Attaches a policy to this group. AttachInlinePolicy(policy Policy) GeneratePhysicalName() *string // Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`). // // Normally, this token will resolve to `arnAttr`, but if the resource is // referenced across environments, `arnComponents` will be used to synthesize // a concrete ARN with the resource's physical name. Make sure to reference // `this.physicalName` in `arnComponents`. GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string // Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`). // // Normally, this token will resolve to `nameAttr`, but if the resource is // referenced across environments, it will be resolved to `this.physicalName`, // which will be a concrete name. GetResourceNameAttribute(nameAttr *string) *string // Returns a string representation of this construct. ToString() *string }
An IAM Group (collection of IAM users) lets you specify permissions for multiple users, which can make it easier to manage permissions for those users.
Example:
user := iam.NewUser(this, jsii.String("MyUser")) // or User.fromUserName(this, 'User', 'johnsmith'); group := iam.NewGroup(this, jsii.String("MyGroup")) // or Group.fromGroupArn(this, 'Group', 'arn:aws:iam::account-id:group/group-name'); user.AddToGroup(group) // or group.addUser(user)
See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html
func NewGroup ¶
func NewGroup(scope constructs.Construct, id *string, props *GroupProps) Group
type GroupProps ¶
type GroupProps struct { // A name for the IAM group. // // For valid values, see the GroupName parameter // for the CreateGroup action in the IAM API Reference. If you don't specify // a name, AWS CloudFormation generates a unique physical ID and uses that // ID for the group name. // // If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to // acknowledge your template's capabilities. For more information, see // Acknowledging IAM Resources in AWS CloudFormation Templates. // Default: Generated by CloudFormation (recommended). // GroupName *string `field:"optional" json:"groupName" yaml:"groupName"` // A list of managed policies associated with this role. // // You can add managed policies later using // `addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName(policyName))`. // Default: - No managed policies. // ManagedPolicies *[]IManagedPolicy `field:"optional" json:"managedPolicies" yaml:"managedPolicies"` // The path to the group. // // For more information about paths, see [IAM // Identifiers](http://docs.aws.amazon.com/IAM/latest/UserGuide/index.html?Using_Identifiers.html) // in the IAM User Guide. // Default: /. // Path *string `field:"optional" json:"path" yaml:"path"` }
Properties for defining an IAM group.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var managedPolicy managedPolicy groupProps := &GroupProps{ GroupName: jsii.String("groupName"), ManagedPolicies: []iManagedPolicy{ managedPolicy, }, Path: jsii.String("path"), }
type IAccessKey ¶ added in v2.7.0
type IAccessKey interface { awscdk.IResource // The Access Key ID. AccessKeyId() *string // The Secret Access Key. SecretAccessKey() awscdk.SecretValue }
Represents an IAM Access Key. See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
type IAssumeRolePrincipal ¶ added in v2.4.0
type IAssumeRolePrincipal interface { IPrincipal // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) }
A type of principal that has more control over its own representation in AssumeRolePolicyDocuments.
More complex types of identity providers need more control over Role's policy documents than simply `{ Effect: 'Allow', Action: 'AssumeRole', Principal: <Whatever> }`.
If that control is necessary, they can implement `IAssumeRolePrincipal` to get full access to a Role's AssumeRolePolicyDocument.
type IComparablePrincipal ¶ added in v2.26.0
type IComparablePrincipal interface { IPrincipal // Return a string format of this principal which should be identical if the two principals are the same. DedupeString() *string }
Interface for principals that can be compared.
This only needs to be implemented for principals that could potentially be value-equal. Identity-equal principals will be handled correctly by default.
type IGrantable ¶
type IGrantable interface { // The principal to grant permissions to. GrantPrincipal() IPrincipal }
Any object that has an associated principal that a permission can be granted to.
type IGroup ¶
type IGroup interface { IIdentity // Returns the IAM Group ARN. GroupArn() *string // Returns the IAM Group Name. GroupName() *string }
Represents an IAM Group. See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html
func Group_FromGroupArn ¶
Import an external group by ARN.
If the imported Group ARN is a Token (such as a `CfnParameter.valueAsString` or a `Fn.importValue()`) *and* the referenced group has a `path` (like `arn:...:group/AdminGroup/NetworkAdmin`), the `groupName` property will not resolve to the correct value. Instead it will resolve to the first path component. We unfortunately cannot express the correct calculation of the full path name as a CloudFormation expression. In this scenario the Group ARN should be supplied without the `path` in order to resolve the correct group resource.
func Group_FromGroupName ¶ added in v2.1.0
Import an existing group by given name (with path).
This method has same caveats of `fromGroupArn`.
type IIdentity ¶
type IIdentity interface { IPrincipal awscdk.IResource // Attaches a managed policy to this principal. AddManagedPolicy(policy IManagedPolicy) // Attaches an inline policy to this principal. // // This is the same as calling `policy.addToXxx(principal)`. AttachInlinePolicy(policy Policy) }
A construct that represents an IAM principal, such as a user, group or role.
type IInstanceProfile ¶ added in v2.88.0
type IInstanceProfile interface { awscdk.IResource // The InstanceProfile's ARN. InstanceProfileArn() *string // The InstanceProfile's name. InstanceProfileName() *string // The role associated with the InstanceProfile. Role() IRole }
Represents an IAM Instance Profile.
func InstanceProfile_FromInstanceProfileArn ¶ added in v2.88.0
func InstanceProfile_FromInstanceProfileArn(scope constructs.Construct, id *string, instanceProfileArn *string) IInstanceProfile
Import an existing InstanceProfile from an InstanceProfile ARN.
If the ARN comes from a Token, the InstanceProfile cannot have a path; if so, any attempt to reference its instanceProfileName will fail.
func InstanceProfile_FromInstanceProfileAttributes ¶ added in v2.88.0
func InstanceProfile_FromInstanceProfileAttributes(scope constructs.Construct, id *string, attrs *InstanceProfileAttributes) IInstanceProfile
Import an existing InstanceProfile from given InstanceProfile attributes.
If the ARN comes from a Token, the InstanceProfile cannot have a path; if so, any attempt to reference its instanceProfileName will fail.
func InstanceProfile_FromInstanceProfileName ¶ added in v2.88.0
func InstanceProfile_FromInstanceProfileName(scope constructs.Construct, id *string, instanceProfileName *string) IInstanceProfile
Import an existing InstanceProfile from an InstanceProfile name.
type IManagedPolicy ¶
type IManagedPolicy interface { // The ARN of the managed policy. ManagedPolicyArn() *string }
A managed policy.
func ManagedPolicy_FromAwsManagedPolicyName ¶
func ManagedPolicy_FromAwsManagedPolicyName(managedPolicyName *string) IManagedPolicy
Import a managed policy from one of the policies that AWS manages.
For this managed policy, you only need to know the name to be able to use it.
Some managed policy names start with "service-role/", some start with "job-function/", and some don't start with anything. Include the prefix when constructing this object.
func ManagedPolicy_FromManagedPolicyArn ¶
func ManagedPolicy_FromManagedPolicyArn(scope constructs.Construct, id *string, managedPolicyArn *string) IManagedPolicy
Import an external managed policy by ARN.
For this managed policy, you only need to know the ARN to be able to use it. This can be useful if you got the ARN from a CloudFormation Export.
If the imported Managed Policy ARN is a Token (such as a `CfnParameter.valueAsString` or a `Fn.importValue()`) *and* the referenced managed policy has a `path` (like `arn:...:policy/AdminPolicy/AdminAllow`), the `managedPolicyName` property will not resolve to the correct value. Instead it will resolve to the first path component. We unfortunately cannot express the correct calculation of the full path name as a CloudFormation expression. In this scenario the Managed Policy ARN should be supplied without the `path` in order to resolve the correct managed policy resource.
func ManagedPolicy_FromManagedPolicyName ¶
func ManagedPolicy_FromManagedPolicyName(scope constructs.Construct, id *string, managedPolicyName *string) IManagedPolicy
Import a customer managed policy from the managedPolicyName.
For this managed policy, you only need to know the name to be able to use it.
type IOpenIdConnectProvider ¶
type IOpenIdConnectProvider interface { awscdk.IResource // The Amazon Resource Name (ARN) of the IAM OpenID Connect provider. OpenIdConnectProviderArn() *string // The issuer for OIDC Provider. OpenIdConnectProviderIssuer() *string }
Represents an IAM OpenID Connect provider.
func OpenIdConnectProvider_FromOpenIdConnectProviderArn ¶
func OpenIdConnectProvider_FromOpenIdConnectProviderArn(scope constructs.Construct, id *string, openIdConnectProviderArn *string) IOpenIdConnectProvider
Imports an Open ID connect provider from an ARN.
type IPolicy ¶
type IPolicy interface { awscdk.IResource // The name of this policy. PolicyName() *string }
Represents an IAM Policy. See: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html
func Policy_FromPolicyName ¶
Import a policy in this app based on its name.
type IPrincipal ¶
type IPrincipal interface { IGrantable // Add to the policy of this principal. AddToPrincipalPolicy(statement PolicyStatement) *AddToPrincipalPolicyResult // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string }
Represents a logical IAM principal.
An IPrincipal describes a logical entity that can perform AWS API calls against sets of resources, optionally under certain conditions.
Examples of simple principals are IAM objects that you create, such as Users or Roles.
An example of a more complex principals is a `ServicePrincipal` (such as `new ServicePrincipal("sns.amazonaws.com")`, which represents the Simple Notifications Service).
A single logical Principal may also map to a set of physical principals. For example, `new OrganizationPrincipal('o-1234')` represents all identities that are part of the given AWS Organization.
type IResourceWithPolicy ¶
type IResourceWithPolicy interface { awscdk.IResource // Add a statement to the resource's resource policy. AddToResourcePolicy(statement PolicyStatement) *AddToResourcePolicyResult }
A resource with a resource policy that can be added to.
type IRole ¶
type IRole interface { IIdentity // Grant the actions defined in actions to the identity Principal on this resource. Grant(grantee IPrincipal, actions ...*string) Grant // Grant permissions to the given principal to assume this role. GrantAssumeRole(grantee IPrincipal) Grant // Grant permissions to the given principal to pass this role. GrantPassRole(grantee IPrincipal) Grant // Returns the ARN of this role. RoleArn() *string // Returns the name of this role. RoleName() *string }
A Role object.
func Role_FromRoleArn ¶
func Role_FromRoleArn(scope constructs.Construct, id *string, roleArn *string, options *FromRoleArnOptions) IRole
Import an external role by ARN.
If the imported Role ARN is a Token (such as a `CfnParameter.valueAsString` or a `Fn.importValue()`) *and* the referenced role has a `path` (like `arn:...:role/AdminRoles/Alice`), the `roleName` property will not resolve to the correct value. Instead it will resolve to the first path component. We unfortunately cannot express the correct calculation of the full path name as a CloudFormation expression. In this scenario the Role ARN should be supplied without the `path` in order to resolve the correct role resource.
func Role_FromRoleName ¶ added in v2.13.0
func Role_FromRoleName(scope constructs.Construct, id *string, roleName *string, options *FromRoleNameOptions) IRole
Import an external role by name.
The imported role is assumed to exist in the same account as the account the scope's containing Stack is being deployed to.
type ISamlProvider ¶
type ISamlProvider interface { awscdk.IResource // The Amazon Resource Name (ARN) of the provider. SamlProviderArn() *string }
A SAML provider.
func SamlProvider_FromSamlProviderArn ¶
func SamlProvider_FromSamlProviderArn(scope constructs.Construct, id *string, samlProviderArn *string) ISamlProvider
Import an existing provider.
type IUser ¶
type IUser interface { IIdentity // Adds this user to a group. AddToGroup(group IGroup) // The user's ARN. UserArn() *string // The user's name. UserName() *string }
Represents an IAM user. See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html
func User_FromUserArn ¶
Import an existing user given a user ARN.
