1. Packages
  2. AWS Classic
  3. API Docs
  4. iam
  5. RolePolicyAttachment

Try AWS Native preview for resources not in the classic version.

AWS Classic v6.41.0 published on Tuesday, Jun 18, 2024 by Pulumi

aws.iam.RolePolicyAttachment

Explore with Pulumi AI

aws logo

Try AWS Native preview for resources not in the classic version.

AWS Classic v6.41.0 published on Tuesday, Jun 18, 2024 by Pulumi

    Attaches a Managed IAM Policy to an IAM role

    NOTE: The usage of this resource conflicts with the aws.iam.PolicyAttachment resource and will permanently show a difference if both are defined.

    NOTE: For a given role, this resource is incompatible with using the aws.iam.Role resource managed_policy_arns argument. When using that argument and this resource, both will attempt to manage the role’s managed policy attachments and Pulumi will show a permanent difference.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
    import * as aws from "@pulumi/aws";
    
    const assumeRole = aws.iam.getPolicyDocument({
        statements: [{
            effect: "Allow",
            principals: [{
                type: "Service",
                identifiers: ["ec2.amazonaws.com"],
            }],
            actions: ["sts:AssumeRole"],
        }],
    });
    const role = new aws.iam.Role("role", {
        name: "test-role",
        assumeRolePolicy: assumeRole.then(assumeRole => assumeRole.json),
    });
    const policy = aws.iam.getPolicyDocument({
        statements: [{
            effect: "Allow",
            actions: ["ec2:Describe*"],
            resources: ["*"],
        }],
    });
    const policyPolicy = new aws.iam.Policy("policy", {
        name: "test-policy",
        description: "A test policy",
        policy: policy.then(policy => policy.json),
    });
    const test_attach = new aws.iam.RolePolicyAttachment("test-attach", {
        role: role.name,
        policyArn: policyPolicy.arn,
    });
    
    import pulumi
    import pulumi_aws as aws
    
    assume_role = aws.iam.get_policy_document(statements=[aws.iam.GetPolicyDocumentStatementArgs(
        effect="Allow",
        principals=[aws.iam.GetPolicyDocumentStatementPrincipalArgs(
            type="Service",
            identifiers=["ec2.amazonaws.com"],
        )],
        actions=["sts:AssumeRole"],
    )])
    role = aws.iam.Role("role",
        name="test-role",
        assume_role_policy=assume_role.json)
    policy = aws.iam.get_policy_document(statements=[aws.iam.GetPolicyDocumentStatementArgs(
        effect="Allow",
        actions=["ec2:Describe*"],
        resources=["*"],
    )])
    policy_policy = aws.iam.Policy("policy",
        name="test-policy",
        description="A test policy",
        policy=policy.json)
    test_attach = aws.iam.RolePolicyAttachment("test-attach",
        role=role.name,
        policy_arn=policy_policy.arn)
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/iam"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		assumeRole, err := iam.GetPolicyDocument(ctx, &iam.GetPolicyDocumentArgs{
    			Statements: []iam.GetPolicyDocumentStatement{
    				{
    					Effect: pulumi.StringRef("Allow"),
    					Principals: []iam.GetPolicyDocumentStatementPrincipal{
    						{
    							Type: "Service",
    							Identifiers: []string{
    								"ec2.amazonaws.com",
    							},
    						},
    					},
    					Actions: []string{
    						"sts:AssumeRole",
    					},
    				},
    			},
    		}, nil)
    		if err != nil {
    			return err
    		}
    		role, err := iam.NewRole(ctx, "role", &iam.RoleArgs{
    			Name:             pulumi.String("test-role"),
    			AssumeRolePolicy: pulumi.String(assumeRole.Json),
    		})
    		if err != nil {
    			return err
    		}
    		policy, err := iam.GetPolicyDocument(ctx, &iam.GetPolicyDocumentArgs{
    			Statements: []iam.GetPolicyDocumentStatement{
    				{
    					Effect: pulumi.StringRef("Allow"),
    					Actions: []string{
    						"ec2:Describe*",
    					},
    					Resources: []string{
    						"*",
    					},
    				},
    			},
    		}, nil)
    		if err != nil {
    			return err
    		}
    		policyPolicy, err := iam.NewPolicy(ctx, "policy", &iam.PolicyArgs{
    			Name:        pulumi.String("test-policy"),
    			Description: pulumi.String("A test policy"),
    			Policy:      pulumi.String(policy.Json),
    		})
    		if err != nil {
    			return err
    		}
    		_, err = iam.NewRolePolicyAttachment(ctx, "test-attach", &iam.RolePolicyAttachmentArgs{
    			Role:      role.Name,
    			PolicyArn: policyPolicy.Arn,
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Aws = Pulumi.Aws;
    
