How Do I Deploy an AWS IAM Role Policy With Pulumi?

Introduction

This guide provides a step-by-step approach to deploying an AWS IAM role policy using Pulumi with TypeScript. You will learn how to create an IAM role, define a trust policy, and attach a policy to the role. This setup is essential for managing permissions and enabling secure access to AWS resources.

Step-by-Step Process

1. Define the IAM Role: Start by creating an IAM role with a trust policy. This policy specifies which entities can assume the role.

2. Create the IAM Role Policy: Develop a policy that outlines the permissions associated with the IAM role. This policy will specify the actions that the role is allowed to perform.

3. Attach the Policy to the IAM Role: Link the defined policy to the IAM role, enabling the role to perform the specified actions.

Here is the TypeScript code to accomplish these tasks:

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Define the IAM role
const role = new aws.iam.Role("myRole", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Principal: {
                Service: "ec2.amazonaws.com",
            },
            Effect: "Allow",
            Sid: "",
        }],
    }),
});

// Define the IAM role policy
const rolePolicy = new aws.iam.RolePolicy("myRolePolicy", {
    role: role.id,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            Effect: "Allow",
            Resource: [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ],
        }],
    }),
});

// Export the role name
export const roleName = role.name;

Summary

In this guide, we successfully deployed an AWS IAM role and attached a policy using Pulumi. The process involved defining a trust policy for the IAM role and specifying the permissions through the role policy. This configuration allows the IAM role to assume the specified permissions, facilitating secure and controlled access to AWS resources.