If the ARN comes from a Token, the User cannot have a path; if so, any attempt to reference its username will fail.
func User_FromUserAttributes ¶
func User_FromUserAttributes(scope constructs.Construct, id *string, attrs *UserAttributes) IUser
Import an existing user given user attributes.
If the ARN comes from a Token, the User cannot have a path; if so, any attempt to reference its username will fail.
func User_FromUserName ¶
Import an existing user given a username.
type InstanceProfile ¶ added in v2.88.0
type InstanceProfile interface { awscdk.Resource IInstanceProfile // The environment this resource belongs to. // // For resources that are created and managed by the CDK // (generally, those created by creating new class instances like Role, Bucket, etc.), // this is always the same as the environment of the stack they belong to; // however, for imported resources // (those obtained from static methods like fromRoleArn, fromBucketName, etc.), // that might be different than the stack they were imported into. Env() *awscdk.ResourceEnvironment // Returns the ARN of this InstanceProfile. InstanceProfileArn() *string // Returns the name of this InstanceProfile. InstanceProfileName() *string // The tree node. Node() constructs.Node // Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource. // // This value will resolve to one of the following: // - a concrete value (e.g. `"my-awesome-bucket"`) // - `undefined`, when a name should be generated by CloudFormation // - a concrete name generated automatically during synthesis, in // cross-environment scenarios. PhysicalName() *string // Returns the role associated with this InstanceProfile. Role() IRole // The stack in which this resource is defined. Stack() awscdk.Stack // Apply the given removal policy to this resource. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). ApplyRemovalPolicy(policy awscdk.RemovalPolicy) GeneratePhysicalName() *string // Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`). // // Normally, this token will resolve to `arnAttr`, but if the resource is // referenced across environments, `arnComponents` will be used to synthesize // a concrete ARN with the resource's physical name. Make sure to reference // `this.physicalName` in `arnComponents`. GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string // Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`). // // Normally, this token will resolve to `nameAttr`, but if the resource is // referenced across environments, it will be resolved to `this.physicalName`, // which will be a concrete name. GetResourceNameAttribute(nameAttr *string) *string // Returns a string representation of this construct. ToString() *string }
IAM Instance Profile.
Example:
role := iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewServicePrincipal(jsii.String("ec2.amazonaws.com")), }) instanceProfile := iam.InstanceProfile_FromInstanceProfileAttributes(this, jsii.String("ImportedInstanceProfile"), &InstanceProfileAttributes{ InstanceProfileArn: jsii.String("arn:aws:iam::account-id:instance-profile/MyInstanceProfile"), Role: Role, })
func NewInstanceProfile ¶ added in v2.88.0
func NewInstanceProfile(scope constructs.Construct, id *string, props *InstanceProfileProps) InstanceProfile
type InstanceProfileAttributes ¶ added in v2.88.0
type InstanceProfileAttributes struct { // The ARN of the InstanceProfile. // // Format: arn:<partition>:iam::<account-id>:instance-profile/<instance-profile-name-with-path>. InstanceProfileArn *string `field:"required" json:"instanceProfileArn" yaml:"instanceProfileArn"` // The role associated with the InstanceProfile. // Default: - no role. // Role IRole `field:"optional" json:"role" yaml:"role"` }
Attributes of an Instance Profile.
Example:
role := iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewServicePrincipal(jsii.String("ec2.amazonaws.com")), }) instanceProfile := iam.InstanceProfile_FromInstanceProfileAttributes(this, jsii.String("ImportedInstanceProfile"), &InstanceProfileAttributes{ InstanceProfileArn: jsii.String("arn:aws:iam::account-id:instance-profile/MyInstanceProfile"), Role: Role, })
type InstanceProfileProps ¶ added in v2.88.0
type InstanceProfileProps struct { // The name of the InstanceProfile to create. // Default: - generated by CloudFormation. // InstanceProfileName *string `field:"optional" json:"instanceProfileName" yaml:"instanceProfileName"` // The path to the InstanceProfile. // Default: /. // Path *string `field:"optional" json:"path" yaml:"path"` // An IAM role to associate with the instance profile that is used by EC2 instances. // // The role must be assumable by the service principal `ec2.amazonaws.com`: // // Example: // role := iam.NewRole(this, jsii.String("MyRole"), &RoleProps{ // AssumedBy: iam.NewServicePrincipal(jsii.String("ec2.amazonaws.com")), // }) // // Default: - a role will be automatically created, it can be accessed via the `role` property. // Role IRole `field:"optional" json:"role" yaml:"role"` }
Properties of an Instance Profile.
Example:
role := iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewServicePrincipal(jsii.String("ec2.amazonaws.com")), }) instanceProfile := iam.NewInstanceProfile(this, jsii.String("InstanceProfile"), &InstanceProfileProps{ Role: Role, InstanceProfileName: jsii.String("MyInstanceProfile"), Path: jsii.String("/sample/path/"), })
type LazyRole ¶
type LazyRole interface { awscdk.Resource IRole // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The environment this resource belongs to. // // For resources that are created and managed by the CDK // (generally, those created by creating new class instances like Role, Bucket, etc.), // this is always the same as the environment of the stack they belong to; // however, for imported resources // (those obtained from static methods like fromRoleArn, fromBucketName, etc.), // that might be different than the stack they were imported into. Env() *awscdk.ResourceEnvironment // The principal to grant permissions to. GrantPrincipal() IPrincipal // The tree node. Node() constructs.Node // Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource. // // This value will resolve to one of the following: // - a concrete value (e.g. `"my-awesome-bucket"`) // - `undefined`, when a name should be generated by CloudFormation // - a concrete name generated automatically during synthesis, in // cross-environment scenarios. PhysicalName() *string // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Returns the ARN of this role. RoleArn() *string // Returns the stable and unique string identifying the role (i.e. AIDAJQABLZS4A3QDU576Q). RoleId() *string // Returns the name of this role. RoleName() *string // The stack in which this resource is defined. Stack() awscdk.Stack // Attaches a managed policy to this role. AddManagedPolicy(policy IManagedPolicy) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Adds a permission to the role's default policy document. // // If there is no default policy attached to this role, it will be created. AddToPrincipalPolicy(statement PolicyStatement) *AddToPrincipalPolicyResult // Apply the given removal policy to this resource. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). ApplyRemovalPolicy(policy awscdk.RemovalPolicy) // Attaches a policy to this role. AttachInlinePolicy(policy Policy) GeneratePhysicalName() *string // Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`). // // Normally, this token will resolve to `arnAttr`, but if the resource is // referenced across environments, `arnComponents` will be used to synthesize // a concrete ARN with the resource's physical name. Make sure to reference // `this.physicalName` in `arnComponents`. GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string // Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`). // // Normally, this token will resolve to `nameAttr`, but if the resource is // referenced across environments, it will be resolved to `this.physicalName`, // which will be a concrete name. GetResourceNameAttribute(nameAttr *string) *string // Grant the actions defined in actions to the identity Principal on this resource. Grant(identity IPrincipal, actions ...*string) Grant // Grant permissions to the given principal to assume this role. GrantAssumeRole(identity IPrincipal) Grant // Grant permissions to the given principal to pass this role. GrantPassRole(identity IPrincipal) Grant // Returns a string representation of this construct. ToString() *string }
An IAM role that only gets attached to the construct tree once it gets used, not before.
This construct can be used to simplify logic in other constructs which need to create a role but only if certain configurations occur (such as when AutoScaling is configured). The role can be configured in one place, but if it never gets used it doesn't get instantiated and will not be synthesized or deployed.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import cdk "github.com/aws/aws-cdk-go/awscdk" import "github.com/aws/aws-cdk-go/awscdk" var managedPolicy managedPolicy var policyDocument policyDocument var principal iPrincipal lazyRole := awscdk.Aws_iam.NewLazyRole(this, jsii.String("MyLazyRole"), &LazyRoleProps{ AssumedBy: principal, // the properties below are optional Description: jsii.String("description"), ExternalIds: []*string{ jsii.String("externalIds"), }, InlinePolicies: map[string]*policyDocument{ "inlinePoliciesKey": policyDocument, }, ManagedPolicies: []iManagedPolicy{ managedPolicy, }, MaxSessionDuration: cdk.Duration_Minutes(jsii.Number(30)), Path: jsii.String("path"), PermissionsBoundary: managedPolicy, RoleName: jsii.String("roleName"), })
func NewLazyRole ¶
func NewLazyRole(scope constructs.Construct, id *string, props *LazyRoleProps) LazyRole
type LazyRoleProps ¶
type LazyRoleProps struct { // The IAM principal (i.e. `new ServicePrincipal('sns.amazonaws.com')`) which can assume this role. // // You can later modify the assume role policy document by accessing it via // the `assumeRolePolicy` property. AssumedBy IPrincipal `field:"required" json:"assumedBy" yaml:"assumedBy"` // A description of the role. // // It can be up to 1000 characters long. // Default: - No description. // Description *string `field:"optional" json:"description" yaml:"description"` // List of IDs that the role assumer needs to provide one of when assuming this role. // // If the configured and provided external IDs do not match, the // AssumeRole operation will fail. // Default: No external ID required. // ExternalIds *[]*string `field:"optional" json:"externalIds" yaml:"externalIds"` // A list of named policies to inline into this role. // // These policies will be // created with the role, whereas those added by “addToPolicy“ are added // using a separate CloudFormation resource (allowing a way around circular // dependencies that could otherwise be introduced). // Default: - No policy is inlined in the Role resource. // InlinePolicies *map[string]PolicyDocument `field:"optional" json:"inlinePolicies" yaml:"inlinePolicies"` // A list of managed policies associated with this role. // // You can add managed policies later using // `addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName(policyName))`. // Default: - No managed policies. // ManagedPolicies *[]IManagedPolicy `field:"optional" json:"managedPolicies" yaml:"managedPolicies"` // The maximum session duration that you want to set for the specified role. // // This setting can have a value from 1 hour (3600sec) to 12 (43200sec) hours. // // Anyone who assumes the role from the AWS CLI or API can use the // DurationSeconds API parameter or the duration-seconds CLI parameter to // request a longer session. The MaxSessionDuration setting determines the // maximum duration that can be requested using the DurationSeconds // parameter. // // If users don't specify a value for the DurationSeconds parameter, their // security credentials are valid for one hour by default. This applies when // you use the AssumeRole* API operations or the assume-role* CLI operations // but does not apply when you use those operations to create a console URL. // Default: Duration.hours(1) // MaxSessionDuration awscdk.Duration `field:"optional" json:"maxSessionDuration" yaml:"maxSessionDuration"` // The path associated with this role. // // For information about IAM paths, see // Friendly Names and Paths in IAM User Guide. // Default: /. // Path *string `field:"optional" json:"path" yaml:"path"` // AWS supports permissions boundaries for IAM entities (users or roles). // // A permissions boundary is an advanced feature for using a managed policy // to set the maximum permissions that an identity-based policy can grant to // an IAM entity. An entity's permissions boundary allows it to perform only // the actions that are allowed by both its identity-based policies and its // permissions boundaries. // Default: - No permissions boundary. // PermissionsBoundary IManagedPolicy `field:"optional" json:"permissionsBoundary" yaml:"permissionsBoundary"` // A name for the IAM role. // // For valid values, see the RoleName parameter for // the CreateRole action in the IAM API Reference. // // IMPORTANT: If you specify a name, you cannot perform updates that require // replacement of this resource. You can perform updates that require no or // some interruption. If you must replace the resource, specify a new name. // // If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to // acknowledge your template's capabilities. For more information, see // Acknowledging IAM Resources in AWS CloudFormation Templates. // Default: - AWS CloudFormation generates a unique physical ID and uses that ID // for the role name. // RoleName *string `field:"optional" json:"roleName" yaml:"roleName"` }
Properties for defining a LazyRole.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import cdk "github.com/aws/aws-cdk-go/awscdk" import "github.com/aws/aws-cdk-go/awscdk" var managedPolicy managedPolicy var policyDocument policyDocument var principal iPrincipal lazyRoleProps := &LazyRoleProps{ AssumedBy: principal, // the properties below are optional Description: jsii.String("description"), ExternalIds: []*string{ jsii.String("externalIds"), }, InlinePolicies: map[string]*policyDocument{ "inlinePoliciesKey": policyDocument, }, ManagedPolicies: []iManagedPolicy{ managedPolicy, }, MaxSessionDuration: cdk.Duration_Minutes(jsii.Number(30)), Path: jsii.String("path"), PermissionsBoundary: managedPolicy, RoleName: jsii.String("roleName"), }
type ManagedPolicy ¶
type ManagedPolicy interface { awscdk.Resource IGrantable IManagedPolicy // The description of this policy. Description() *string // The policy document. Document() PolicyDocument // The environment this resource belongs to. // // For resources that are created and managed by the CDK // (generally, those created by creating new class instances like Role, Bucket, etc.), // this is always the same as the environment of the stack they belong to; // however, for imported resources // (those obtained from static methods like fromRoleArn, fromBucketName, etc.), // that might be different than the stack they were imported into. Env() *awscdk.ResourceEnvironment // The principal to grant permissions to. GrantPrincipal() IPrincipal // Returns the ARN of this managed policy. ManagedPolicyArn() *string // The name of this policy. ManagedPolicyName() *string // The tree node. Node() constructs.Node // The path of this policy. Path() *string // Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource. // // This value will resolve to one of the following: // - a concrete value (e.g. `"my-awesome-bucket"`) // - `undefined`, when a name should be generated by CloudFormation // - a concrete name generated automatically during synthesis, in // cross-environment scenarios. PhysicalName() *string // The stack in which this resource is defined. Stack() awscdk.Stack // Adds a statement to the policy document. AddStatements(statement ...PolicyStatement) // Apply the given removal policy to this resource. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). ApplyRemovalPolicy(policy awscdk.RemovalPolicy) // Attaches this policy to a group. AttachToGroup(group IGroup) // Attaches this policy to a role. AttachToRole(role IRole) // Attaches this policy to a user. AttachToUser(user IUser) GeneratePhysicalName() *string // Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`). // // Normally, this token will resolve to `arnAttr`, but if the resource is // referenced across environments, `arnComponents` will be used to synthesize // a concrete ARN with the resource's physical name. Make sure to reference // `this.physicalName` in `arnComponents`. GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string // Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`). // // Normally, this token will resolve to `nameAttr`, but if the resource is // referenced across environments, it will be resolved to `this.physicalName`, // which will be a concrete name. GetResourceNameAttribute(nameAttr *string) *string // Returns a string representation of this construct. ToString() *string }
Managed policy.
