pulumi-aws-kotlin/com.pulumi.aws.iam.kotlin/RoleArgs

RoleArgs

data class RoleArgs(val assumeRolePolicy: Output<String>? = null, val description: Output<String>? = null, val forceDetachPolicies: Output<Boolean>? = null, val inlinePolicies: Output<List<RoleInlinePolicyArgs>>? = null, val managedPolicyArns: Output<List<String>>? = null, val maxSessionDuration: Output<Int>? = null, val name: Output<String>? = null, val namePrefix: Output<String>? = null, val path: Output<String>? = null, val permissionsBoundary: Output<String>? = null, val tags: Output<Map<String, String>>? = null) : ConvertibleToJava<RoleArgs>

Provides an IAM role.

NOTE: If policies are attached to the role via the aws.iam.PolicyAttachment resource and you are modifying the role name or path, the force_detach_policies argument must be set to true and applied before attempting the operation otherwise you will encounter a DeleteConflict error. The aws.iam.RolePolicyAttachment resource (recommended) does not have this requirement. NOTE: If you use this resource's managed_policy_arns argument or inline_policy configuration blocks, this resource will take over exclusive management of the role's respective policy types (e.g., both policy types if both arguments are used). These arguments are incompatible with other ways of managing a role's policies, such as aws.iam.PolicyAttachment, aws.iam.RolePolicyAttachment, and aws.iam.RolePolicy. If you attempt to manage a role's policies by multiple means, you will get resource cycling and/or errors.

Example Usage

Basic Example

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var testRole = new Role("testRole", RoleArgs.builder()
            .assumeRolePolicy(serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Action", "sts:AssumeRole"),
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Sid", ""),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("Service", "ec2.amazonaws.com")
                        ))
                    )))
                )))
            .tags(Map.of("tag-key", "tag-value"))
            .build());
    }
}
Content copied to clipboard

Example of Using Data Source for Assume Role Policy

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.IamFunctions;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var instanceAssumeRolePolicy = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .actions("sts:AssumeRole")
                .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                    .type("Service")
                    .identifiers("ec2.amazonaws.com")
                    .build())
                .build())
            .build());
        var instance = new Role("instance", RoleArgs.builder()
            .path("/system/")
            .assumeRolePolicy(instanceAssumeRolePolicy.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.json()))
            .build());
    }
}
Content copied to clipboard

Example of Exclusive Inline Policies

This example creates an IAM role with two inline IAM policies. If someone adds another inline policy out-of-band, on the next apply, this provider will remove that policy. If someone deletes these policies out-of-band, this provider will recreate them.

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.IamFunctions;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.iam.inputs.RoleInlinePolicyArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var inlinePolicy = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .actions("ec2:DescribeAccountAttributes")
                .resources("*")
                .build())
            .build());
        var example = new Role("example", RoleArgs.builder()
            .assumeRolePolicy(data.aws_iam_policy_document().instance_assume_role_policy().json())
            .inlinePolicies(
                RoleInlinePolicyArgs.builder()
                    .name("my_inline_policy")
                    .policy(serializeJson(
                        jsonObject(
                            jsonProperty("Version", "2012-10-17"),
                            jsonProperty("Statement", jsonArray(jsonObject(
                                jsonProperty("Action", jsonArray("ec2:Describe*")),
                                jsonProperty("Effect", "Allow"),
                                jsonProperty("Resource", "*")
                            )))
                        )))
                    .build(),
                RoleInlinePolicyArgs.builder()
                    .name("policy-8675309")
                    .policy(inlinePolicy.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.json()))
                    .build())
            .build());
    }
}
Content copied to clipboard

Example of Removing Inline Policies

This example creates an IAM role with what appears to be empty IAM inline_policy argument instead of using inline_policy as a configuration block. The result is that if someone were to add an inline policy out-of-band, on the next apply, this provider will remove that policy.

