AwsAccountDefaults

Service-level account defaults component for AWS account baseline capabilities.

Remarks

This is the single orchestrating component for account-level default behaviours, including optional default VPC cleanup, deployment IAM roles, regional Serverless Framework deployment-artifact buckets, Grafana access role, composed security groups, and a shared RDS/DocDB subnet group.

Naming:

• Root: type ${namespace}:aws:AwsAccountDefaults; capability account-defaults; logical-only raw identity args.identity; ${env}-${projectHash}-account-defaults-${sanitiseNamePart(args.identity)}. Punctuation-only values are rejected by the shared builder.
• Direct aws:iam/role:Role and aws:iam/rolePolicy:RolePolicy children use [args.identity, 'pulumiDeploymentRole' | 'serverlessDeploymentRole' | 'grafanaAccessRole'].
• The enabled serverlessDeploymentRole capability creates one direct pulumi:providers:aws child using [args.identity] and fixed us-east-1 region, plus one direct pulumi:providers:aws-native child per args.serverlessDeploymentRole.regions.<region>, using [args.identity, region]. These providers have only their region inputs and therefore use the ambient current AWS session; callers must not configure component providers for this capability. The classic provider owns the global IAM role and policy, while each native provider composes one AwsS3Bucket per region, with root capability s3 and raw identity serverlessDeployment<RegionCode> (for example serverlessDeploymentEuw1), producing ${env}-${projectHash}-s3-serverlessdeploymenteuw1. Each composed aws-native:s3:Bucket child uses [serverlessDeployment<RegionCode>]. Its S3 provider name uses stackAccountPurpose, ${env}-${projectHash}-${accountHash}-serverlessdeploymenteuw1, folding the compact lower-case region code into the globally unique bucket name. These private, ACL-less, AES256-encrypted buckets deny non-HTTPS requests and have versioning, lifecycle expiry, and intelligent tiering deliberately disabled. They support Serverless Framework deployments and are unrelated to AwsServerless.
• Direct pulumi-nodejs:dynamic:Resource default-VPC cleanup markers use [args.identity, args.defaultVpcCleanup.regions.<region>]. The keyed region is a raw AWS region identifier; it is forwarded unchanged to the dynamic provider, which does not own a provider name.
• Nested AwsAccountDefaultsDefaultSecurityGroup scope components are parented by AwsAccountDefaults and use the intentional target logical-name formula ${env}-${projectHash}-${sanitise(args.identity)}-${sanitise(presetKey)}-${sha1([vpcName]).slice(0, 6)}. Their readable anchor is args.identity then the preset key; their raw hash payload is args.defaultSecurityGroups.<vpcName>. The VPC Name tag often begins with the runtime prefix, so the hash avoids duplicating it while retaining each raw map key as a unique scope dimension. Each scope composes AwsSecurityGroup, which retains its established provider name from the fixed preset purpose. defaultSecurityGroups is a keyed record whose key is the VPC Name tag value.
• Direct aws:rds/subnetGroup:SubnetGroup uses [args.identity, args.rdsAndDocdbSubnetGroup.purpose]. Its provider name remains the lowercased stackAndPurpose result from raw args.rdsAndDocdbSubnetGroup.purpose; RDS owns validation for names up to 255 characters.
• Default security-group and shared RDS/DocDB subnet-group AWS names use the stackAndPurpose style ${env}-${projectHash}-${purpose}. VPC targeting remains part of Pulumi logical identity only and is not included in AWS security-group names.
• Exception: the pulumiDeploymentRole, serverlessDeploymentRole, and grafanaAccessRole IAM roles use fixed, unprefixed AWS names (pulumiDeployment, serverlessDeployment, and grafanaAccess); they are well-known integration roles referenced by external systems, so raw aws.iam.Role resources with fixed names are used deliberately. Intentional.
• Exception: the matching direct aws:iam/rolePolicy:RolePolicy children use the same fixed, unprefixed provider names (pulumiDeployment, serverlessDeployment, and grafanaAccess) as their owning roles. Intentional.