Example:
var build build role := iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewCompositePrincipal(iam.NewServicePrincipal(jsii.String("gamelift.amazonaws.com"))), }) role.AddManagedPolicy(iam.ManagedPolicy_FromAwsManagedPolicyName(jsii.String("CloudWatchAgentServerPolicy"))) fleet := gamelift.NewBuildFleet(this, jsii.String("Game server fleet"), &BuildFleetProps{ FleetName: jsii.String("test-fleet"), Content: build, InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_C5, ec2.InstanceSize_LARGE), RuntimeConfiguration: &RuntimeConfiguration{ ServerProcesses: []serverProcess{ &serverProcess{ LaunchPath: jsii.String("/local/game/GameLiftExampleServer.x86_64"), }, }, }, Role: role, }) // Actions can also be grantted through dedicated method fleet.Grant(role, jsii.String("gamelift:ListFleets"))
func NewManagedPolicy ¶
func NewManagedPolicy(scope constructs.Construct, id *string, props *ManagedPolicyProps) ManagedPolicy
type ManagedPolicyProps ¶
type ManagedPolicyProps struct { // A description of the managed policy. // // Typically used to store information about the // permissions defined in the policy. For example, "Grants access to production DynamoDB tables." // The policy description is immutable. After a value is assigned, it cannot be changed. // Default: - empty. // Description *string `field:"optional" json:"description" yaml:"description"` // Initial PolicyDocument to use for this ManagedPolicy. // // If omited, any // `PolicyStatement` provided in the `statements` property will be applied // against the empty default `PolicyDocument`. // Default: - An empty policy. // Document PolicyDocument `field:"optional" json:"document" yaml:"document"` // Groups to attach this policy to. // // You can also use `attachToGroup(group)` to attach this policy to a group. // Default: - No groups. // Groups *[]IGroup `field:"optional" json:"groups" yaml:"groups"` // The name of the managed policy. // // If you specify multiple policies for an entity, // specify unique names. For example, if you specify a list of policies for // an IAM role, each policy must have a unique name. // Default: - A name is automatically generated. // ManagedPolicyName *string `field:"optional" json:"managedPolicyName" yaml:"managedPolicyName"` // The path for the policy. // // This parameter allows (through its regex pattern) a string of characters // consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. // In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), // including most punctuation characters, digits, and upper and lowercased letters. // // For more information about paths, see IAM Identifiers in the IAM User Guide. // Default: - "/". // Path *string `field:"optional" json:"path" yaml:"path"` // Roles to attach this policy to. // // You can also use `attachToRole(role)` to attach this policy to a role. // Default: - No roles. // Roles *[]IRole `field:"optional" json:"roles" yaml:"roles"` // Initial set of permissions to add to this policy document. // // You can also use `addPermission(statement)` to add permissions later. // Default: - No statements. // Statements *[]PolicyStatement `field:"optional" json:"statements" yaml:"statements"` // Users to attach this policy to. // // You can also use `attachToUser(user)` to attach this policy to a user. // Default: - No users. // Users *[]IUser `field:"optional" json:"users" yaml:"users"` }
Properties for defining an IAM managed policy.
Example:
policyDocument := map[string]interface{}{ "Version": jsii.String("2012-10-17"), "Statement": []interface{}{ map[string]interface{}{ "Sid": jsii.String("FirstStatement"), "Effect": jsii.String("Allow"), "Action": []*string{ jsii.String("iam:ChangePassword"), }, "Resource": []*string{ jsii.String("*"), }, }, map[string]interface{}{ "Sid": jsii.String("SecondStatement"), "Effect": jsii.String("Allow"), "Action": []*string{ jsii.String("s3:ListAllMyBuckets"), }, "Resource": []*string{ jsii.String("*"), }, }, map[string]interface{}{ "Sid": jsii.String("ThirdStatement"), "Effect": jsii.String("Allow"), "Action": []*string{ jsii.String("s3:List*"), jsii.String("s3:Get*"), }, "Resource": []*string{ jsii.String("arn:aws:s3:::confidential-data"), jsii.String("arn:aws:s3:::confidential-data/*"), }, "Condition": map[string]map[string]*string{ "Bool": map[string]*string{ "aws:MultiFactorAuthPresent": jsii.String("true"), }, }, }, }, } customPolicyDocument := iam.PolicyDocument_FromJson(policyDocument) // You can pass this document as an initial document to a ManagedPolicy // or inline Policy. newManagedPolicy := iam.NewManagedPolicy(this, jsii.String("MyNewManagedPolicy"), &ManagedPolicyProps{ Document: customPolicyDocument, }) newPolicy := iam.NewPolicy(this, jsii.String("MyNewPolicy"), &PolicyProps{ Document: customPolicyDocument, })
type OpenIdConnectPrincipal ¶
type OpenIdConnectPrincipal interface { WebIdentityPrincipal // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The conditions under which the policy is in effect. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html // Conditions() *map[string]interface{} // federated identity provider (i.e. 'cognito-identity.amazonaws.com' for users authenticated through Cognito). Federated() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
A principal that represents a federated identity provider as from a OpenID Connect provider.
Example:
provider := iam.NewOpenIdConnectProvider(this, jsii.String("MyProvider"), &OpenIdConnectProviderProps{ Url: jsii.String("https://openid/connect"), ClientIds: []*string{ jsii.String("myclient1"), jsii.String("myclient2"), }, }) principal := iam.NewOpenIdConnectPrincipal(provider)
func NewOpenIdConnectPrincipal ¶
func NewOpenIdConnectPrincipal(openIdConnectProvider IOpenIdConnectProvider, conditions *map[string]interface{}) OpenIdConnectPrincipal
type OpenIdConnectProvider ¶
type OpenIdConnectProvider interface { awscdk.Resource IOpenIdConnectProvider // The environment this resource belongs to. // // For resources that are created and managed by the CDK // (generally, those created by creating new class instances like Role, Bucket, etc.), // this is always the same as the environment of the stack they belong to; // however, for imported resources // (those obtained from static methods like fromRoleArn, fromBucketName, etc.), // that might be different than the stack they were imported into. Env() *awscdk.ResourceEnvironment // The tree node. Node() constructs.Node // The Amazon Resource Name (ARN) of the IAM OpenID Connect provider. OpenIdConnectProviderArn() *string // The issuer for OIDC Provider. OpenIdConnectProviderIssuer() *string // The thumbprints configured for this provider. OpenIdConnectProviderthumbprints() *string // Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource. // // This value will resolve to one of the following: // - a concrete value (e.g. `"my-awesome-bucket"`) // - `undefined`, when a name should be generated by CloudFormation // - a concrete name generated automatically during synthesis, in // cross-environment scenarios. PhysicalName() *string // The stack in which this resource is defined. Stack() awscdk.Stack // Apply the given removal policy to this resource. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). ApplyRemovalPolicy(policy awscdk.RemovalPolicy) GeneratePhysicalName() *string // Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`). // // Normally, this token will resolve to `arnAttr`, but if the resource is // referenced across environments, `arnComponents` will be used to synthesize // a concrete ARN with the resource's physical name. Make sure to reference // `this.physicalName` in `arnComponents`. GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string // Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`). // // Normally, this token will resolve to `nameAttr`, but if the resource is // referenced across environments, it will be resolved to `this.physicalName`, // which will be a concrete name. GetResourceNameAttribute(nameAttr *string) *string // Returns a string representation of this construct. ToString() *string }
IAM OIDC identity providers are entities in IAM that describe an external identity provider (IdP) service that supports the OpenID Connect (OIDC) standard, such as Google or Salesforce.
You use an IAM OIDC identity provider when you want to establish trust between an OIDC-compatible IdP and your AWS account. This is useful when creating a mobile app or web application that requires access to AWS resources, but you don't want to create custom sign-in code or manage your own user identities.
