Docs Packages
  1. Packages
  2. AWS Classic
  3. API Docs
  4. s3control
  5. ObjectLambdaAccessPointPolicy

Try AWS Native preview for resources not in the classic version.

AWS Classic v6.31.1 published on Thursday, Apr 18, 2024 by Pulumi
pulumi/pulumi-aws

aws.s3control.ObjectLambdaAccessPointPolicy

Explore with Pulumi AI

aws logo

Try AWS Native preview for resources not in the classic version.

AWS Classic v6.31.1 published on Thursday, Apr 18, 2024 by Pulumi
pulumi/pulumi-aws

    Provides a resource to manage an S3 Object Lambda Access Point resource policy.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.s3.BucketV2("example", {bucket: "example"});
const exampleAccessPoint = new aws.s3.AccessPoint("example", {
    bucket: example.id,
    name: "example",
});
const exampleObjectLambdaAccessPoint = new aws.s3control.ObjectLambdaAccessPoint("example", {
    name: "example",
    configuration: {
        supportingAccessPoint: exampleAccessPoint.arn,
        transformationConfigurations: [{
            actions: ["GetObject"],
            contentTransformation: {
                awsLambda: {
                    functionArn: exampleAwsLambdaFunction.arn,
                },
            },
        }],
    },
});
const exampleObjectLambdaAccessPointPolicy = new aws.s3control.ObjectLambdaAccessPointPolicy("example", {
    name: exampleObjectLambdaAccessPoint.name,
    policy: pulumi.jsonStringify({
        Version: "2008-10-17",
        Statement: [{
            Effect: "Allow",
            Action: "s3-object-lambda:GetObject",
            Principal: {
                AWS: current.accountId,
            },
            Resource: exampleObjectLambdaAccessPoint.arn,
        }],
    }),
});

    import pulumi
import json
import pulumi_aws as aws

example = aws.s3.BucketV2("example", bucket="example")
example_access_point = aws.s3.AccessPoint("example",
    bucket=example.id,
    name="example")
example_object_lambda_access_point = aws.s3control.ObjectLambdaAccessPoint("example",
    name="example",
    configuration=aws.s3control.ObjectLambdaAccessPointConfigurationArgs(
        supporting_access_point=example_access_point.arn,
        transformation_configurations=[aws.s3control.ObjectLambdaAccessPointConfigurationTransformationConfigurationArgs(
            actions=["GetObject"],
            content_transformation=aws.s3control.ObjectLambdaAccessPointConfigurationTransformationConfigurationContentTransformationArgs(
                aws_lambda=aws.s3control.ObjectLambdaAccessPointConfigurationTransformationConfigurationContentTransformationAwsLambdaArgs(
                    function_arn=example_aws_lambda_function["arn"],
                ),
            ),
        )],
    ))
example_object_lambda_access_point_policy = aws.s3control.ObjectLambdaAccessPointPolicy("example",
    name=example_object_lambda_access_point.name,
    policy=pulumi.Output.json_dumps({
        "Version": "2008-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": "s3-object-lambda:GetObject",
            "Principal": {
                "AWS": current["accountId"],
            },
            "Resource": example_object_lambda_access_point.arn,
        }],
    }))

    package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/s3"
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/s3control"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := s3.NewBucketV2(ctx, "example", &s3.BucketV2Args{
			Bucket: pulumi.String("example"),
		})
		if err != nil {
			return err
		}
		exampleAccessPoint, err := s3.NewAccessPoint(ctx, "example", &s3.AccessPointArgs{
			Bucket: example.ID(),
			Name:   pulumi.String("example"),
		})
		if err != nil {
			return err
		}
		exampleObjectLambdaAccessPoint, err := s3control.NewObjectLambdaAccessPoint(ctx, "example", &s3control.ObjectLambdaAccessPointArgs{
			Name: pulumi.String("example"),
			Configuration: &s3control.ObjectLambdaAccessPointConfigurationArgs{
				SupportingAccessPoint: exampleAccessPoint.Arn,
				TransformationConfigurations: s3control.ObjectLambdaAccessPointConfigurationTransformationConfigurationArray{
					&s3control.ObjectLambdaAccessPointConfigurationTransformationConfigurationArgs{
						Actions: pulumi.StringArray{
							pulumi.String("GetObject"),
						},
						ContentTransformation: &s3control.ObjectLambdaAccessPointConfigurationTransformationConfigurationContentTransformationArgs{
							AwsLambda: &s3control.ObjectLambdaAccessPointConfigurationTransformationConfigurationContentTransformationAwsLambdaArgs{
								FunctionArn: pulumi.Any(exampleAwsLambdaFunction.Arn),
							},
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = s3control.NewObjectLambdaAccessPointPolicy(ctx, "example", &s3control.ObjectLambdaAccessPointPolicyArgs{
			Name: exampleObjectLambdaAccessPoint.Name,
			Policy: exampleObjectLambdaAccessPoint.Arn.ApplyT(func(arn string) (pulumi.String, error) {
				var _zero pulumi.String
				tmpJSON0, err := json.Marshal(map[string]interface{}{
					"Version": "2008-10-17",
					"Statement": []map[string]interface{}{
						map[string]interface{}{
							"Effect": "Allow",
							"Action": "s3-object-lambda:GetObject",
							"Principal": map[string]interface{}{
								"AWS": current.AccountId,
							},
							"Resource": arn,
						},
					},
				})
				if err != nil {
					return _zero, err
				}
				json0 := string(tmpJSON0)
				return pulumi.String(json0), nil
			}).(pulumi.StringOutput),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.S3.BucketV2("example", new()
    {
        Bucket = "example",
    });