    return await Deployment.RunAsync(() => 
    {
        var assumeRole = Aws.Iam.GetPolicyDocument.Invoke(new()
        {
            Statements = new[]
            {
                new Aws.Iam.Inputs.GetPolicyDocumentStatementInputArgs
                {
                    Effect = "Allow",
                    Principals = new[]
                    {
                        new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalInputArgs
                        {
                            Type = "Service",
                            Identifiers = new[]
                            {
                                "ec2.amazonaws.com",
                            },
                        },
                    },
                    Actions = new[]
                    {
                        "sts:AssumeRole",
                    },
                },
            },
        });
    
        var role = new Aws.Iam.Role("role", new()
        {
            Name = "test-role",
            AssumeRolePolicy = assumeRole.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Json),
        });
    
        var policy = Aws.Iam.GetPolicyDocument.Invoke(new()
        {
            Statements = new[]
            {
                new Aws.Iam.Inputs.GetPolicyDocumentStatementInputArgs
                {
                    Effect = "Allow",
                    Actions = new[]
                    {
                        "ec2:Describe*",
                    },
                    Resources = new[]
                    {
                        "*",
                    },
                },
            },
        });
    
        var policyPolicy = new Aws.Iam.Policy("policy", new()
        {
            Name = "test-policy",
            Description = "A test policy",
            PolicyDocument = policy.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Json),
        });
    
        var test_attach = new Aws.Iam.RolePolicyAttachment("test-attach", new()
        {
            Role = role.Name,
            PolicyArn = policyPolicy.Arn,
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.aws.iam.IamFunctions;
    import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
    import com.pulumi.aws.iam.Role;
    import com.pulumi.aws.iam.RoleArgs;
    import com.pulumi.aws.iam.Policy;
    import com.pulumi.aws.iam.PolicyArgs;
    import com.pulumi.aws.iam.RolePolicyAttachment;
    import com.pulumi.aws.iam.RolePolicyAttachmentArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            final var assumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
                .statements(GetPolicyDocumentStatementArgs.builder()
                    .effect("Allow")
                    .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                        .type("Service")
                        .identifiers("ec2.amazonaws.com")
                        .build())
                    .actions("sts:AssumeRole")
                    .build())
                .build());
    
            var role = new Role("role", RoleArgs.builder()
                .name("test-role")
                .assumeRolePolicy(assumeRole.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.json()))
                .build());
    
            final var policy = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
                .statements(GetPolicyDocumentStatementArgs.builder()
                    .effect("Allow")
                    .actions("ec2:Describe*")
                    .resources("*")
                    .build())
                .build());
    
            var policyPolicy = new Policy("policyPolicy", PolicyArgs.builder()
                .name("test-policy")
                .description("A test policy")
                .policy(policy.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.json()))
                .build());
    
            var test_attach = new RolePolicyAttachment("test-attach", RolePolicyAttachmentArgs.builder()
                .role(role.name())
                .policyArn(policyPolicy.arn())
                .build());
    
        }
    }
    
    resources:
      role:
        type: aws:iam:Role
        properties:
          name: test-role
          assumeRolePolicy: ${assumeRole.json}
      policyPolicy:
        type: aws:iam:Policy
        name: policy
        properties:
          name: test-policy
          description: A test policy
          policy: ${policy.json}
      test-attach:
        type: aws:iam:RolePolicyAttachment
        properties:
          role: ${role.name}
          policyArn: ${policyPolicy.arn}
    variables:
      assumeRole:
        fn::invoke:
          Function: aws:iam:getPolicyDocument
          Arguments:
            statements:
              - effect: Allow
                principals:
                  - type: Service
                    identifiers:
                      - ec2.amazonaws.com
                actions:
                  - sts:AssumeRole
      policy:
        fn::invoke:
          Function: aws:iam:getPolicyDocument
          Arguments:
            statements:
              - effect: Allow
                actions:
                  - ec2:Describe*
                resources:
                  - '*'
    

    Create RolePolicyAttachment Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new RolePolicyAttachment(name: string, args: RolePolicyAttachmentArgs, opts?: CustomResourceOptions);
    @overload
    def RolePolicyAttachment(resource_name: str,
                             args: RolePolicyAttachmentArgs,
                             opts: Optional[ResourceOptions] = None)
    
