AwsIam

Service-level AWS IAM component.

Remarks

This is the primary component resource for the package. It can orchestrate creation of IAM policy, role, assume role policy, user, and service-specific credential capabilities through a single component boundary.

Naming:

• Root type ${namespace}:aws:AwsIam uses capability iam and one raw identity: args.policy.name, args.role.name, args.user.name, args.serviceSpecificCredential.identity, or the LOGICAL-ONLY args.assumeRolePolicy.identity. The shared root builder produces ${env}-${projectHash}-iam-${sanitised identity}.
• Qualified child type aws:iam/policy:Policy, parent ${namespace}:aws:AwsIam, uses [args.policy.name]; qualified child type aws:iam/role:Role uses [args.role.name]; and qualified child type aws:iam/user:User uses [args.user.name]. Each target is ${env}-${projectHash}-${sanitised name}.
• Qualified child type aws:iam/accessKey:AccessKey, parent ${namespace}:aws:AwsIam, uses [args.user.name, args.user.accessKeys map key]. Its target is ${env}-${projectHash}-${sanitised user name}-${sanitised map key}.
• Qualified child type aws:iam/userPolicyAttachment:UserPolicyAttachment, parent ${namespace}:aws:AwsIam, uses [args.user.name, args.user.managedPolicies/managedPolicyArns map key]. One collision map covers both input paths before any attachment is created. Its target is ${env}-${projectHash}-${sanitised user name}-${sanitised map key}.
• Qualified child type aws:iam/serviceSpecificCredential:ServiceSpecificCredential, parent ${namespace}:aws:AwsIam, uses [args.serviceSpecificCredential.identity]. Its target is ${env}-${projectHash}-${sanitised args.serviceSpecificCredential.identity}. Its service and owning IAM user are semantic AWS identifiers forwarded unchanged.
• IAM role AWS names use stackServicePurpose, ${env}-${projectHash}-${serviceCode}-${purpose}; IAM policy and user AWS names use stackAndPurpose, ${env}-${projectHash}-${purpose}.

Example

import { iamAssumeRoleServicePrincipals, iamRoleServiceCodes } from '@jobcloud/pulumi-helpers';

const userPolicy = new AwsIam({
  policy: {
    name: 'userPolicy',
    policy: {
      path: './policies/user-policy.json',
    },
  },
});

const rolePolicy = new AwsIam({
  policy: {
    name: 'rolePolicy',
    policy: {
      path: './policies/role-policy.json',
    },
  },
});

const roleAssumeRolePolicy = new AwsIam({
  assumeRolePolicy: {
    identity: 'ecsTasksAssumeRolePolicy',
    servicePrincipal: iamAssumeRoleServicePrincipals.ecsTasks,
  },
});

const roleWithReference = new AwsIam({
  role: {
    name: 'appRole',
    serviceCode: iamRoleServiceCodes.ecs,
    assumeRolePolicy: roleAssumeRolePolicy,
    managedPolicies: { rolePolicy },
  },
});

const userWithReference = new AwsIam({
  user: {
    name: 'automationUser',
    managedPolicies: { userPolicy },
    accessKeys: {
      '2026': { status: 'Active' },
      '2027': { status: 'Inactive' },
    },
  },
});

export const accessKey2026Id = userWithReference.userAccessKeys?.['2026']?.id;

Constructors

new AwsIam( args: AwsIamArgs, options?: ComponentResourceOptions, ): AwsIam

Parameters

• args (AwsIamArgs) — Service-level IAM capability inputs.The component logical name is derived from args.policy.name, args.role.name, args.assumeRolePolicy.identity, args.user.name, or args.serviceSpecificCredential.identity.
• options (ComponentResourceOptions, optional) — Optional settings controlling resource behaviour.

Returns

AwsIam

Hierarchy

• ComponentResource
• AwsIam

Properties

assumeRolePolicyCapability: AwsIamAssumeRolePolicy

Optional IAM assume role policy capability created by this component.

policy: AwsIamPolicy

Optional IAM policy capability created by this component.

role: AwsIamRole

Optional IAM role capability created by this component.

serviceSpecificCredential: AwsIamServiceSpecificCredential

Optional IAM service-specific credential capability created by this component.

urn: Output<string>

Inherited from urn

The stable logical URN used to distinctly address a resource, both before and after deployments.

user: AwsIamUser

Optional IAM user capability created by this component.

userAccessKeys: Record<string, AwsIamUserAccessKeyMetadata>

Optional non-secret IAM user access-key metadata created by this component.

userPolicyAttachments: UserPolicyAttachment[]

Optional IAM user policy attachments created by this component.

Methods

getData(): Promise<any>

Inherited from getData

Retrieves the data produces by initialize. The data is immediately available in a derived class's constructor after the super(...) call to ComponentResource.

Returns

• Promise<any>

getProvider(moduleMember: string): ProviderResource | undefined

Inherited from getProvider

Returns the provider for the given module member, if one exists.

Parameters

• moduleMember (string)

Returns

• ProviderResource | undefined

initialize( args: Inputs, opts?: ComponentResourceOptions, name?: string, type?: string, ): Promise<any>

Inherited from initialize

Can be overridden by a subclass to asynchronously initialize data for this component automatically when constructed. The data will be available immediately for subclass constructors to use. To access the data use getData.

Parameters

• args (Inputs)
• opts (ComponentResourceOptions, optional)
• name (string, optional)
• type (string, optional)

Returns

• Promise<any>

registerOutputs( outputs?: Inputs | Promise<Inputs> | Output<Inputs>, ): void

Inherited from registerOutputs

Registers synthetic outputs that a component has initialized, usually by allocating other child sub-resources and propagating their resulting property values.

Component resources can call this at the end of their constructor to indicate that they are done creating child resources. This is not strictly necessary as this will automatically be called after the initialize method completes.

Parameters

• outputs (Inputs | Promise<Inputs> | Output<Inputs>, optional)

Returns

• void

Static Methods

isInstance(obj: any): obj is ComponentResource<any>

Inherited from isInstance

Returns true if the given object is a CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

Parameters

• obj (any)

Returns

• obj is ComponentResource<any>