AwsAccountDefaultsPulumiDeploymentRoleArgs

interface AwsAccountDefaultsPulumiDeploymentRoleArgs {
additionalTrustPolicyStatementsTemplate?: AwsAccountDefaultsTrustPolicyStatementsTemplateArgs;
enabled?: boolean;
policyDocument: AwsAccountDefaultsRolePolicyTemplateArgs;
}

Capability arguments for creating the default deployment role for Pulumi deployment contexts.

Remarks

The default CodeBuild trust statement is restricted to projects in the provider's current AWS account and region through aws:SourceAccount and aws:SourceArn conditions.

Example

CODE

new AwsAccountDefaults({
  identity: 'account-defaults',
  pulumiDeploymentRole: {
    policyDocument: {
      path: 'policies/pulumi-deployment-default.json',
    },
  },
});

Properties

`additionalTrustPolicyStatementsTemplate: AwsAccountDefaultsTrustPolicyStatementsTemplateArgs`

Optional JSON template containing additional trust-policy statements merged with the default CodeBuild trust statement.

Remarks

The template can contain either a single statement object, or an array of statement objects. Rendered statements are appended after the default CodeBuild trust statement. Consumers own the principals and confused-deputy conditions in these additional statements.

Example

CODE

additionalTrustPolicyStatementsTemplate: {
  path: 'policies/pulumi-deployment-extra-trust-statement.json',
}

`enabled: boolean`

Enables the default Pulumi deployment role. Defaults to true when this block is set.

`policyDocument: AwsAccountDefaultsRolePolicyTemplateArgs`

Path and optional variables for rendering the inline role policy document template.