1. Packages
  2. AWS Classic
  3. API Docs
  4. ssoadmin
  5. CustomerManagedPolicyAttachment

Try AWS Native preview for resources not in the classic version.

AWS Classic v6.44.0 published on Monday, Jul 8, 2024 by Pulumi

aws.ssoadmin.CustomerManagedPolicyAttachment

Explore with Pulumi AI

aws logo

Try AWS Native preview for resources not in the classic version.

AWS Classic v6.44.0 published on Monday, Jul 8, 2024 by Pulumi

    Provides a customer managed policy attachment for a Single Sign-On (SSO) Permission Set resource

    NOTE: Creating this resource will automatically Provision the Permission Set to apply the corresponding updates to all assigned accounts.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
    import * as aws from "@pulumi/aws";
    
    const example = aws.ssoadmin.getInstances({});
    const examplePermissionSet = new aws.ssoadmin.PermissionSet("example", {
        name: "Example",
        instanceArn: example.then(example => example.arns?.[0]),
    });
    const examplePolicy = new aws.iam.Policy("example", {
        name: "TestPolicy",
        description: "My test policy",
        policy: JSON.stringify({
            Version: "2012-10-17",
            Statement: [{
                Action: ["ec2:Describe*"],
                Effect: "Allow",
                Resource: "*",
            }],
        }),
    });
    const exampleCustomerManagedPolicyAttachment = new aws.ssoadmin.CustomerManagedPolicyAttachment("example", {
        instanceArn: examplePermissionSet.instanceArn,
        permissionSetArn: examplePermissionSet.arn,
        customerManagedPolicyReference: {
            name: examplePolicy.name,
            path: "/",
        },
    });
    
    import pulumi
    import json
    import pulumi_aws as aws
    
    example = aws.ssoadmin.get_instances()
    example_permission_set = aws.ssoadmin.PermissionSet("example",
        name="Example",
        instance_arn=example.arns[0])
    example_policy = aws.iam.Policy("example",
        name="TestPolicy",
        description="My test policy",
        policy=json.dumps({
            "Version": "2012-10-17",
            "Statement": [{
                "Action": ["ec2:Describe*"],
                "Effect": "Allow",
                "Resource": "*",
            }],
        }))
    example_customer_managed_policy_attachment = aws.ssoadmin.CustomerManagedPolicyAttachment("example",
        instance_arn=example_permission_set.instance_arn,
        permission_set_arn=example_permission_set.arn,
        customer_managed_policy_reference={
            "name": example_policy.name,
            "path": "/",
        })
    
    package main
    
    import (
    	"encoding/json"
    
    	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/iam"
    	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/ssoadmin"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		example, err := ssoadmin.GetInstances(ctx, nil, nil)
    		if err != nil {
    			return err
    		}
    		examplePermissionSet, err := ssoadmin.NewPermissionSet(ctx, "example", &ssoadmin.PermissionSetArgs{
    			Name:        pulumi.String("Example"),
    			InstanceArn: pulumi.String(example.Arns[0]),
    		})
    		if err != nil {
    			return err
    		}
    		tmpJSON0, err := json.Marshal(map[string]interface{}{
    			"Version": "2012-10-17",
    			"Statement": []map[string]interface{}{
    				map[string]interface{}{
    					"Action": []string{
    						"ec2:Describe*",
    					},
    					"Effect":   "Allow",
    					"Resource": "*",
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		json0 := string(tmpJSON0)
    		examplePolicy, err := iam.NewPolicy(ctx, "example", &iam.PolicyArgs{
    			Name:        pulumi.String("TestPolicy"),
    			Description: pulumi.String("My test policy"),
    			Policy:      pulumi.String(json0),
    		})
    		if err != nil {
    			return err
    		}
    		_, err = ssoadmin.NewCustomerManagedPolicyAttachment(ctx, "example", &ssoadmin.CustomerManagedPolicyAttachmentArgs{
    			InstanceArn:      examplePermissionSet.InstanceArn,
    			PermissionSetArn: examplePermissionSet.Arn,
    			CustomerManagedPolicyReference: &ssoadmin.CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs{
    				Name: examplePolicy.Name,
    				Path: pulumi.String("/"),
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using System.Text.Json;
    using Pulumi;
    using Aws = Pulumi.Aws;
    
    return await Deployment.RunAsync(() => 
    {
        var example = Aws.SsoAdmin.GetInstances.Invoke();
    