Example:
provider := iam.NewOpenIdConnectProvider(this, jsii.String("MyProvider"), &OpenIdConnectProviderProps{ Url: jsii.String("https://openid/connect"), ClientIds: []*string{ jsii.String("myclient1"), jsii.String("myclient2"), }, })
See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html
func NewOpenIdConnectProvider ¶
func NewOpenIdConnectProvider(scope constructs.Construct, id *string, props *OpenIdConnectProviderProps) OpenIdConnectProvider
Defines an OpenID Connect provider.
type OpenIdConnectProviderProps ¶
type OpenIdConnectProviderProps struct { // The URL of the identity provider. // // The URL must begin with https:// and // should correspond to the iss claim in the provider's OpenID Connect ID // tokens. Per the OIDC standard, path components are allowed but query // parameters are not. Typically the URL consists of only a hostname, like // https://server.example.org or https://example.com. // // You cannot register the same provider multiple times in a single AWS // account. If you try to submit a URL that has already been used for an // OpenID Connect provider in the AWS account, you will get an error. Url *string `field:"required" json:"url" yaml:"url"` // A list of client IDs (also known as audiences). // // When a mobile or web app // registers with an OpenID Connect provider, they establish a value that // identifies the application. (This is the value that's sent as the client_id // parameter on OAuth requests.) // // You can register multiple client IDs with the same provider. For example, // you might have multiple applications that use the same OIDC provider. You // cannot register more than 100 client IDs with a single IAM OIDC provider. // // Client IDs are up to 255 characters long. // Default: - no clients are allowed. // ClientIds *[]*string `field:"optional" json:"clientIds" yaml:"clientIds"` // A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificates. // // Typically this list includes only one entry. However, IAM lets you have up // to five thumbprints for an OIDC provider. This lets you maintain multiple // thumbprints if the identity provider is rotating certificates. // // The server certificate thumbprint is the hex-encoded SHA-1 hash value of // the X.509 certificate used by the domain where the OpenID Connect provider // makes its keys available. It is always a 40-character string. // // You must provide at least one thumbprint when creating an IAM OIDC // provider. For example, assume that the OIDC provider is server.example.com // and the provider stores its keys at // https://keys.server.example.com/openid-connect. In that case, the // thumbprint string would be the hex-encoded SHA-1 hash value of the // certificate used by https://keys.server.example.com. // Default: - If no thumbprints are specified (an empty array or `undefined`), // the thumbprint of the root certificate authority will be obtained from the // provider's server as described in https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html // Thumbprints *[]*string `field:"optional" json:"thumbprints" yaml:"thumbprints"` }
Initialization properties for `OpenIdConnectProvider`.
Example:
provider := iam.NewOpenIdConnectProvider(this, jsii.String("MyProvider"), &OpenIdConnectProviderProps{ Url: jsii.String("https://openid/connect"), ClientIds: []*string{ jsii.String("myclient1"), jsii.String("myclient2"), }, })
type OrganizationPrincipal ¶
type OrganizationPrincipal interface { PrincipalBase // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // The unique identifier (ID) of an organization (i.e. o-12345abcde). OrganizationId() *string // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
A principal that represents an AWS Organization.
Example:
// Grant permissions to an entire AWS organization var fn function org := iam.NewOrganizationPrincipal(jsii.String("o-xxxxxxxxxx")) fn.GrantInvoke(org)
func NewOrganizationPrincipal ¶
func NewOrganizationPrincipal(organizationId *string) OrganizationPrincipal
type PermissionsBoundary ¶
type PermissionsBoundary interface { // Apply the given policy as Permissions Boundary to all Roles and Users in the scope. // // Will override any Permissions Boundaries configured previously; in case // a Permission Boundary is applied in multiple scopes, the Boundary applied // closest to the Role wins. Apply(boundaryPolicy IManagedPolicy) // Remove previously applied Permissions Boundaries. Clear() }
Modify the Permissions Boundaries of Users and Roles in a construct tree.
```ts const policy = iam.ManagedPolicy.fromAwsManagedPolicyName('ReadOnlyAccess'); iam.PermissionsBoundary.of(this).apply(policy); ```.
Example:
var project project iam.PermissionsBoundary_Of(project).Apply(codebuild.NewUntrustedCodeBoundaryPolicy(this, jsii.String("Boundary")))
func PermissionsBoundary_Of ¶
func PermissionsBoundary_Of(scope constructs.IConstruct) PermissionsBoundary
Access the Permissions Boundaries of a construct tree.
type Policy ¶
type Policy interface { awscdk.Resource IGrantable IPolicy // The policy document. Document() PolicyDocument // The environment this resource belongs to. // // For resources that are created and managed by the CDK // (generally, those created by creating new class instances like Role, Bucket, etc.), // this is always the same as the environment of the stack they belong to; // however, for imported resources // (those obtained from static methods like fromRoleArn, fromBucketName, etc.), // that might be different than the stack they were imported into. Env() *awscdk.ResourceEnvironment // The principal to grant permissions to. GrantPrincipal() IPrincipal // The tree node. Node() constructs.Node // Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource. // // This value will resolve to one of the following: // - a concrete value (e.g. `"my-awesome-bucket"`) // - `undefined`, when a name should be generated by CloudFormation // - a concrete name generated automatically during synthesis, in // cross-environment scenarios. PhysicalName() *string // The name of this policy. PolicyName() *string // The stack in which this resource is defined. Stack() awscdk.Stack // Adds a statement to the policy document. AddStatements(statement ...PolicyStatement) // Apply the given removal policy to this resource. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). ApplyRemovalPolicy(policy awscdk.RemovalPolicy) // Attaches this policy to a group. AttachToGroup(group IGroup) // Attaches this policy to a role. AttachToRole(role IRole) // Attaches this policy to a user. AttachToUser(user IUser) GeneratePhysicalName() *string // Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`). // // Normally, this token will resolve to `arnAttr`, but if the resource is // referenced across environments, `arnComponents` will be used to synthesize // a concrete ARN with the resource's physical name. Make sure to reference // `this.physicalName` in `arnComponents`. GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string // Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`). // // Normally, this token will resolve to `nameAttr`, but if the resource is // referenced across environments, it will be resolved to `this.physicalName`, // which will be a concrete name. GetResourceNameAttribute(nameAttr *string) *string // Returns a string representation of this construct. ToString() *string }
The AWS::IAM::Policy resource associates an IAM policy with IAM users, roles, or groups.
For more information about IAM policies, see [Overview of IAM Policies](http://docs.aws.amazon.com/IAM/latest/UserGuide/policies_overview.html) in the IAM User Guide guide.
Example:
var postAuthFn function userpool := cognito.NewUserPool(this, jsii.String("myuserpool"), &UserPoolProps{ LambdaTriggers: &UserPoolTriggers{ PostAuthentication: postAuthFn, }, }) // provide permissions to describe the user pool scoped to the ARN the user pool postAuthFn.Role.AttachInlinePolicy(iam.NewPolicy(this, jsii.String("userpool-policy"), &PolicyProps{ Statements: []policyStatement{ iam.NewPolicyStatement(&PolicyStatementProps{ Actions: []*string{ jsii.String("cognito-idp:DescribeUserPool"), }, Resources: []*string{ userpool.UserPoolArn, }, }), }, }))
func NewPolicy ¶
func NewPolicy(scope constructs.Construct, id *string, props *PolicyProps) Policy
type PolicyDocument ¶
type PolicyDocument interface { awscdk.IResolvable // The creation stack of this resolvable which will be appended to errors thrown during resolution. // // This may return an array with a single informational element indicating how // to get this property populated, if it was skipped for performance reasons. CreationStack() *[]*string // Whether the policy document contains any statements. IsEmpty() *bool // The number of statements already added to this policy. // // Can be used, for example, to generate unique "sid"s within the policy. StatementCount() *float64 // Adds a statement to the policy document. AddStatements(statement ...PolicyStatement) // Produce the Token's value at resolution time. Resolve(context awscdk.IResolveContext) interface{} // JSON-ify the document. // // Used when JSON.stringify() is called ToJSON() interface{} // Encode the policy document as a string. ToString() *string // Validate that all policy statements in the policy document satisfies the requirements for any policy. // // Returns: An array of validation error messages, or an empty array if the document is valid. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json // ValidateForAnyPolicy() *[]*string // Validate that all policy statements in the policy document satisfies the requirements for an identity-based policy. // // Returns: An array of validation error messages, or an empty array if the document is valid. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json // ValidateForIdentityPolicy() *[]*string // Validate that all policy statements in the policy document satisfies the requirements for a resource-based policy. // // Returns: An array of validation error messages, or an empty array if the document is valid. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json // ValidateForResourcePolicy() *[]*string }
A PolicyDocument is a collection of statements.
Example:
import "github.com/aws/aws-cdk-go/awscdk" myFileSystemPolicy := iam.NewPolicyDocument(&PolicyDocumentProps{ Statements: []policyStatement{ iam.NewPolicyStatement(&PolicyStatementProps{ Actions: []*string{ jsii.String("elasticfilesystem:ClientWrite"), jsii.String("elasticfilesystem:ClientMount"), }, Principals: []iPrincipal{ iam.NewAccountRootPrincipal(), }, Resources: []*string{ jsii.String("*"), }, Conditions: map[string]interface{}{ "Bool": map[string]*string{ "elasticfilesystem:AccessedViaMountTarget": jsii.String("true"), }, }, }), }, }) fileSystem := efs.NewFileSystem(this, jsii.String("MyEfsFileSystem"), &FileSystemProps{ Vpc: ec2.NewVpc(this, jsii.String("VPC")), FileSystemPolicy: myFileSystemPolicy, })
func NewPolicyDocument ¶
func NewPolicyDocument(props *PolicyDocumentProps) PolicyDocument
func PolicyDocument_FromJson ¶
func PolicyDocument_FromJson(obj interface{}) PolicyDocument
Creates a new PolicyDocument based on the object provided.
This will accept an object created from the `.toJSON()` call
type PolicyDocumentProps ¶
type PolicyDocumentProps struct { // Automatically assign Statement Ids to all statements. // Default: false. // AssignSids *bool `field:"optional" json:"assignSids" yaml:"assignSids"` // Try to minimize the policy by merging statements. // // To avoid overrunning the maximum policy size, combine statements if they produce // the same result. Merging happens according to the following rules: // // - The Effect of both statements is the same // - Neither of the statements have a 'Sid' // - Combine Principals if the rest of the statement is exactly the same. // - Combine Resources if the rest of the statement is exactly the same. // - Combine Actions if the rest of the statement is exactly the same. // - We will never combine NotPrincipals, NotResources or NotActions, because doing // so would change the meaning of the policy document. // Default: - false, unless the feature flag `@aws-cdk/aws-iam:minimizePolicies` is set. // Minimize *bool `field:"optional" json:"minimize" yaml:"minimize"` // Initial statements to add to the policy document. // Default: - No statements. // Statements *[]PolicyStatement `field:"optional" json:"statements" yaml:"statements"` }
Properties for a new PolicyDocument.