    var exampleAccessPoint = new Aws.S3.AccessPoint("example", new()
    {
        Bucket = example.Id,
        Name = "example",
    });

    var exampleObjectLambdaAccessPoint = new Aws.S3Control.ObjectLambdaAccessPoint("example", new()
    {
        Name = "example",
        Configuration = new Aws.S3Control.Inputs.ObjectLambdaAccessPointConfigurationArgs
        {
            SupportingAccessPoint = exampleAccessPoint.Arn,
            TransformationConfigurations = new[]
            {
                new Aws.S3Control.Inputs.ObjectLambdaAccessPointConfigurationTransformationConfigurationArgs
                {
                    Actions = new[]
                    {
                        "GetObject",
                    },
                    ContentTransformation = new Aws.S3Control.Inputs.ObjectLambdaAccessPointConfigurationTransformationConfigurationContentTransformationArgs
                    {
                        AwsLambda = new Aws.S3Control.Inputs.ObjectLambdaAccessPointConfigurationTransformationConfigurationContentTransformationAwsLambdaArgs
                        {
                            FunctionArn = exampleAwsLambdaFunction.Arn,
                        },
                    },
                },
            },
        },
    });

    var exampleObjectLambdaAccessPointPolicy = new Aws.S3Control.ObjectLambdaAccessPointPolicy("example", new()
    {
        Name = exampleObjectLambdaAccessPoint.Name,
        Policy = Output.JsonSerialize(Output.Create(new Dictionary<string, object?>
        {
            ["Version"] = "2008-10-17",
            ["Statement"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["Effect"] = "Allow",
                    ["Action"] = "s3-object-lambda:GetObject",
                    ["Principal"] = new Dictionary<string, object?>
                    {
                        ["AWS"] = current.AccountId,
                    },
                    ["Resource"] = exampleObjectLambdaAccessPoint.Arn,
                },
            },
        })),
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.s3.BucketV2;
import com.pulumi.aws.s3.BucketV2Args;
import com.pulumi.aws.s3.AccessPoint;
import com.pulumi.aws.s3.AccessPointArgs;
import com.pulumi.aws.s3control.ObjectLambdaAccessPoint;
import com.pulumi.aws.s3control.ObjectLambdaAccessPointArgs;
import com.pulumi.aws.s3control.inputs.ObjectLambdaAccessPointConfigurationArgs;
import com.pulumi.aws.s3control.ObjectLambdaAccessPointPolicy;
import com.pulumi.aws.s3control.ObjectLambdaAccessPointPolicyArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new BucketV2("example", BucketV2Args.builder()        
            .bucket("example")
            .build());

        var exampleAccessPoint = new AccessPoint("exampleAccessPoint", AccessPointArgs.builder()        
            .bucket(example.id())
            .name("example")
            .build());

        var exampleObjectLambdaAccessPoint = new ObjectLambdaAccessPoint("exampleObjectLambdaAccessPoint", ObjectLambdaAccessPointArgs.builder()        
            .name("example")
            .configuration(ObjectLambdaAccessPointConfigurationArgs.builder()
                .supportingAccessPoint(exampleAccessPoint.arn())
                .transformationConfigurations(ObjectLambdaAccessPointConfigurationTransformationConfigurationArgs.builder()
                    .actions("GetObject")
                    .contentTransformation(ObjectLambdaAccessPointConfigurationTransformationConfigurationContentTransformationArgs.builder()
                        .awsLambda(ObjectLambdaAccessPointConfigurationTransformationConfigurationContentTransformationAwsLambdaArgs.builder()
                            .functionArn(exampleAwsLambdaFunction.arn())
                            .build())
                        .build())
                    .build())
                .build())
            .build());

        var exampleObjectLambdaAccessPointPolicy = new ObjectLambdaAccessPointPolicy("exampleObjectLambdaAccessPointPolicy", ObjectLambdaAccessPointPolicyArgs.builder()        
            .name(exampleObjectLambdaAccessPoint.name())
            .policy(exampleObjectLambdaAccessPoint.arn().applyValue(arn -> serializeJson(
                jsonObject(
                    jsonProperty("Version", "2008-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Action", "s3-object-lambda:GetObject"),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("AWS", current.accountId())
                        )),
                        jsonProperty("Resource", arn)
                    )))
                ))))
            .build());