Example

const defaults = new AwsAccountDefaults(
  {
    identity: 'account-defaults',
    defaultVpcCleanup: {
      regions: { 'eu-west-1': {}, 'eu-central-1': {} },
    },
    pulumiDeploymentRole: {
      policyDocument: {
        path: 'policies/pulumi-deployment-default.json',
      },
    },
    serverlessDeploymentRole: {
      regions: { 'eu-central-1': {}, 'eu-west-1': {} },
      policyDocument: {
        path: 'policies/serverless-deployment-default.json',
      },
    },
    grafanaAccessRole: {
      trustPrincipalArns: [
        'arn:aws:iam::000000000000:role/roleA',
        'arn:aws:iam::000000000000:role/roleB',
      ],
      policyDocument: {
        path: 'policies/grafana-access-default.json',
      },
    },
    defaultSecurityGroups: {
      production: {},
      staging: {},
    },
  },
);

Constructors

new AwsAccountDefaults( args: AwsAccountDefaultsArgs, options?: ComponentResourceOptions, ): AwsAccountDefaults

Parameters

• args (AwsAccountDefaultsArgs) — Account defaults capability inputs.
• options (ComponentResourceOptions, optional) — Optional settings controlling resource behaviour.

Returns

AwsAccountDefaults

Hierarchy

• ComponentResource
• AwsAccountDefaults

Properties

defaultVpcCleanupApplied: OutputInstance<boolean> | undefined

Whether default VPC cleanup was applied (the region currently has no default VPC).

Remarks

Resolves to true after cleanup removed a default VPC or when none existed, and to false when the capability is disabled. A pulumi refresh re-reads current reality, so it reports false if a default VPC reappears.

defaultVpcCleanupAppliedByRegion: Output<AwsAccountDefaultsDefaultVpcCleanupAppliedByRegion> | undefined

Default VPC cleanup state keyed by configured AWS region when configured.

deploymentRoleArn: Output<string> | undefined

Default Pulumi deployment role ARN when configured.

grafanaAccessRoleArn: Output<string> | undefined

Grafana access role ARN when configured.

rdsAndDocdbSubnetGroup: SubnetGroup | undefined

Shared RDS/DocDB DB subnet group created from a referenced VPC when configured.

rdsAndDocdbSubnetGroupName: Output<string> | undefined

Shared RDS/DocDB DB subnet group name when configured.

securityGroupIds: Output<AwsAccountDefaultsSecurityGroupIds> | undefined

Security group IDs keyed first by VPC Name tag value, then by preset group key.

serverlessDeploymentBucketArns: Output<Partial<Record<'eu-central-1' | 'eu-west-1' | 'us-east-1', string>>> | undefined

Serverless Framework deployment-artifact bucket ARNs keyed by configured AWS region.

serverlessDeploymentBucketNames: Output<Partial<Record<'eu-central-1' | 'eu-west-1' | 'us-east-1', string | undefined>>> | undefined

Serverless Framework deployment-artifact bucket names keyed by configured AWS region.

serverlessDeploymentRoleArn: Output<string> | undefined

Serverless deployment role ARN when configured.

urn: Output<string>

Inherited from urn

The stable logical URN used to distinctly address a resource, both before and after deployments.

Methods

getData(): Promise<any>

Inherited from getData

Retrieves the data produces by initialize. The data is immediately available in a derived class's constructor after the super(...) call to ComponentResource.

Returns

• Promise<any>

getProvider(moduleMember: string): ProviderResource | undefined

Inherited from getProvider

Returns the provider for the given module member, if one exists.

Parameters

• moduleMember (string)

Returns

• ProviderResource | undefined

initialize( args: Inputs, opts?: ComponentResourceOptions, name?: string, type?: string, ): Promise<any>

Inherited from initialize

Can be overridden by a subclass to asynchronously initialize data for this component automatically when constructed. The data will be available immediately for subclass constructors to use. To access the data use getData.

Parameters

• args (Inputs)
• opts (ComponentResourceOptions, optional)
• name (string, optional)
• type (string, optional)

Returns

• Promise<any>

registerOutputs( outputs?: Inputs | Promise<Inputs> | Output<Inputs>, ): void

Inherited from registerOutputs

Registers synthetic outputs that a component has initialized, usually by allocating other child sub-resources and propagating their resulting property values.

Component resources can call this at the end of their constructor to indicate that they are done creating child resources. This is not strictly necessary as this will automatically be called after the initialize method completes.

Parameters

• outputs (Inputs | Promise<Inputs> | Output<Inputs>, optional)

Returns

• void

Static Methods

isInstance(obj: any): obj is ComponentResource<any>

Inherited from isInstance

Returns true if the given object is a CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

Parameters

• obj (any)

Returns

• obj is ComponentResource<any>