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.iam.inputs.RoleInlinePolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var example = new Role("example", RoleArgs.builder()
            .assumeRolePolicy(data.aws_iam_policy_document().instance_assume_role_policy().json())
            .inlinePolicies()
            .build());
    }
}
Content copied to clipboard

Example of Exclusive Managed Policies

This example creates an IAM role and attaches two managed IAM policies. If someone attaches another managed policy out-of-band, on the next apply, this provider will detach that policy. If someone detaches these policies out-of-band, this provider will attach them again.

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.Policy;
import com.pulumi.aws.iam.PolicyArgs;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var policyOne = new Policy("policyOne", PolicyArgs.builder()
            .policy(serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Action", jsonArray("ec2:Describe*")),
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Resource", "*")
                    )))
                )))
            .build());
        var policyTwo = new Policy("policyTwo", PolicyArgs.builder()
            .policy(serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Action", jsonArray(
                            "s3:ListAllMyBuckets",
                            "s3:ListBucket",
                            "s3:HeadBucket"
                        )),
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Resource", "*")
                    )))
                )))
            .build());
        var example = new Role("example", RoleArgs.builder()
            .assumeRolePolicy(data.aws_iam_policy_document().instance_assume_role_policy().json())
            .managedPolicyArns(
                policyOne.arn(),
                policyTwo.arn())
            .build());
    }
}
Content copied to clipboard

Example of Removing Managed Policies

This example creates an IAM role with an empty managed_policy_arns argument. If someone attaches a policy out-of-band, on the next apply, this provider will detach that policy.

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var example = new Role("example", RoleArgs.builder()
            .assumeRolePolicy(data.aws_iam_policy_document().instance_assume_role_policy().json())
            .managedPolicyArns()
            .build());
    }
}
Content copied to clipboard

Import

IAM Roles can be imported using the name, e.g.,

$ pulumi import aws:iam/role:Role developer developer_name
Content copied to clipboard

Constructors

Link copied to clipboard
constructor(assumeRolePolicy: Output<String>? = null, description: Output<String>? = null, forceDetachPolicies: Output<Boolean>? = null, inlinePolicies: Output<List<RoleInlinePolicyArgs>>? = null, managedPolicyArns: Output<List<String>>? = null, maxSessionDuration: Output<Int>? = null, name: Output<String>? = null, namePrefix: Output<String>? = null, path: Output<String>? = null, permissionsBoundary: Output<String>? = null, tags: Output<Map<String, String>>? = null)

Properties

Link copied to clipboard
val assumeRolePolicy: Output<String>? = null

Policy that grants an entity permission to assume the role.

Link copied to clipboard
val description: Output<String>? = null

Description of the role.

Link copied to clipboard
val forceDetachPolicies: Output<Boolean>? = null

Whether to force detaching any policies the role has before destroying it. Defaults to false.

Link copied to clipboard
val inlinePolicies: Output<List<RoleInlinePolicyArgs>>? = null

Configuration block defining an exclusive set of IAM inline policies associated with the IAM role. See below. If no blocks are configured, the provider will not manage any inline policies in this resource. Configuring one empty block (i.e., inline_policy {}) will cause the provider to remove all inline policies added out of band on apply.

Link copied to clipboard
val managedPolicyArns: Output<List<String>>? = null
Link copied to clipboard
val maxSessionDuration: Output<Int>? = null

Maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.

Link copied to clipboard
val name: Output<String>? = null

Friendly name of the role. If omitted, the provider will assign a random, unique name. See IAM Identifiers for more information.

Link copied to clipboard
val namePrefix: Output<String>? = null

Creates a unique friendly name beginning with the specified prefix. Conflicts with name.

Link copied to clipboard
val path: Output<String>? = null

Path to the role. See IAM Identifiers for more information.

Link copied to clipboard
val permissionsBoundary: Output<String>? = null

ARN of the policy that is used to set the permissions boundary for the role.

Link copied to clipboard
val tags: Output<Map<String, String>>? = null

Key-value mapping of tags for the IAM role. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

Functions

Link copied to clipboard
open override fun toJava(): RoleArgs