AwsAccountDefaultsServerlessDeploymentRoleArgs

interface AwsAccountDefaultsServerlessDeploymentRoleArgs {
additionalTrustPolicyStatementsTemplate?: AwsAccountDefaultsTrustPolicyStatementsTemplateArgs;
enabled?: boolean;
policyDocument: AwsAccountDefaultsRolePolicyTemplateArgs;
regions: AwsAccountDefaultsServerlessDeploymentBucketRegions;
}

Capability arguments for creating the global Serverless Framework deployment role and regional artifact buckets.

Remarks

This capability uses ambient AWS session credentials for both the global IAM role and every internally created regional aws-native provider. Do not pass provider or providers in the component options when enabling it.

Example

CODE

new AwsAccountDefaults({
  identity: 'account-defaults',
  serverlessDeploymentRole: {
    regions: { 'eu-central-1': {}, 'eu-west-1': {} },
    policyDocument: {
      path: 'policies/serverless-deployment-default.json',
    },
  },
});

Properties

`additionalTrustPolicyStatementsTemplate: AwsAccountDefaultsTrustPolicyStatementsTemplateArgs`

Optional JSON template containing additional trust-policy statements merged with the default CodeBuild trust statement.

Remarks

The template can contain either a single statement object, or an array of statement objects. Rendered statements are appended after the default CodeBuild trust statement.

Example

CODE

additionalTrustPolicyStatementsTemplate: {
  path: 'policies/serverless-deployment-extra-trust-statement.json',
}

`enabled: boolean`

Enables the Serverless Framework deployment role and its private regional deployment-artifact buckets. Defaults to true when this block is set.

`policyDocument: AwsAccountDefaultsRolePolicyTemplateArgs`

Path and optional variables for rendering the inline role policy document template.

`regions: AwsAccountDefaultsServerlessDeploymentBucketRegions`

AWS regions that receive private Serverless Framework deployment-artifact buckets, keyed by raw AWS region identifier.

Remarks

Must be a non-empty keyed object. Each key must be enabled at organisational level via jobcloudAllowedRegions. The component creates an internal aws-native provider for every selected region using the ambient current AWS session, so consumers do not supply providers.