    @overload
    def RolePolicyAttachment(resource_name: str,
                             opts: Optional[ResourceOptions] = None,
                             policy_arn: Optional[str] = None,
                             role: Optional[str] = None)
    func NewRolePolicyAttachment(ctx *Context, name string, args RolePolicyAttachmentArgs, opts ...ResourceOption) (*RolePolicyAttachment, error)
    public RolePolicyAttachment(string name, RolePolicyAttachmentArgs args, CustomResourceOptions? opts = null)
    public RolePolicyAttachment(String name, RolePolicyAttachmentArgs args)
    public RolePolicyAttachment(String name, RolePolicyAttachmentArgs args, CustomResourceOptions options)
    
    type: aws:iam:RolePolicyAttachment
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    

    Parameters

    name string
    The unique name of the resource.
    args RolePolicyAttachmentArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args RolePolicyAttachmentArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args RolePolicyAttachmentArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args RolePolicyAttachmentArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args RolePolicyAttachmentArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Example

    The following reference example uses placeholder values for all input properties.

    var rolePolicyAttachmentResource = new Aws.Iam.RolePolicyAttachment("rolePolicyAttachmentResource", new()
    {
        PolicyArn = "string",
        Role = "string",
    });
    
    example, err := iam.NewRolePolicyAttachment(ctx, "rolePolicyAttachmentResource", &iam.RolePolicyAttachmentArgs{
    	PolicyArn: pulumi.String("string"),
    	Role:      pulumi.Any("string"),
    })
    
    var rolePolicyAttachmentResource = new RolePolicyAttachment("rolePolicyAttachmentResource", RolePolicyAttachmentArgs.builder()
        .policyArn("string")
        .role("string")
        .build());
    
    role_policy_attachment_resource = aws.iam.RolePolicyAttachment("rolePolicyAttachmentResource",
        policy_arn="string",
        role="string")
    
    const rolePolicyAttachmentResource = new aws.iam.RolePolicyAttachment("rolePolicyAttachmentResource", {
        policyArn: "string",
        role: "string",
    });
    
    type: aws:iam:RolePolicyAttachment
    properties:
        policyArn: string
        role: string
    

    RolePolicyAttachment Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The RolePolicyAttachment resource accepts the following input properties:

    PolicyArn string
    The ARN of the policy you want to apply
    Role string | string
    The name of the IAM role to which the policy should be applied
    PolicyArn string
    The ARN of the policy you want to apply
    Role string | string
    The name of the IAM role to which the policy should be applied
    policyArn String
    The ARN of the policy you want to apply
    role String | String
    The name of the IAM role to which the policy should be applied
    policyArn ARN
    The ARN of the policy you want to apply
    role string | Role
    The name of the IAM role to which the policy should be applied
    policy_arn str
    The ARN of the policy you want to apply
    role str | str
    The name of the IAM role to which the policy should be applied
    policyArn
    The ARN of the policy you want to apply
    role String |
    The name of the IAM role to which the policy should be applied

    Outputs

    All input properties are implicitly available as output properties. Additionally, the RolePolicyAttachment resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing RolePolicyAttachment Resource

    Get an existing RolePolicyAttachment resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: RolePolicyAttachmentState, opts?: CustomResourceOptions): RolePolicyAttachment
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            policy_arn: Optional[str] = None,
            role: Optional[str] = None) -> RolePolicyAttachment
    func GetRolePolicyAttachment(ctx *Context, name string, id IDInput, state *RolePolicyAttachmentState, opts ...ResourceOption) (*RolePolicyAttachment, error)
    public static RolePolicyAttachment Get(string name, Input<string> id, RolePolicyAttachmentState? state, CustomResourceOptions? opts = null)
    public static RolePolicyAttachment get(String name, Output<String> id, RolePolicyAttachmentState state, CustomResourceOptions options)
    Resource lookup is not supported in YAML
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    PolicyArn string
    The ARN of the policy you want to apply
    Role string | string
    The name of the IAM role to which the policy should be applied
    PolicyArn string
    The ARN of the policy you want to apply
    Role string | string
    The name of the IAM role to which the policy should be applied
    policyArn String
    The ARN of the policy you want to apply
    role String | String
    The name of the IAM role to which the policy should be applied
    policyArn ARN
    The ARN of the policy you want to apply
    role string | Role
    The name of the IAM role to which the policy should be applied
    policy_arn str
    The ARN of the policy you want to apply
    role str | str
    The name of the IAM role to which the policy should be applied
    policyArn
    The ARN of the policy you want to apply
    role String |
    The name of the IAM role to which the policy should be applied

    Import

    Using pulumi import, import IAM role policy attachments using the role name and policy arn separated by /. For example:

    $ pulumi import aws:iam/rolePolicyAttachment:RolePolicyAttachment test-attach test-role/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
    

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo

    Try AWS Native preview for resources not in the classic version.

    AWS Classic v6.41.0 published on Tuesday, Jun 18, 2024 by Pulumi