Example:
import "github.com/aws/aws-cdk-go/awscdk" myFileSystemPolicy := iam.NewPolicyDocument(&PolicyDocumentProps{ Statements: []policyStatement{ iam.NewPolicyStatement(&PolicyStatementProps{ Actions: []*string{ jsii.String("elasticfilesystem:ClientWrite"), jsii.String("elasticfilesystem:ClientMount"), }, Principals: []iPrincipal{ iam.NewAccountRootPrincipal(), }, Resources: []*string{ jsii.String("*"), }, Conditions: map[string]interface{}{ "Bool": map[string]*string{ "elasticfilesystem:AccessedViaMountTarget": jsii.String("true"), }, }, }), }, }) fileSystem := efs.NewFileSystem(this, jsii.String("MyEfsFileSystem"), &FileSystemProps{ Vpc: ec2.NewVpc(this, jsii.String("VPC")), FileSystemPolicy: myFileSystemPolicy, })
type PolicyProps ¶
type PolicyProps struct { // Initial PolicyDocument to use for this Policy. // // If omited, any // `PolicyStatement` provided in the `statements` property will be applied // against the empty default `PolicyDocument`. // Default: - An empty policy. // Document PolicyDocument `field:"optional" json:"document" yaml:"document"` // Force creation of an `AWS::IAM::Policy`. // // Unless set to `true`, this `Policy` construct will not materialize to an // `AWS::IAM::Policy` CloudFormation resource in case it would have no effect // (for example, if it remains unattached to an IAM identity or if it has no // statements). This is generally desired behavior, since it prevents // creating invalid--and hence undeployable--CloudFormation templates. // // In cases where you know the policy must be created and it is actually // an error if no statements have been added to it, you can set this to `true`. // Default: false. // Force *bool `field:"optional" json:"force" yaml:"force"` // Groups to attach this policy to. // // You can also use `attachToGroup(group)` to attach this policy to a group. // Default: - No groups. // Groups *[]IGroup `field:"optional" json:"groups" yaml:"groups"` // The name of the policy. // // If you specify multiple policies for an entity, // specify unique names. For example, if you specify a list of policies for // an IAM role, each policy must have a unique name. // Default: - Uses the logical ID of the policy resource, which is ensured // to be unique within the stack. // PolicyName *string `field:"optional" json:"policyName" yaml:"policyName"` // Roles to attach this policy to. // // You can also use `attachToRole(role)` to attach this policy to a role. // Default: - No roles. // Roles *[]IRole `field:"optional" json:"roles" yaml:"roles"` // Initial set of permissions to add to this policy document. // // You can also use `addStatements(...statement)` to add permissions later. // Default: - No statements. // Statements *[]PolicyStatement `field:"optional" json:"statements" yaml:"statements"` // Users to attach this policy to. // // You can also use `attachToUser(user)` to attach this policy to a user. // Default: - No users. // Users *[]IUser `field:"optional" json:"users" yaml:"users"` }
Properties for defining an IAM inline policy document.
Example:
var books resource var iamUser user getBooks := books.AddMethod(jsii.String("GET"), apigateway.NewHttpIntegration(jsii.String("http://amazon.com")), &MethodOptions{ AuthorizationType: apigateway.AuthorizationType_IAM, }) iamUser.AttachInlinePolicy(iam.NewPolicy(this, jsii.String("AllowBooks"), &PolicyProps{ Statements: []policyStatement{ iam.NewPolicyStatement(&PolicyStatementProps{ Actions: []*string{ jsii.String("execute-api:Invoke"), }, Effect: iam.Effect_ALLOW, Resources: []*string{ getBooks.methodArn, }, }), }, }))
type PolicyStatement ¶
type PolicyStatement interface { // The Actions added to this statement. Actions() *[]*string // The conditions added to this statement. Conditions() interface{} // Whether to allow or deny the actions in this statement Set effect for this statement. Effect() Effect SetEffect(val Effect) // Whether the PolicyStatement has been frozen. // // The statement object is frozen when `freeze()` is called. Frozen() *bool // Indicates if this permission has a "Principal" section. HasPrincipal() *bool // Indicates if this permission has at least one resource associated with it. HasResource() *bool // The NotActions added to this statement. NotActions() *[]*string // The NotPrincipals added to this statement. NotPrincipals() *[]IPrincipal // The NotResources added to this statement. NotResources() *[]*string // The Principals added to this statement. Principals() *[]IPrincipal // The Resources added to this statement. Resources() *[]*string // Statement ID for this statement Set Statement ID for this statement. Sid() *string SetSid(val *string) // Add a `StringEquals` condition that limits to a given account from `sts:ExternalId`. // // This method can only be called once: subsequent calls will overwrite earlier calls. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html // AddAccountCondition(accountId *string) // Adds an AWS account root user principal to this policy statement. AddAccountRootPrincipal() // Specify allowed actions into the "Action" section of the policy statement. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_action.html // AddActions(actions ...*string) // Adds a “"*"“ resource to this statement. AddAllResources() // Adds all identities in all accounts ("*") to this policy statement. AddAnyPrincipal() // Specify a principal using the ARN identifier of the principal. // // You cannot specify IAM groups and instance profiles as principals. AddArnPrincipal(arn *string) // Specify AWS account ID as the principal entity to the "Principal" section of a policy statement. AddAwsAccountPrincipal(accountId *string) // Adds a canonical user ID principal to this policy document. AddCanonicalUserPrincipal(canonicalUserId *string) // Add a condition to the Policy. // // If multiple calls are made to add a condition with the same operator and field, only // the last one wins. For example: // // “`ts // declare const stmt: iam.PolicyStatement; // // stmt.addCondition('StringEquals', { 'aws:SomeField': '1' }); // stmt.addCondition('StringEquals', { 'aws:SomeField': '2' }); // “` // // Will end up with the single condition `StringEquals: { 'aws:SomeField': '2' }`. // // If you meant to add a condition to say that the field can be *either* `1` or `2`, write // this: // // “`ts // declare const stmt: iam.PolicyStatement; // // stmt.addCondition('StringEquals', { 'aws:SomeField': ['1', '2'] }); // “`. AddCondition(key *string, value interface{}) // Add multiple conditions to the Policy. // // See the `addCondition` function for a caveat on calling this method multiple times. AddConditions(conditions *map[string]interface{}) // Adds a federated identity provider such as Amazon Cognito to this policy statement. AddFederatedPrincipal(federated interface{}, conditions *map[string]interface{}) // Explicitly allow all actions except the specified list of actions into the "NotAction" section of the policy document. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html // AddNotActions(notActions ...*string) // Specify principals that is not allowed or denied access to the "NotPrincipal" section of a policy statement. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notprincipal.html // AddNotPrincipals(notPrincipals ...IPrincipal) // Specify resources that this policy statement will not apply to in the "NotResource" section of this policy statement. // // All resources except the specified list will be matched. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notresource.html // AddNotResources(arns ...*string) // Adds principals to the "Principal" section of a policy statement. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html // AddPrincipals(principals ...IPrincipal) // Specify resources that this policy statement applies into the "Resource" section of this policy statement. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html // AddResources(arns ...*string) // Adds a service principal to this policy statement. AddServicePrincipal(service *string, opts *ServicePrincipalOpts) // Add an `StringEquals` condition that limits to a given account from `aws:SourceAccount`. // // This method can only be called once: subsequent calls will overwrite earlier calls. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceaccount // AddSourceAccountCondition(accountId *string) // Add an `ArnEquals` condition that limits to a given resource arn from `aws:SourceArn`. // // This method can only be called once: subsequent calls will overwrite earlier calls. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcearn // AddSourceArnCondition(arn *string) // Create a new `PolicyStatement` with the same exact properties as this one, except for the overrides. Copy(overrides *PolicyStatementProps) PolicyStatement // Make the PolicyStatement immutable. // // After calling this, any of the `addXxx()` methods will throw an exception. // // Libraries that lazily generate statement bodies can override this method to // fill the actual PolicyStatement fields. Be aware that this method may be called // multiple times. Freeze() PolicyStatement // JSON-ify the statement. // // Used when JSON.stringify() is called ToJSON() interface{} // JSON-ify the policy statement. // // Used when JSON.stringify() is called ToStatementJson() interface{} // String representation of this policy statement. ToString() *string // Validate that the policy statement satisfies base requirements for a policy. // // Returns: An array of validation error messages, or an empty array if the statement is valid. ValidateForAnyPolicy() *[]*string // Validate that the policy statement satisfies all requirements for an identity-based policy. // // Returns: An array of validation error messages, or an empty array if the statement is valid. ValidateForIdentityPolicy() *[]*string // Validate that the policy statement satisfies all requirements for a resource-based policy. // // Returns: An array of validation error messages, or an empty array if the statement is valid. ValidateForResourcePolicy() *[]*string }
Represents a statement in an IAM policy document.
Example:
crossAccountRoleArn := "arn:aws:iam::OTHERACCOUNT:role/CrossAccountRoleName" // arn of role deployed in separate account callRegion := "us-west-1" // sdk call to be made in specified region (optional) // sdk call to be made in specified region (optional) cr.NewAwsCustomResource(this, jsii.String("CrossAccount"), &AwsCustomResourceProps{ OnCreate: &AwsSdkCall{ AssumedRoleArn: crossAccountRoleArn, Region: callRegion, // optional Service: jsii.String("sts"), Action: jsii.String("GetCallerIdentity"), PhysicalResourceId: cr.PhysicalResourceId_Of(jsii.String("id")), }, Policy: cr.AwsCustomResourcePolicy_FromStatements([]policyStatement{ iam.*policyStatement_FromJson(map[string]*string{ "Effect": jsii.String("Allow"), "Action": jsii.String("sts:AssumeRole"), "Resource": crossAccountRoleArn, }), }), })
func NewPolicyStatement ¶
func NewPolicyStatement(props *PolicyStatementProps) PolicyStatement
func PolicyStatement_FromJson ¶
func PolicyStatement_FromJson(obj interface{}) PolicyStatement
Creates a new PolicyStatement based on the object provided.
This will accept an object created from the `.toJSON()` call
type PolicyStatementProps ¶
type PolicyStatementProps struct { // List of actions to add to the statement. // Default: - no actions. // Actions *[]*string `field:"optional" json:"actions" yaml:"actions"` // Conditions to add to the statement. // Default: - no condition. // Conditions *map[string]interface{} `field:"optional" json:"conditions" yaml:"conditions"` // Whether to allow or deny the actions in this statement. // Default: Effect.ALLOW // Effect Effect `field:"optional" json:"effect" yaml:"effect"` // List of not actions to add to the statement. // Default: - no not-actions. // NotActions *[]*string `field:"optional" json:"notActions" yaml:"notActions"` // List of not principals to add to the statement. // Default: - no not principals. // NotPrincipals *[]IPrincipal `field:"optional" json:"notPrincipals" yaml:"notPrincipals"` // NotResource ARNs to add to the statement. // Default: - no not-resources. // NotResources *[]*string `field:"optional" json:"notResources" yaml:"notResources"` // List of principals to add to the statement. // Default: - no principals. // Principals *[]IPrincipal `field:"optional" json:"principals" yaml:"principals"` // Resource ARNs to add to the statement. // Default: - no resources. // Resources *[]*string `field:"optional" json:"resources" yaml:"resources"` // The Sid (statement ID) is an optional identifier that you provide for the policy statement. // // You can assign a Sid value to each statement in a // statement array. In services that let you specify an ID element, such as // SQS and SNS, the Sid value is just a sub-ID of the policy document's ID. In // IAM, the Sid value must be unique within a JSON policy. // Default: - no sid. // Sid *string `field:"optional" json:"sid" yaml:"sid"` }
Interface for creating a policy statement.
Example:
// Add gateway endpoints when creating the VPC vpc := ec2.NewVpc(this, jsii.String("MyVpc"), &VpcProps{ GatewayEndpoints: map[string]gatewayVpcEndpointOptions{ "S3": &gatewayVpcEndpointOptions{ "service": ec2.GatewayVpcEndpointAwsService_S3(), }, }, }) // Alternatively gateway endpoints can be added on the VPC dynamoDbEndpoint := vpc.addGatewayEndpoint(jsii.String("DynamoDbEndpoint"), &gatewayVpcEndpointOptions{ Service: ec2.GatewayVpcEndpointAwsService_DYNAMODB(), }) // This allows to customize the endpoint policy dynamoDbEndpoint.AddToPolicy( iam.NewPolicyStatement(&PolicyStatementProps{ // Restrict to listing and describing tables Principals: []iPrincipal{ iam.NewAnyPrincipal(), }, Actions: []*string{ jsii.String("dynamodb:DescribeTable"), jsii.String("dynamodb:ListTables"), }, Resources: []*string{ jsii.String("*"), }, })) // Add an interface endpoint vpc.addInterfaceEndpoint(jsii.String("EcrDockerEndpoint"), &InterfaceVpcEndpointOptions{ Service: ec2.InterfaceVpcEndpointAwsService_ECR_DOCKER(), })
type PrincipalBase ¶
type PrincipalBase interface { IAssumeRolePrincipal IComparablePrincipal // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
Base class for policy principals.