        var examplePermissionSet = new Aws.SsoAdmin.PermissionSet("example", new()
        {
            Name = "Example",
            InstanceArn = example.Apply(getInstancesResult => getInstancesResult.Arns[0]),
        });
    
        var examplePolicy = new Aws.Iam.Policy("example", new()
        {
            Name = "TestPolicy",
            Description = "My test policy",
            PolicyDocument = JsonSerializer.Serialize(new Dictionary<string, object?>
            {
                ["Version"] = "2012-10-17",
                ["Statement"] = new[]
                {
                    new Dictionary<string, object?>
                    {
                        ["Action"] = new[]
                        {
                            "ec2:Describe*",
                        },
                        ["Effect"] = "Allow",
                        ["Resource"] = "*",
                    },
                },
            }),
        });
    
        var exampleCustomerManagedPolicyAttachment = new Aws.SsoAdmin.CustomerManagedPolicyAttachment("example", new()
        {
            InstanceArn = examplePermissionSet.InstanceArn,
            PermissionSetArn = examplePermissionSet.Arn,
            CustomerManagedPolicyReference = new Aws.SsoAdmin.Inputs.CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs
            {
                Name = examplePolicy.Name,
                Path = "/",
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.aws.ssoadmin.SsoadminFunctions;
    import com.pulumi.aws.ssoadmin.PermissionSet;
    import com.pulumi.aws.ssoadmin.PermissionSetArgs;
    import com.pulumi.aws.iam.Policy;
    import com.pulumi.aws.iam.PolicyArgs;
    import com.pulumi.aws.ssoadmin.CustomerManagedPolicyAttachment;
    import com.pulumi.aws.ssoadmin.CustomerManagedPolicyAttachmentArgs;
    import com.pulumi.aws.ssoadmin.inputs.CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs;
    import static com.pulumi.codegen.internal.Serialization.*;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            final var example = SsoadminFunctions.getInstances();
    
            var examplePermissionSet = new PermissionSet("examplePermissionSet", PermissionSetArgs.builder()
                .name("Example")
                .instanceArn(example.applyValue(getInstancesResult -> getInstancesResult.arns()[0]))
                .build());
    
            var examplePolicy = new Policy("examplePolicy", PolicyArgs.builder()
                .name("TestPolicy")
                .description("My test policy")
                .policy(serializeJson(
                    jsonObject(
                        jsonProperty("Version", "2012-10-17"),
                        jsonProperty("Statement", jsonArray(jsonObject(
                            jsonProperty("Action", jsonArray("ec2:Describe*")),
                            jsonProperty("Effect", "Allow"),
                            jsonProperty("Resource", "*")
                        )))
                    )))
                .build());
    
            var exampleCustomerManagedPolicyAttachment = new CustomerManagedPolicyAttachment("exampleCustomerManagedPolicyAttachment", CustomerManagedPolicyAttachmentArgs.builder()
                .instanceArn(examplePermissionSet.instanceArn())
                .permissionSetArn(examplePermissionSet.arn())
                .customerManagedPolicyReference(CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs.builder()
                    .name(examplePolicy.name())
                    .path("/")
                    .build())
                .build());
    
        }
    }
    
    resources:
      examplePermissionSet:
        type: aws:ssoadmin:PermissionSet
        name: example
        properties:
          name: Example
          instanceArn: ${example.arns[0]}
      examplePolicy:
        type: aws:iam:Policy
        name: example
        properties:
          name: TestPolicy
          description: My test policy
          policy:
            fn::toJSON:
              Version: 2012-10-17
              Statement:
                - Action:
                    - ec2:Describe*
                  Effect: Allow
                  Resource: '*'
      exampleCustomerManagedPolicyAttachment:
        type: aws:ssoadmin:CustomerManagedPolicyAttachment
        name: example
        properties:
          instanceArn: ${examplePermissionSet.instanceArn}
          permissionSetArn: ${examplePermissionSet.arn}
          customerManagedPolicyReference:
            name: ${examplePolicy.name}
            path: /
    variables:
      example:
        fn::invoke:
          Function: aws:ssoadmin:getInstances
          Arguments: {}
    

    Create CustomerManagedPolicyAttachment Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new CustomerManagedPolicyAttachment(name: string, args: CustomerManagedPolicyAttachmentArgs, opts?: CustomResourceOptions);
    @overload
    def CustomerManagedPolicyAttachment(resource_name: str,
                                        args: CustomerManagedPolicyAttachmentArgs,
                                        opts: Optional[ResourceOptions] = None)
    
