1. Docs
2. Reference
3. REST API Docs
4. Schema
5. OperationContextAWSOIDCConfiguration

OperationContextAWSOIDCConfiguration contains information about how to exchange an OIDC token for temporary AWS credentials in the form of an assume-role session. See https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html for details on creating an appropriately-configured IAM role.

Properties

• duration string optional
  Duration is the duration of the assume-role session.
• policyArns array[string] optional
  PolicyARNs is an optional set of IAM policy ARNs that further restrict the assume-role session.
• roleArn string required
  The ARN of the role to assume using the OIDC token.
• sessionName string required
  The name of the assume-role session, sent to AWS STS as RoleSessionName. Supports ${var} placeholders for ${organization.name}, ${project.name}, ${stack.name}, ${operation}, ${deployment.version}, and ${deployment.id}. Recommended: include ${deployment.version} so each run is traceable in AWS CloudTrail (for example, ‘pulumi-${deployment.version}’). AWS caps RoleSessionName at 64 characters; if a rendered template would exceed that, the name variables (organization, project, stack) are truncated to fit while ${operation}, ${deployment.version}, and ${deployment.id} are preserved.