Example:
tagParam := awscdk.NewCfnParameter(this, jsii.String("TagName")) stringEquals := awscdk.NewCfnJson(this, jsii.String("ConditionJson"), &CfnJsonProps{ Value: map[string]*bool{ fmt.Sprintf("aws:PrincipalTag/%v", tagParam.valueAsString): jsii.Boolean(true), }, }) principal := iam.NewAccountRootPrincipal().WithConditions(map[string]interface{}{ "StringEquals": stringEquals, }) iam.NewRole(this, jsii.String("MyRole"), &RoleProps{ AssumedBy: principal, })
type PrincipalPolicyFragment ¶
type PrincipalPolicyFragment interface { // The conditions under which the policy is in effect. // // See [the IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html). // conditions that need to be applied to this policy. Conditions() *map[string]interface{} // JSON of the "Principal" section in a policy statement. PrincipalJson() *map[string]*[]*string }
A collection of the fields in a PolicyStatement that can be used to identify a principal.
This consists of the JSON used in the "Principal" field, and optionally a set of "Condition"s that need to be applied to the policy.
Generally, a principal looks like:
{ '<TYPE>': ['ID', 'ID', ...] }
And this is also the type of the field `principalJson`. However, there is a special type of principal that is just the string '*', which is treated differently by some services. To represent that principal, `principalJson` should contain `{ 'LiteralString': ['*'] }`.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var conditions interface{} principalPolicyFragment := awscdk.Aws_iam.NewPrincipalPolicyFragment(map[string][]*string{ "principalJsonKey": []*string{ jsii.String("principalJson"), }, }, map[string]interface{}{ "conditionsKey": conditions, })
func NewPrincipalPolicyFragment ¶
func NewPrincipalPolicyFragment(principalJson *map[string]*[]*string, conditions *map[string]interface{}) PrincipalPolicyFragment
type PrincipalWithConditions ¶
type PrincipalWithConditions interface { PrincipalBase // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The conditions under which the policy is in effect. // // See [the IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html). Conditions() *map[string]interface{} // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add a condition to the principal. AddCondition(key *string, value interface{}) // Adds multiple conditions to the principal. // // Values from the conditions parameter will overwrite existing values with the same operator // and key. AddConditions(conditions *map[string]interface{}) // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(statement PolicyStatement) *AddToPrincipalPolicyResult // Append the given string to the wrapped principal's dedupe string (if available). AppendDedupe(append *string) *string // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
An IAM principal with additional conditions specifying when the policy is in effect.
For more information about conditions, see: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var conditions interface{} var principal iPrincipal principalWithConditions := awscdk.Aws_iam.NewPrincipalWithConditions(principal, map[string]interface{}{ "conditionsKey": conditions, })
func NewPrincipalWithConditions ¶
func NewPrincipalWithConditions(principal IPrincipal, conditions *map[string]interface{}) PrincipalWithConditions
type Role ¶
type Role interface { awscdk.Resource IRole // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The assume role policy document associated with this role. AssumeRolePolicy() PolicyDocument // The environment this resource belongs to. // // For resources that are created and managed by the CDK // (generally, those created by creating new class instances like Role, Bucket, etc.), // this is always the same as the environment of the stack they belong to; // however, for imported resources // (those obtained from static methods like fromRoleArn, fromBucketName, etc.), // that might be different than the stack they were imported into. Env() *awscdk.ResourceEnvironment // The principal to grant permissions to. GrantPrincipal() IPrincipal // The tree node. Node() constructs.Node // Returns the permissions boundary attached to this role. PermissionsBoundary() IManagedPolicy // Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource. // // This value will resolve to one of the following: // - a concrete value (e.g. `"my-awesome-bucket"`) // - `undefined`, when a name should be generated by CloudFormation // - a concrete name generated automatically during synthesis, in // cross-environment scenarios. PhysicalName() *string // Returns the role. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Returns the ARN of this role. RoleArn() *string // Returns the stable and unique string identifying the role. // // For example, // AIDAJQABLZS4A3QDU576Q. RoleId() *string // Returns the name of the role. RoleName() *string // The stack in which this resource is defined. Stack() awscdk.Stack // Attaches a managed policy to this role. AddManagedPolicy(policy IManagedPolicy) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Adds a permission to the role's default policy document. // // If there is no default policy attached to this role, it will be created. AddToPrincipalPolicy(statement PolicyStatement) *AddToPrincipalPolicyResult // Apply the given removal policy to this resource. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). ApplyRemovalPolicy(policy awscdk.RemovalPolicy) // Attaches a policy to this role. AttachInlinePolicy(policy Policy) GeneratePhysicalName() *string // Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`). // // Normally, this token will resolve to `arnAttr`, but if the resource is // referenced across environments, `arnComponents` will be used to synthesize // a concrete ARN with the resource's physical name. Make sure to reference // `this.physicalName` in `arnComponents`. GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string // Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`). // // Normally, this token will resolve to `nameAttr`, but if the resource is // referenced across environments, it will be resolved to `this.physicalName`, // which will be a concrete name. GetResourceNameAttribute(nameAttr *string) *string // Grant the actions defined in actions to the identity Principal on this resource. Grant(grantee IPrincipal, actions ...*string) Grant // Grant permissions to the given principal to assume this role. GrantAssumeRole(identity IPrincipal) Grant // Grant permissions to the given principal to pass this role. GrantPassRole(identity IPrincipal) Grant // Returns a string representation of this construct. ToString() *string // Return a copy of this Role object whose Policies will not be updated. // // Use the object returned by this method if you want this Role to be used by // a construct without it automatically updating the Role's Policies. // // If you do, you are responsible for adding the correct statements to the // Role's policies yourself. WithoutPolicyUpdates(options *WithoutPolicyUpdatesOptions) IRole }
IAM Role.
Defines an IAM role. The role is created with an assume policy document associated with the specified AWS service principal defined in `serviceAssumeRole`.
Example:
lambdaRole := iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewServicePrincipal(jsii.String("lambda.amazonaws.com")), Description: jsii.String("Example role..."), }) stream := kinesis.NewStream(this, jsii.String("MyEncryptedStream"), &StreamProps{ Encryption: kinesis.StreamEncryption_KMS, }) // give lambda permissions to read stream stream.grantRead(lambdaRole)
type RoleProps ¶
type RoleProps struct { // The IAM principal (i.e. `new ServicePrincipal('sns.amazonaws.com')`) which can assume this role. // // You can later modify the assume role policy document by accessing it via // the `assumeRolePolicy` property. AssumedBy IPrincipal `field:"required" json:"assumedBy" yaml:"assumedBy"` // A description of the role. // // It can be up to 1000 characters long. // Default: - No description. // Description *string `field:"optional" json:"description" yaml:"description"` // List of IDs that the role assumer needs to provide one of when assuming this role. // // If the configured and provided external IDs do not match, the // AssumeRole operation will fail. // Default: No external ID required. // ExternalIds *[]*string `field:"optional" json:"externalIds" yaml:"externalIds"` // A list of named policies to inline into this role. // // These policies will be // created with the role, whereas those added by “addToPolicy“ are added // using a separate CloudFormation resource (allowing a way around circular // dependencies that could otherwise be introduced). // Default: - No policy is inlined in the Role resource. // InlinePolicies *map[string]PolicyDocument `field:"optional" json:"inlinePolicies" yaml:"inlinePolicies"` // A list of managed policies associated with this role. // // You can add managed policies later using // `addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName(policyName))`. // Default: - No managed policies. // ManagedPolicies *[]IManagedPolicy `field:"optional" json:"managedPolicies" yaml:"managedPolicies"` // The maximum session duration that you want to set for the specified role. // // This setting can have a value from 1 hour (3600sec) to 12 (43200sec) hours. // // Anyone who assumes the role from the AWS CLI or API can use the // DurationSeconds API parameter or the duration-seconds CLI parameter to // request a longer session. The MaxSessionDuration setting determines the // maximum duration that can be requested using the DurationSeconds // parameter. // // If users don't specify a value for the DurationSeconds parameter, their // security credentials are valid for one hour by default. This applies when // you use the AssumeRole* API operations or the assume-role* CLI operations // but does not apply when you use those operations to create a console URL. // Default: Duration.hours(1) // MaxSessionDuration awscdk.Duration `field:"optional" json:"maxSessionDuration" yaml:"maxSessionDuration"` // The path associated with this role. // // For information about IAM paths, see // Friendly Names and Paths in IAM User Guide. // Default: /. // Path *string `field:"optional" json:"path" yaml:"path"` // AWS supports permissions boundaries for IAM entities (users or roles). // // A permissions boundary is an advanced feature for using a managed policy // to set the maximum permissions that an identity-based policy can grant to // an IAM entity. An entity's permissions boundary allows it to perform only // the actions that are allowed by both its identity-based policies and its // permissions boundaries. // Default: - No permissions boundary. // PermissionsBoundary IManagedPolicy `field:"optional" json:"permissionsBoundary" yaml:"permissionsBoundary"` // A name for the IAM role. // // For valid values, see the RoleName parameter for // the CreateRole action in the IAM API Reference. // // IMPORTANT: If you specify a name, you cannot perform updates that require // replacement of this resource. You can perform updates that require no or // some interruption. If you must replace the resource, specify a new name. // // If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to // acknowledge your template's capabilities. For more information, see // Acknowledging IAM Resources in AWS CloudFormation Templates. // Default: - AWS CloudFormation generates a unique physical ID and uses that ID // for the role name. // RoleName *string `field:"optional" json:"roleName" yaml:"roleName"` }
Properties for defining an IAM Role.
Example:
lambdaRole := iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewServicePrincipal(jsii.String("lambda.amazonaws.com")), Description: jsii.String("Example role..."), }) stream := kinesis.NewStream(this, jsii.String("MyEncryptedStream"), &StreamProps{ Encryption: kinesis.StreamEncryption_KMS, }) // give lambda permissions to read stream stream.grantRead(lambdaRole)
type SamlConsolePrincipal ¶
type SamlConsolePrincipal interface { SamlPrincipal // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The conditions under which the policy is in effect. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html // Conditions() *map[string]interface{} // federated identity provider (i.e. 'cognito-identity.amazonaws.com' for users authenticated through Cognito). Federated() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
Principal entity that represents a SAML federated identity provider for programmatic and AWS Management Console access.
Example:
provider := iam.NewSamlProvider(this, jsii.String("Provider"), &SamlProviderProps{ MetadataDocument: iam.SamlMetadataDocument_FromFile(jsii.String("/path/to/saml-metadata-document.xml")), }) iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewSamlConsolePrincipal(provider), })
func NewSamlConsolePrincipal ¶
func NewSamlConsolePrincipal(samlProvider ISamlProvider, conditions *map[string]interface{}) SamlConsolePrincipal
type SamlMetadataDocument ¶
type SamlMetadataDocument interface { // The XML content of the metadata document. Xml() *string }
A SAML metadata document.
Example:
provider := iam.NewSamlProvider(this, jsii.String("Provider"), &SamlProviderProps{ MetadataDocument: iam.SamlMetadataDocument_FromFile(jsii.String("/path/to/saml-metadata-document.xml")), }) principal := iam.NewSamlPrincipal(provider, map[string]interface{}{ "StringEquals": map[string]*string{ "SAML:iss": jsii.String("issuer"), }, })
func SamlMetadataDocument_FromFile ¶
func SamlMetadataDocument_FromFile(path *string) SamlMetadataDocument
Create a SAML metadata document from a XML file.
func SamlMetadataDocument_FromXml ¶
func SamlMetadataDocument_FromXml(xml *string) SamlMetadataDocument
Create a SAML metadata document from a XML string.
type SamlPrincipal ¶
type SamlPrincipal interface { FederatedPrincipal // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The conditions under which the policy is in effect. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html // Conditions() *map[string]interface{} // federated identity provider (i.e. 'cognito-identity.amazonaws.com' for users authenticated through Cognito). Federated() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
Principal entity that represents a SAML federated identity provider.
