AwsIamRoleResourceArgs

interface AwsIamRoleResourceArgs extends Omit<aws.iam.RoleArgs, 'assumeRolePolicy' | 'name' | 'namePrefix'> {
assumeRolePolicy: AwsIamRoleAssumeRolePolicyInput;
description?: Input<string | undefined>;
forceDetachPolicies?: Input<boolean | undefined>;
inlinePolicies?: Input<Input<RoleInlinePolicy>[] | undefined>;
managedPolicyArns?: Input<Input<string>[] | undefined>;
maxSessionDuration?: Input<number | undefined>;
name: string;
path?: Input<string | undefined>;
permissionsBoundary?: Input<string | undefined>;
serviceCode: Input<IamRoleServiceCode>;
tags?: Input<{ [key: string]: Input<string> } | undefined>;
}

Input arguments for AwsIamRole.

Remarks

This type maps directly to aws.iam.RoleArgs with these changes:

name is required and treated as the role purpose in the AWS naming pattern.
serviceCode is required and must be an allowed iamRoleServiceCodes value from @jobcloud/pulumi-helpers; it is embedded as the serviceCode segment of the stackServicePurpose role name.
assumeRolePolicy accepts a JSON file/template, a controlled default service principal, or a resolved policy reference from AwsIamAssumeRolePolicy.

Example

CODE

import { iamAssumeRoleServicePrincipals, iamRoleServiceCodes } from '@jobcloud/pulumi-helpers';

const args: AwsIamRoleResourceArgs = {
  name: 'ecsTaskExecution',
  serviceCode: iamRoleServiceCodes.ecs,
  assumeRolePolicy: { servicePrincipal: iamAssumeRoleServicePrincipals.ec2 },
  description: 'EC2 application role',
};

Hierarchy

RoleArgs, "assumeRolePolicy" | "name" | "namePrefix">
AwsIamRoleResourceArgs

Properties

`assumeRolePolicy: AwsIamRoleAssumeRolePolicyInput`

Assume role policy input for the role.

`description: Input<string | undefined>`

Inherited from description

Description of the role.

`forceDetachPolicies: Input<boolean | undefined>`

Inherited from forceDetachPolicies

Whether to force detaching any policies the role has before destroying it. Defaults to false.

`inlinePolicies: Input<Input<RoleInlinePolicy>[] | undefined>`

Inherited from inlinePolicies

Configuration block defining an exclusive set of IAM inline policies associated with the IAM role. See below. If no blocks are configured, Pulumi will not manage any inline policies in this resource. Configuring one empty block (i.e., inlinePolicy {}) will cause Pulumi to remove all inline policies added out of band on apply.

`managedPolicyArns: Input<Input<string>[] | undefined>`

Inherited from managedPolicyArns

Set of exclusive IAM managed policy ARNs to attach to the IAM role. If this attribute is not configured, Pulumi will ignore policy attachments to this resource. When configured, Pulumi will align the role's managed policy attachments with this set by attaching or detaching managed policies. Configuring an empty set (i.e., managedPolicyArns = []) will cause Pulumi to remove all managed policy attachments.

`maxSessionDuration: Input<number | undefined>`

Inherited from maxSessionDuration

Maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.

`name: string`

Required role purpose name used in the AWS naming pattern. Must be a strict camelCase alphanumeric purpose.

`path: Input<string | undefined>`

Inherited from path

Path to the role. See IAM Identifiers for more information.

`permissionsBoundary: Input<string | undefined>`

Inherited from permissionsBoundary

ARN of the policy that is used to set the permissions boundary for the role.

`serviceCode: Input<IamRoleServiceCode>`

Required service code embedded as the serviceCode segment of the stackServicePurpose role name.

Remarks

Use a value from iamRoleServiceCodes exported by @jobcloud/pulumi-helpers (for example iamRoleServiceCodes.ecs or iamRoleServiceCodes.lambda). Plain strings are deliberately rejected by the type system; this is a hyphen-delimited segment of the AWS name and is validated fail-fast against the centralised set, never coerced.

`tags: Input<{ [key: string]: Input<string> } | undefined>`

Inherited from tags

Key-value mapping of tags for the IAM role. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.