    @overload
    def CustomerManagedPolicyAttachment(resource_name: str,
                                        opts: Optional[ResourceOptions] = None,
                                        customer_managed_policy_reference: Optional[CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs] = None,
                                        instance_arn: Optional[str] = None,
                                        permission_set_arn: Optional[str] = None)
    func NewCustomerManagedPolicyAttachment(ctx *Context, name string, args CustomerManagedPolicyAttachmentArgs, opts ...ResourceOption) (*CustomerManagedPolicyAttachment, error)
    public CustomerManagedPolicyAttachment(string name, CustomerManagedPolicyAttachmentArgs args, CustomResourceOptions? opts = null)
    public CustomerManagedPolicyAttachment(String name, CustomerManagedPolicyAttachmentArgs args)
    public CustomerManagedPolicyAttachment(String name, CustomerManagedPolicyAttachmentArgs args, CustomResourceOptions options)
    
    type: aws:ssoadmin:CustomerManagedPolicyAttachment
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    

    Parameters

    name string
    The unique name of the resource.
    args CustomerManagedPolicyAttachmentArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args CustomerManagedPolicyAttachmentArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args CustomerManagedPolicyAttachmentArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args CustomerManagedPolicyAttachmentArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args CustomerManagedPolicyAttachmentArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var customerManagedPolicyAttachmentResource = new Aws.SsoAdmin.CustomerManagedPolicyAttachment("customerManagedPolicyAttachmentResource", new()
    {
        CustomerManagedPolicyReference = new Aws.SsoAdmin.Inputs.CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs
        {
            Name = "string",
            Path = "string",
        },
        InstanceArn = "string",
        PermissionSetArn = "string",
    });
    
    example, err := ssoadmin.NewCustomerManagedPolicyAttachment(ctx, "customerManagedPolicyAttachmentResource", &ssoadmin.CustomerManagedPolicyAttachmentArgs{
    	CustomerManagedPolicyReference: &ssoadmin.CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs{
    		Name: pulumi.String("string"),
    		Path: pulumi.String("string"),
    	},
    	InstanceArn:      pulumi.String("string"),
    	PermissionSetArn: pulumi.String("string"),
    })
    
    var customerManagedPolicyAttachmentResource = new CustomerManagedPolicyAttachment("customerManagedPolicyAttachmentResource", CustomerManagedPolicyAttachmentArgs.builder()
        .customerManagedPolicyReference(CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs.builder()
            .name("string")
            .path("string")
            .build())
        .instanceArn("string")
        .permissionSetArn("string")
        .build());
    
    customer_managed_policy_attachment_resource = aws.ssoadmin.CustomerManagedPolicyAttachment("customerManagedPolicyAttachmentResource",
        customer_managed_policy_reference={
            "name": "string",
            "path": "string",
        },
        instance_arn="string",
        permission_set_arn="string")
    
    const customerManagedPolicyAttachmentResource = new aws.ssoadmin.CustomerManagedPolicyAttachment("customerManagedPolicyAttachmentResource", {
        customerManagedPolicyReference: {
            name: "string",
            path: "string",
        },
        instanceArn: "string",
        permissionSetArn: "string",
    });
    
    type: aws:ssoadmin:CustomerManagedPolicyAttachment
    properties:
        customerManagedPolicyReference:
            name: string
            path: string
        instanceArn: string
        permissionSetArn: string
    

    CustomerManagedPolicyAttachment Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The CustomerManagedPolicyAttachment resource accepts the following input properties:

    CustomerManagedPolicyReference CustomerManagedPolicyAttachmentCustomerManagedPolicyReference
    Specifies the name and path of a customer managed policy. See below.
    InstanceArn string
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    PermissionSetArn string
    The Amazon Resource Name (ARN) of the Permission Set.
    CustomerManagedPolicyReference CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs
    Specifies the name and path of a customer managed policy. See below.
    InstanceArn string
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    PermissionSetArn string
    The Amazon Resource Name (ARN) of the Permission Set.
    customerManagedPolicyReference CustomerManagedPolicyAttachmentCustomerManagedPolicyReference
    Specifies the name and path of a customer managed policy. See below.
    instanceArn String
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    permissionSetArn String
    The Amazon Resource Name (ARN) of the Permission Set.
    customerManagedPolicyReference CustomerManagedPolicyAttachmentCustomerManagedPolicyReference
    Specifies the name and path of a customer managed policy. See below.
    instanceArn string
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    permissionSetArn string
    The Amazon Resource Name (ARN) of the Permission Set.
    customer_managed_policy_reference CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs
    Specifies the name and path of a customer managed policy. See below.
    instance_arn str
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    permission_set_arn str
    The Amazon Resource Name (ARN) of the Permission Set.
    customerManagedPolicyReference Property Map
    Specifies the name and path of a customer managed policy. See below.
    instanceArn String
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    permissionSetArn String
    The Amazon Resource Name (ARN) of the Permission Set.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the CustomerManagedPolicyAttachment resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing CustomerManagedPolicyAttachment Resource