Example:
provider := iam.NewSamlProvider(this, jsii.String("Provider"), &SamlProviderProps{ MetadataDocument: iam.SamlMetadataDocument_FromFile(jsii.String("/path/to/saml-metadata-document.xml")), }) principal := iam.NewSamlPrincipal(provider, map[string]interface{}{ "StringEquals": map[string]*string{ "SAML:iss": jsii.String("issuer"), }, })
func NewSamlPrincipal ¶
func NewSamlPrincipal(samlProvider ISamlProvider, conditions *map[string]interface{}) SamlPrincipal
type SamlProvider ¶
type SamlProvider interface { awscdk.Resource ISamlProvider // The environment this resource belongs to. // // For resources that are created and managed by the CDK // (generally, those created by creating new class instances like Role, Bucket, etc.), // this is always the same as the environment of the stack they belong to; // however, for imported resources // (those obtained from static methods like fromRoleArn, fromBucketName, etc.), // that might be different than the stack they were imported into. Env() *awscdk.ResourceEnvironment // The tree node. Node() constructs.Node // Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource. // // This value will resolve to one of the following: // - a concrete value (e.g. `"my-awesome-bucket"`) // - `undefined`, when a name should be generated by CloudFormation // - a concrete name generated automatically during synthesis, in // cross-environment scenarios. PhysicalName() *string // The Amazon Resource Name (ARN) of the provider. SamlProviderArn() *string // The stack in which this resource is defined. Stack() awscdk.Stack // Apply the given removal policy to this resource. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). ApplyRemovalPolicy(policy awscdk.RemovalPolicy) GeneratePhysicalName() *string // Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`). // // Normally, this token will resolve to `arnAttr`, but if the resource is // referenced across environments, `arnComponents` will be used to synthesize // a concrete ARN with the resource's physical name. Make sure to reference // `this.physicalName` in `arnComponents`. GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string // Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`). // // Normally, this token will resolve to `nameAttr`, but if the resource is // referenced across environments, it will be resolved to `this.physicalName`, // which will be a concrete name. GetResourceNameAttribute(nameAttr *string) *string // Returns a string representation of this construct. ToString() *string }
A SAML provider.
Example:
provider := iam.NewSamlProvider(this, jsii.String("Provider"), &SamlProviderProps{ MetadataDocument: iam.SamlMetadataDocument_FromFile(jsii.String("/path/to/saml-metadata-document.xml")), }) iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewSamlConsolePrincipal(provider), })
func NewSamlProvider ¶
func NewSamlProvider(scope constructs.Construct, id *string, props *SamlProviderProps) SamlProvider
type SamlProviderProps ¶
type SamlProviderProps struct { // An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your organization's IdP. MetadataDocument SamlMetadataDocument `field:"required" json:"metadataDocument" yaml:"metadataDocument"` // The name of the provider to create. // // This parameter allows a string of characters consisting of upper and // lowercase alphanumeric characters with no spaces. You can also include // any of the following characters: _+=,.@- // // Length must be between 1 and 128 characters. // Default: - a CloudFormation generated name. // Name *string `field:"optional" json:"name" yaml:"name"` }
Properties for a SAML provider.
Example:
provider := iam.NewSamlProvider(this, jsii.String("Provider"), &SamlProviderProps{ MetadataDocument: iam.SamlMetadataDocument_FromFile(jsii.String("/path/to/saml-metadata-document.xml")), }) iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewSamlConsolePrincipal(provider), })
type ServicePrincipal ¶
type ServicePrincipal interface { PrincipalBase // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // AWS service (i.e. sqs.amazonaws.com). Service() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
An IAM principal that represents an AWS service (i.e. `sqs.amazonaws.com`).
Example:
lambdaRole := iam.NewRole(this, jsii.String("Role"), &RoleProps{ AssumedBy: iam.NewServicePrincipal(jsii.String("lambda.amazonaws.com")), Description: jsii.String("Example role..."), }) stream := kinesis.NewStream(this, jsii.String("MyEncryptedStream"), &StreamProps{ Encryption: kinesis.StreamEncryption_KMS, }) // give lambda permissions to read stream stream.grantRead(lambdaRole)
func NewServicePrincipal ¶
func NewServicePrincipal(service *string, opts *ServicePrincipalOpts) ServicePrincipal
Reference an AWS service, optionally in a given region.
type ServicePrincipalOpts ¶
type ServicePrincipalOpts struct { // Additional conditions to add to the Service Principal. // Default: - No conditions. // Conditions *map[string]interface{} `field:"optional" json:"conditions" yaml:"conditions"` // The region in which you want to reference the service. // // This is only necessary for *cross-region* references to *opt-in* regions. In those // cases, the region name needs to be included to reference the correct service principal. // In all other cases, the global service principal name is sufficient. // // This field behaves differently depending on whether the `@aws-cdk/aws-iam:standardizedServicePrincipals` // flag is set or not: // // - If the flag is set, the input service principal is assumed to be of the form `SERVICE.amazonaws.com`. // That value will always be returned, unless the given region is an opt-in region and the service // principal is rendered in a stack in a different region, in which case `SERVICE.REGION.amazonaws.com` // will be rendered. Under this regime, there is no downside to always specifying the region property: // it will be rendered only if necessary. // - If the flag is not set, the service principal will resolve to a single principal // whose name comes from the `@aws-cdk/region-info` package, using the region to override // the stack region. If there is no entry for this service principal in the database,, the input // service name is returned literally. This is legacy behavior and is not recommended. // Default: - the resolving Stack's region. // Region *string `field:"optional" json:"region" yaml:"region"` }
Options for a service principal.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var conditions interface{} servicePrincipalOpts := &ServicePrincipalOpts{ Conditions: map[string]interface{}{ "conditionsKey": conditions, }, Region: jsii.String("region"), }
type SessionTagsPrincipal ¶ added in v2.4.0
type SessionTagsPrincipal interface { PrincipalBase // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(doc PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(statement PolicyStatement) *AddToPrincipalPolicyResult // Append the given string to the wrapped principal's dedupe string (if available). AppendDedupe(append *string) *string // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
Enables session tags on role assumptions from a principal.
For more information on session tags, see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" var principal iPrincipal sessionTagsPrincipal := awscdk.Aws_iam.NewSessionTagsPrincipal(principal)
func NewSessionTagsPrincipal ¶ added in v2.4.0
func NewSessionTagsPrincipal(principal IPrincipal) SessionTagsPrincipal
type StarPrincipal ¶
type StarPrincipal interface { PrincipalBase // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
A principal that uses a literal '*' in the IAM JSON language.
Some services behave differently when you specify `Principal: "*"` or `Principal: { AWS: "*" }` in their resource policy.
`StarPrincipal` renders to `Principal: *`. Most of the time, you should use `AnyPrincipal` instead.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" starPrincipal := awscdk.Aws_iam.NewStarPrincipal()
func NewStarPrincipal ¶
func NewStarPrincipal() StarPrincipal
type UnknownPrincipal ¶
type UnknownPrincipal interface { IPrincipal // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(statement PolicyStatement) *AddToPrincipalPolicyResult }
A principal for use in resources that need to have a role but it's unknown.
Some resources have roles associated with them which they assume, such as Lambda Functions, CodeBuild projects, StepFunctions machines, etc.
When those resources are imported, their actual roles are not always imported with them. When that happens, we use an instance of this class instead, which will add user warnings when statements are attempted to be added to it.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" import constructs "github.com/aws/constructs-go/constructs" var construct construct unknownPrincipal := awscdk.Aws_iam.NewUnknownPrincipal(&UnknownPrincipalProps{ Resource: construct, })
func NewUnknownPrincipal ¶
func NewUnknownPrincipal(props *UnknownPrincipalProps) UnknownPrincipal
type UnknownPrincipalProps ¶
type UnknownPrincipalProps struct {
// The resource the role proxy is for.
Resource constructs.IConstruct `field:"required" json:"resource" yaml:"resource"`
}
Properties for an UnknownPrincipal.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" import constructs "github.com/aws/constructs-go/constructs" var construct construct unknownPrincipalProps := &UnknownPrincipalProps{ Resource: construct, }
type User ¶
type User interface { awscdk.Resource IIdentity IUser // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The environment this resource belongs to. // // For resources that are created and managed by the CDK // (generally, those created by creating new class instances like Role, Bucket, etc.), // this is always the same as the environment of the stack they belong to; // however, for imported resources // (those obtained from static methods like fromRoleArn, fromBucketName, etc.), // that might be different than the stack they were imported into. Env() *awscdk.ResourceEnvironment // The principal to grant permissions to. GrantPrincipal() IPrincipal // The tree node. Node() constructs.Node // Returns the permissions boundary attached to this user. PermissionsBoundary() IManagedPolicy // Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource. // // This value will resolve to one of the following: // - a concrete value (e.g. `"my-awesome-bucket"`) // - `undefined`, when a name should be generated by CloudFormation // - a concrete name generated automatically during synthesis, in // cross-environment scenarios. PhysicalName() *string // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // The stack in which this resource is defined. Stack() awscdk.Stack // An attribute that represents the user's ARN. UserArn() *string // An attribute that represents the user name. UserName() *string // Attaches a managed policy to the user. AddManagedPolicy(policy IManagedPolicy) // Adds this user to a group. AddToGroup(group IGroup) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Adds an IAM statement to the default policy. // // Returns: true. AddToPrincipalPolicy(statement PolicyStatement) *AddToPrincipalPolicyResult // Apply the given removal policy to this resource. // // The Removal Policy controls what happens to this resource when it stops // being managed by CloudFormation, either because you've removed it from the // CDK application or because you've made a change that requires the resource // to be replaced. // // The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS // account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). ApplyRemovalPolicy(policy awscdk.RemovalPolicy) // Attaches a policy to this user. AttachInlinePolicy(policy Policy) GeneratePhysicalName() *string // Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`). // // Normally, this token will resolve to `arnAttr`, but if the resource is // referenced across environments, `arnComponents` will be used to synthesize // a concrete ARN with the resource's physical name. Make sure to reference // `this.physicalName` in `arnComponents`. GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string // Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`). // // Normally, this token will resolve to `nameAttr`, but if the resource is // referenced across environments, it will be resolved to `this.physicalName`, // which will be a concrete name. GetResourceNameAttribute(nameAttr *string) *string // Returns a string representation of this construct. ToString() *string }
Define a new IAM user.
Example:
var definition iChainable user := iam.NewUser(this, jsii.String("MyUser")) stateMachine := sfn.NewStateMachine(this, jsii.String("StateMachine"), &StateMachineProps{ DefinitionBody: sfn.DefinitionBody_FromChainable(definition), }) //give user permission to send task success to the state machine stateMachine.grant(user, jsii.String("states:SendTaskSuccess"))
type UserAttributes ¶
type UserAttributes struct { // The ARN of the user. // // Format: arn:<partition>:iam::<account-id>:user/<user-name-with-path>. UserArn *string `field:"required" json:"userArn" yaml:"userArn"` }
Represents a user defined outside of this stack.
