AwsIamRoleArgs

interface AwsIamRoleArgs extends Omit<AwsIamRoleResourceArgs, 'assumeRolePolicy' | 'managedPolicyArns'> {
assumeRolePolicy: AwsIamAssumeRolePolicyReference;
description?: Input<string | undefined>;
forceDetachPolicies?: Input<boolean | undefined>;
inlinePolicies?: Input<Input<RoleInlinePolicy>[] | undefined>;
managedPolicies?: Record<string, AwsIamPolicyReference>;
managedPolicyArns?: Record<string, Input<string>>;
maxSessionDuration?: Input<number | undefined>;
name: string;
path?: Input<string | undefined>;
permissionsBoundary?: Input<string | undefined>;
serviceCode: Input<IamRoleServiceCode>;
tags?: Input<{ [key: string]: Input<string> } | undefined>;
}

Role inputs for AwsIam that allow referencing managed policies by object.

Example

CODE

import { iamAssumeRoleServicePrincipals } from '@jobcloud/pulumi-helpers';

const roleArgs: AwsIamRoleArgs = {
  name: 'appRole',
  serviceCode: iamRoleServiceCodes.ecs,
  assumeRolePolicy: { servicePrincipal: iamAssumeRoleServicePrincipals.ecsTasks },
  managedPolicyArns: { readOnly: 'ReadOnlyAccess' },
};

Hierarchy

Omit<AwsIamRoleResourceArgs, "assumeRolePolicy" | "managedPolicyArns">
AwsIamRoleArgs

Properties

`assumeRolePolicy: AwsIamAssumeRolePolicyReference`

Assume role policy for the role.

Remarks

Accepts a JSON template, a controlled default service principal, or a reference to a dedicated assume role policy capability instance. Inline policy documents are rejected.

`description: Input<string | undefined>`

Inherited from description

Description of the role.

`forceDetachPolicies: Input<boolean | undefined>`

Inherited from forceDetachPolicies

Whether to force detaching any policies the role has before destroying it. Defaults to false.

`inlinePolicies: Input<Input<RoleInlinePolicy>[] | undefined>`

Inherited from inlinePolicies

Configuration block defining an exclusive set of IAM inline policies associated with the IAM role. See below. If no blocks are configured, Pulumi will not manage any inline policies in this resource. Configuring one empty block (i.e., inlinePolicy {}) will cause Pulumi to remove all inline policies added out of band on apply.

`managedPolicies: Record<string, AwsIamPolicyReference>`

Optional policy references for role attachment.

Remarks

You may pass AwsIam policy components, IAM policy objects created by this package, or direct ARN/name inputs.

`managedPolicyArns: Record<string, Input<string>>`

Optional managed policy references (ARNs or AWS managed policy names) to attach to the role.

`maxSessionDuration: Input<number | undefined>`

Inherited from maxSessionDuration

Maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.

`name: string`

Overrides name

Plain-string role name used as the logical identity source for the AwsIam role capability.

`path: Input<string | undefined>`

Inherited from path

Path to the role. See IAM Identifiers for more information.

`permissionsBoundary: Input<string | undefined>`

Inherited from permissionsBoundary

ARN of the policy that is used to set the permissions boundary for the role.

`serviceCode: Input<IamRoleServiceCode>`

Inherited from serviceCode

Required service code embedded as the serviceCode segment of the stackServicePurpose role name.

Remarks

Use a value from iamRoleServiceCodes exported by @jobcloud/pulumi-helpers (for example iamRoleServiceCodes.ecs or iamRoleServiceCodes.lambda). Plain strings are deliberately rejected by the type system; this is a hyphen-delimited segment of the AWS name and is validated fail-fast against the centralised set, never coerced.

`tags: Input<{ [key: string]: Input<string> } | undefined>`

Inherited from tags

Key-value mapping of tags for the IAM role. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.