    Get an existing CustomerManagedPolicyAttachment resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: CustomerManagedPolicyAttachmentState, opts?: CustomResourceOptions): CustomerManagedPolicyAttachment
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            customer_managed_policy_reference: Optional[CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs] = None,
            instance_arn: Optional[str] = None,
            permission_set_arn: Optional[str] = None) -> CustomerManagedPolicyAttachment
    func GetCustomerManagedPolicyAttachment(ctx *Context, name string, id IDInput, state *CustomerManagedPolicyAttachmentState, opts ...ResourceOption) (*CustomerManagedPolicyAttachment, error)
    public static CustomerManagedPolicyAttachment Get(string name, Input<string> id, CustomerManagedPolicyAttachmentState? state, CustomResourceOptions? opts = null)
    public static CustomerManagedPolicyAttachment get(String name, Output<String> id, CustomerManagedPolicyAttachmentState state, CustomResourceOptions options)
    Resource lookup is not supported in YAML
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CustomerManagedPolicyReference CustomerManagedPolicyAttachmentCustomerManagedPolicyReference
    Specifies the name and path of a customer managed policy. See below.
    InstanceArn string
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    PermissionSetArn string
    The Amazon Resource Name (ARN) of the Permission Set.
    CustomerManagedPolicyReference CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs
    Specifies the name and path of a customer managed policy. See below.
    InstanceArn string
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    PermissionSetArn string
    The Amazon Resource Name (ARN) of the Permission Set.
    customerManagedPolicyReference CustomerManagedPolicyAttachmentCustomerManagedPolicyReference
    Specifies the name and path of a customer managed policy. See below.
    instanceArn String
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    permissionSetArn String
    The Amazon Resource Name (ARN) of the Permission Set.
    customerManagedPolicyReference CustomerManagedPolicyAttachmentCustomerManagedPolicyReference
    Specifies the name and path of a customer managed policy. See below.
    instanceArn string
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    permissionSetArn string
    The Amazon Resource Name (ARN) of the Permission Set.
    customer_managed_policy_reference CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs
    Specifies the name and path of a customer managed policy. See below.
    instance_arn str
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    permission_set_arn str
    The Amazon Resource Name (ARN) of the Permission Set.
    customerManagedPolicyReference Property Map
    Specifies the name and path of a customer managed policy. See below.
    instanceArn String
    The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
    permissionSetArn String
    The Amazon Resource Name (ARN) of the Permission Set.

    Supporting Types

    CustomerManagedPolicyAttachmentCustomerManagedPolicyReference, CustomerManagedPolicyAttachmentCustomerManagedPolicyReferenceArgs

    Name string
    Name of the customer managed IAM Policy to be attached.
    Path string
    The path to the IAM policy to be attached. The default is /. See IAM Identifiers for more information.
    Name string
    Name of the customer managed IAM Policy to be attached.
    Path string
    The path to the IAM policy to be attached. The default is /. See IAM Identifiers for more information.
    name String
    Name of the customer managed IAM Policy to be attached.
    path String
    The path to the IAM policy to be attached. The default is /. See IAM Identifiers for more information.
    name string
    Name of the customer managed IAM Policy to be attached.
    path string
    The path to the IAM policy to be attached. The default is /. See IAM Identifiers for more information.
    name str
    Name of the customer managed IAM Policy to be attached.
    path str
    The path to the IAM policy to be attached. The default is /. See IAM Identifiers for more information.
    name String
    Name of the customer managed IAM Policy to be attached.
    path String
    The path to the IAM policy to be attached. The default is /. See IAM Identifiers for more information.

    Import

    Using pulumi import, import SSO Managed Policy Attachments using the name, path, permission_set_arn, and instance_arn separated by a comma (,). For example:

    $ pulumi import aws:ssoadmin/customerManagedPolicyAttachment:CustomerManagedPolicyAttachment example TestPolicy,/,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
    

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo

    Try AWS Native preview for resources not in the classic version.

    AWS Classic v6.44.0 published on Monday, Jul 8, 2024 by Pulumi