Example:
user := iam.User_FromUserAttributes(this, jsii.String("MyImportedUserByAttributes"), &UserAttributes{ UserArn: jsii.String("arn:aws:iam::123456789012:user/johnsmith"), })
type UserProps ¶
type UserProps struct { // Groups to add this user to. // // You can also use `addToGroup` to add this // user to a group. // Default: - No groups. // Groups *[]IGroup `field:"optional" json:"groups" yaml:"groups"` // A list of managed policies associated with this role. // // You can add managed policies later using // `addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName(policyName))`. // Default: - No managed policies. // ManagedPolicies *[]IManagedPolicy `field:"optional" json:"managedPolicies" yaml:"managedPolicies"` // The password for the user. This is required so the user can access the AWS Management Console. // // You can use `SecretValue.unsafePlainText` to specify a password in plain text or // use `secretsmanager.Secret.fromSecretAttributes` to reference a secret in // Secrets Manager. // Default: - User won't be able to access the management console without a password. // Password awscdk.SecretValue `field:"optional" json:"password" yaml:"password"` // Specifies whether the user is required to set a new password the next time the user logs in to the AWS Management Console. // // If this is set to 'true', you must also specify "initialPassword". // Default: false. // PasswordResetRequired *bool `field:"optional" json:"passwordResetRequired" yaml:"passwordResetRequired"` // The path for the user name. // // For more information about paths, see IAM // Identifiers in the IAM User Guide. // Default: /. // Path *string `field:"optional" json:"path" yaml:"path"` // AWS supports permissions boundaries for IAM entities (users or roles). // // A permissions boundary is an advanced feature for using a managed policy // to set the maximum permissions that an identity-based policy can grant to // an IAM entity. An entity's permissions boundary allows it to perform only // the actions that are allowed by both its identity-based policies and its // permissions boundaries. // Default: - No permissions boundary. // PermissionsBoundary IManagedPolicy `field:"optional" json:"permissionsBoundary" yaml:"permissionsBoundary"` // A name for the IAM user. // // For valid values, see the UserName parameter for // the CreateUser action in the IAM API Reference. If you don't specify a // name, AWS CloudFormation generates a unique physical ID and uses that ID // for the user name. // // If you specify a name, you cannot perform updates that require // replacement of this resource. You can perform updates that require no or // some interruption. If you must replace the resource, specify a new name. // // If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to // acknowledge your template's capabilities. For more information, see // Acknowledging IAM Resources in AWS CloudFormation Templates. // Default: - Generated by CloudFormation (recommended). // UserName *string `field:"optional" json:"userName" yaml:"userName"` }
Properties for defining an IAM user.
Example:
user := awscdk.NewUser(this, jsii.String("MyUser"), &UserProps{ Password: awscdk.SecretValue_PlainText(jsii.String("1234")), }) group := awscdk.NewGroup(this, jsii.String("MyGroup")) policy := awscdk.NewPolicy(this, jsii.String("MyPolicy")) policy.AttachToUser(user) group.attachInlinePolicy(policy)
type WebIdentityPrincipal ¶
type WebIdentityPrincipal interface { FederatedPrincipal // When this Principal is used in an AssumeRole policy, the action to use. AssumeRoleAction() *string // The conditions under which the policy is in effect. // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html // Conditions() *map[string]interface{} // federated identity provider (i.e. 'cognito-identity.amazonaws.com' for users authenticated through Cognito). Federated() *string // The principal to grant permissions to. GrantPrincipal() IPrincipal // Return the policy fragment that identifies this principal in a Policy. PolicyFragment() PrincipalPolicyFragment // The AWS account ID of this principal. // // Can be undefined when the account is not known // (for example, for service principals). // Can be a Token - in that case, // it's assumed to be AWS::AccountId. PrincipalAccount() *string // Add the principal to the AssumeRolePolicyDocument. // // Add the statements to the AssumeRolePolicyDocument necessary to give this principal // permissions to assume the given role. AddToAssumeRolePolicy(document PolicyDocument) // Add to the policy of this principal. AddToPolicy(statement PolicyStatement) *bool // Add to the policy of this principal. AddToPrincipalPolicy(_statement PolicyStatement) *AddToPrincipalPolicyResult // Return whether or not this principal is equal to the given principal. DedupeString() *string // JSON-ify the principal. // // Used when JSON.stringify() is called ToJSON() *map[string]*[]*string // Returns a string representation of an object. ToString() *string // Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. // // When there is a value for the same operator and key in both the principal and the // conditions parameter, the value from the conditions parameter will be used. // // Returns: a new PrincipalWithConditions object. WithConditions(conditions *map[string]interface{}) PrincipalBase // Returns a new principal using this principal as the base, with session tags enabled. // // Returns: a new SessionTagsPrincipal object. WithSessionTags() PrincipalBase }
A principal that represents a federated identity provider as Web Identity such as Cognito, Amazon, Facebook, Google, etc.
Example:
principal := iam.NewWebIdentityPrincipal(jsii.String("cognito-identity.amazonaws.com"), map[string]interface{}{ "StringEquals": map[string]*string{ "cognito-identity.amazonaws.com:aud": jsii.String("us-east-2:12345678-abcd-abcd-abcd-123456"), }, "ForAnyValue:StringLike": map[string]*string{ "cognito-identity.amazonaws.com:amr": jsii.String("unauthenticated"), }, })
func NewWebIdentityPrincipal ¶
func NewWebIdentityPrincipal(identityProvider *string, conditions *map[string]interface{}) WebIdentityPrincipal
type WithoutPolicyUpdatesOptions ¶
type WithoutPolicyUpdatesOptions struct { // Add grants to resources instead of dropping them. // // If this is `false` or not specified, grant permissions added to this role are ignored. // It is your own responsibility to make sure the role has the required permissions. // // If this is `true`, any grant permissions will be added to the resource instead. // Default: false. // AddGrantsToResources *bool `field:"optional" json:"addGrantsToResources" yaml:"addGrantsToResources"` }
Options for the `withoutPolicyUpdates()` modifier of a Role.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import "github.com/aws/aws-cdk-go/awscdk" withoutPolicyUpdatesOptions := &WithoutPolicyUpdatesOptions{ AddGrantsToResources: jsii.Boolean(false), }
Source Files
¶
- AccessKey.go
- AccessKeyProps.go
- AccessKeyStatus.go
- AccessKey__checks.go
- AccountPrincipal.go
- AccountPrincipal__checks.go
- AccountRootPrincipal.go
- AccountRootPrincipal__checks.go
- AddToPrincipalPolicyResult.go
- AddToResourcePolicyResult.go
- AnyPrincipal.go
- AnyPrincipal__checks.go
- ArnPrincipal.go
- ArnPrincipal__checks.go
- CanonicalUserPrincipal.go
- CanonicalUserPrincipal__checks.go
- CfnAccessKey.go
- CfnAccessKeyProps.go
- CfnAccessKey__checks.go
- CfnGroup.go
- CfnGroupPolicy.go
- CfnGroupPolicyProps.go
- CfnGroupPolicy__checks.go
- CfnGroupProps.go
- CfnGroup_PolicyProperty.go
- CfnGroup__checks.go
- CfnInstanceProfile.go
- CfnInstanceProfileProps.go
- CfnInstanceProfile__checks.go
- CfnManagedPolicy.go
- CfnManagedPolicyProps.go
- CfnManagedPolicy__checks.go
- CfnOIDCProvider.go
- CfnOIDCProviderProps.go
- CfnOIDCProvider__checks.go
- CfnPolicy.go
- CfnPolicyProps.go
- CfnPolicy__checks.go
- CfnRole.go
- CfnRolePolicy.go
- CfnRolePolicyProps.go
- CfnRolePolicy__checks.go
- CfnRoleProps.go
- CfnRole_PolicyProperty.go
- CfnRole__checks.go
- CfnSAMLProvider.go
- CfnSAMLProviderProps.go
- CfnSAMLProvider__checks.go
- CfnServerCertificate.go
- CfnServerCertificateProps.go
- CfnServerCertificate__checks.go
- CfnServiceLinkedRole.go
- CfnServiceLinkedRoleProps.go
- CfnServiceLinkedRole__checks.go
- CfnUser.go
- CfnUserPolicy.go
- CfnUserPolicyProps.go
- CfnUserPolicy__checks.go
- CfnUserProps.go
- CfnUserToGroupAddition.go
- CfnUserToGroupAdditionProps.go
- CfnUserToGroupAddition__checks.go
- CfnUser_LoginProfileProperty.go
- CfnUser_PolicyProperty.go
- CfnUser__checks.go
- CfnVirtualMFADevice.go
- CfnVirtualMFADeviceProps.go
- CfnVirtualMFADevice__checks.go
- CommonGrantOptions.go
- ComparablePrincipal.go
- ComparablePrincipal__checks.go
- CompositeDependable.go
- CompositePrincipal.go
- CompositePrincipal__checks.go
- CustomizeRolesOptions.go
- Effect.go
- FederatedPrincipal.go
- FederatedPrincipal__checks.go
- FromRoleArnOptions.go
- FromRoleNameOptions.go
- Grant.go
- GrantOnPrincipalAndResourceOptions.go
- GrantOnPrincipalOptions.go
- GrantWithResourceOptions.go
- Grant__checks.go
- Group.go
- GroupProps.go
- Group__checks.go
- IAccessKey.go
- IAssumeRolePrincipal.go
- IAssumeRolePrincipal__checks.go
- IComparablePrincipal.go
- IGrantable.go
- IGroup.go
- IIdentity.go
- IIdentity__checks.go
- IInstanceProfile.go
- IManagedPolicy.go
- IOpenIdConnectProvider.go
- IPolicy.go
- IPrincipal.go
- IPrincipal__checks.go
- IResourceWithPolicy.go
- IResourceWithPolicy__checks.go
- IRole.go
- IRole__checks.go
- ISamlProvider.go
- IUser.go
- IUser__checks.go
- InstanceProfile.go
- InstanceProfileAttributes.go
- InstanceProfileProps.go
- InstanceProfile__checks.go
- LazyRole.go
- LazyRoleProps.go
- LazyRole__checks.go
- ManagedPolicy.go
- ManagedPolicyProps.go
- ManagedPolicy__checks.go
- OpenIdConnectPrincipal.go
- OpenIdConnectPrincipal__checks.go
- OpenIdConnectProvider.go
- OpenIdConnectProviderProps.go
- OpenIdConnectProvider__checks.go
- OrganizationPrincipal.go
- OrganizationPrincipal__checks.go
- PermissionsBoundary.go
- PermissionsBoundary__checks.go
- Policy.go
- PolicyDocument.go
- PolicyDocumentProps.go
- PolicyDocument__checks.go
- PolicyProps.go
- PolicyStatement.go
- PolicyStatementProps.go
- PolicyStatement__checks.go
- Policy__checks.go
- PrincipalBase.go
- PrincipalBase__checks.go
- PrincipalPolicyFragment.go
- PrincipalPolicyFragment__checks.go
- PrincipalWithConditions.go
- PrincipalWithConditions__checks.go
- Role.go
- RoleProps.go
- Role__checks.go
- SamlConsolePrincipal.go
- SamlConsolePrincipal__checks.go
- SamlMetadataDocument.go
- SamlMetadataDocument__checks.go
- SamlPrincipal.go
- SamlPrincipal__checks.go
- SamlProvider.go
- SamlProviderProps.go
- SamlProvider__checks.go
- ServicePrincipal.go
- ServicePrincipalOpts.go
- ServicePrincipal__checks.go
- SessionTagsPrincipal.go
- SessionTagsPrincipal__checks.go
- StarPrincipal.go
- StarPrincipal__checks.go
- UnknownPrincipal.go
- UnknownPrincipalProps.go
- UnknownPrincipal__checks.go
- User.go
- UserAttributes.go
- UserProps.go
- User__checks.go
- WebIdentityPrincipal.go
- WebIdentityPrincipal__checks.go
- WithoutPolicyUpdatesOptions.go
- main.go