    }
}

    resources:
  example:
    type: aws:s3:BucketV2
    properties:
      bucket: example
  exampleAccessPoint:
    type: aws:s3:AccessPoint
    name: example
    properties:
      bucket: ${example.id}
      name: example
  exampleObjectLambdaAccessPoint:
    type: aws:s3control:ObjectLambdaAccessPoint
    name: example
    properties:
      name: example
      configuration:
        supportingAccessPoint: ${exampleAccessPoint.arn}
        transformationConfigurations:
          - actions:
              - GetObject
            contentTransformation:
              awsLambda:
                functionArn: ${exampleAwsLambdaFunction.arn}
  exampleObjectLambdaAccessPointPolicy:
    type: aws:s3control:ObjectLambdaAccessPointPolicy
    name: example
    properties:
      name: ${exampleObjectLambdaAccessPoint.name}
      policy:
        fn::toJSON:
          Version: 2008-10-17
          Statement:
            - Effect: Allow
              Action: s3-object-lambda:GetObject
              Principal:
                AWS: ${current.accountId}
              Resource: ${exampleObjectLambdaAccessPoint.arn}

    Create ObjectLambdaAccessPointPolicy Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ObjectLambdaAccessPointPolicy(name: string, args: ObjectLambdaAccessPointPolicyArgs, opts?: CustomResourceOptions);
    @overload
def ObjectLambdaAccessPointPolicy(resource_name: str,
                                  args: ObjectLambdaAccessPointPolicyArgs,
                                  opts: Optional[ResourceOptions] = None)

@overload
def ObjectLambdaAccessPointPolicy(resource_name: str,
                                  opts: Optional[ResourceOptions] = None,
                                  policy: Optional[str] = None,
                                  account_id: Optional[str] = None,
                                  name: Optional[str] = None)
    func NewObjectLambdaAccessPointPolicy(ctx *Context, name string, args ObjectLambdaAccessPointPolicyArgs, opts ...ResourceOption) (*ObjectLambdaAccessPointPolicy, error)
    public ObjectLambdaAccessPointPolicy(string name, ObjectLambdaAccessPointPolicyArgs args, CustomResourceOptions? opts = null)
    public ObjectLambdaAccessPointPolicy(String name, ObjectLambdaAccessPointPolicyArgs args)
public ObjectLambdaAccessPointPolicy(String name, ObjectLambdaAccessPointPolicyArgs args, CustomResourceOptions options)

    type: aws:s3control:ObjectLambdaAccessPointPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args ObjectLambdaAccessPointPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ObjectLambdaAccessPointPolicyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ObjectLambdaAccessPointPolicyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ObjectLambdaAccessPointPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ObjectLambdaAccessPointPolicyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Example

    The following reference example uses placeholder values for all input properties.

    var objectLambdaAccessPointPolicyResource = new Aws.S3Control.ObjectLambdaAccessPointPolicy("objectLambdaAccessPointPolicyResource", new()
{
    Policy = "string",
    AccountId = "string",
    Name = "string",
});

    example, err := s3control.NewObjectLambdaAccessPointPolicy(ctx, "objectLambdaAccessPointPolicyResource", &s3control.ObjectLambdaAccessPointPolicyArgs{
	Policy:    pulumi.String("string"),
	AccountId: pulumi.String("string"),
	Name:      pulumi.String("string"),
})

    var objectLambdaAccessPointPolicyResource = new ObjectLambdaAccessPointPolicy("objectLambdaAccessPointPolicyResource", ObjectLambdaAccessPointPolicyArgs.builder()        
    .policy("string")
    .accountId("string")
    .name("string")
    .build());

    object_lambda_access_point_policy_resource = aws.s3control.ObjectLambdaAccessPointPolicy("objectLambdaAccessPointPolicyResource",
    policy="string",
    account_id="string",
    name="string")

    const objectLambdaAccessPointPolicyResource = new aws.s3control.ObjectLambdaAccessPointPolicy("objectLambdaAccessPointPolicyResource", {
    policy: "string",
    accountId: "string",
    name: "string",
});

    type: aws:s3control:ObjectLambdaAccessPointPolicy
properties:
    accountId: string
    name: string
    policy: string

    ObjectLambdaAccessPointPolicy Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The ObjectLambdaAccessPointPolicy resource accepts the following input properties:

    Policy string
    The Object Lambda Access Point resource policy document.
    AccountId string
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    Name string
    The name of the Object Lambda Access Point.
    Policy string
    The Object Lambda Access Point resource policy document.
    AccountId string
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    Name string
    The name of the Object Lambda Access Point.
    policy String
    The Object Lambda Access Point resource policy document.
    accountId String
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    name String
    The name of the Object Lambda Access Point.
    policy string
    The Object Lambda Access Point resource policy document.
    accountId string
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    name string
    The name of the Object Lambda Access Point.
    policy str
    The Object Lambda Access Point resource policy document.
    account_id str
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    name str
    The name of the Object Lambda Access Point.
    policy String
    The Object Lambda Access Point resource policy document.
    accountId String
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    name String
    The name of the Object Lambda Access Point.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ObjectLambdaAccessPointPolicy resource produces the following output properties:

    HasPublicAccessPolicy bool
    Indicates whether this access point currently has a policy that allows public access.
    Id string
    The provider-assigned unique ID for this managed resource.
    HasPublicAccessPolicy bool
    Indicates whether this access point currently has a policy that allows public access.
    Id string
    The provider-assigned unique ID for this managed resource.
    hasPublicAccessPolicy Boolean
    Indicates whether this access point currently has a policy that allows public access.
    id String
    The provider-assigned unique ID for this managed resource.
    hasPublicAccessPolicy boolean
    Indicates whether this access point currently has a policy that allows public access.
    id string
    The provider-assigned unique ID for this managed resource.
    has_public_access_policy bool
    Indicates whether this access point currently has a policy that allows public access.
    id str
    The provider-assigned unique ID for this managed resource.
    hasPublicAccessPolicy Boolean
    Indicates whether this access point currently has a policy that allows public access.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing ObjectLambdaAccessPointPolicy Resource

    Get an existing ObjectLambdaAccessPointPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ObjectLambdaAccessPointPolicyState, opts?: CustomResourceOptions): ObjectLambdaAccessPointPolicy
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_id: Optional[str] = None,
        has_public_access_policy: Optional[bool] = None,
        name: Optional[str] = None,
        policy: Optional[str] = None) -> ObjectLambdaAccessPointPolicy
    func GetObjectLambdaAccessPointPolicy(ctx *Context, name string, id IDInput, state *ObjectLambdaAccessPointPolicyState, opts ...ResourceOption) (*ObjectLambdaAccessPointPolicy, error)
    public static ObjectLambdaAccessPointPolicy Get(string name, Input<string> id, ObjectLambdaAccessPointPolicyState? state, CustomResourceOptions? opts = null)
    public static ObjectLambdaAccessPointPolicy get(String name, Output<String> id, ObjectLambdaAccessPointPolicyState state, CustomResourceOptions options)
    Resource lookup is not supported in YAML
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountId string
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    HasPublicAccessPolicy bool
    Indicates whether this access point currently has a policy that allows public access.
    Name string
    The name of the Object Lambda Access Point.
    Policy string
    The Object Lambda Access Point resource policy document.
    AccountId string
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    HasPublicAccessPolicy bool
    Indicates whether this access point currently has a policy that allows public access.
    Name string
    The name of the Object Lambda Access Point.
    Policy string
    The Object Lambda Access Point resource policy document.
    accountId String
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    hasPublicAccessPolicy Boolean
    Indicates whether this access point currently has a policy that allows public access.
    name String
    The name of the Object Lambda Access Point.
    policy String
    The Object Lambda Access Point resource policy document.
    accountId string
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    hasPublicAccessPolicy boolean
    Indicates whether this access point currently has a policy that allows public access.
    name string
    The name of the Object Lambda Access Point.
    policy string
    The Object Lambda Access Point resource policy document.
    account_id str
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    has_public_access_policy bool
    Indicates whether this access point currently has a policy that allows public access.
    name str
    The name of the Object Lambda Access Point.
    policy str
    The Object Lambda Access Point resource policy document.
    accountId String
    The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the AWS provider.
    hasPublicAccessPolicy Boolean
    Indicates whether this access point currently has a policy that allows public access.
    name String
    The name of the Object Lambda Access Point.
    policy String
    The Object Lambda Access Point resource policy document.

    Import

    Using pulumi import, import Object Lambda Access Point policies using the account_id and name, separated by a colon (:). For example:

    $ pulumi import aws:s3control/objectLambdaAccessPointPolicy:ObjectLambdaAccessPointPolicy example 123456789012:example

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo

    Try AWS Native preview for resources not in the classic version.

    AWS Classic v6.31.1 published on Thursday, Apr 18, 2024 by Pulumi
    pulumi/pulumi-aws