tailscale.AwsExternalId

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as tailscale from "@pulumi/tailscale";

const prod = new tailscale.AwsExternalId("prod", {});
const tailscaleAssumeRole = aws.index.IamPolicyDocument({
    statement: [{
        actions: ["sts:AssumeRole"],
        principals: [{
            type: "AWS",
            identifiers: [prod.tailscaleAwsAccountId],
        }],
        condition: [{
            test: "StringEquals",
            variable: "sts:ExternalId",
            values: [prod.externalId],
        }],
    }],
});
const logsWriterIamRole = new aws.index.IamRole("logs_writer", {
    name: "logs-writer",
    assumeRolePolicy: tailscaleAssumeRole.json,
});
const configurationLogs = new tailscale.LogstreamConfiguration("configuration_logs", {
    logType: "configuration",
    destinationType: "s3",
    s3Bucket: tailscaleLogs.id,
    s3Region: "us-west-2",
    s3AuthenticationType: "rolearn",
    s3RoleArn: logsWriterIamRole.arn,
    s3ExternalId: prod.externalId,
});
const logsWriter = aws.index.IamPolicyDocument({
    statement: [{
        effect: "Allow",
        actions: ["s3:*"],
        resources: [
            "arn:aws:s3:::example-bucket",
            "arn:aws:s3:::example-bucket/*",
        ],
    }],
});
const logsWriterIamRolePolicy = new aws.index.IamRolePolicy("logs_writer", {
    role: logsWriterIamRole.id,
    policy: logsWriter.json,
});

import pulumi
import pulumi_aws as aws
import pulumi_tailscale as tailscale

prod = tailscale.AwsExternalId("prod")
tailscale_assume_role = aws.index.iam_policy_document(statement=[{
    "actions": ["sts:AssumeRole"],
    "principals": [{
        "type": "AWS",
        "identifiers": [prod.tailscale_aws_account_id],
    }],
    "condition": [{
        "test": "StringEquals",
        "variable": "sts:ExternalId",
        "values": [prod.external_id],
    }],
}])
logs_writer_iam_role = aws.index.IamRole("logs_writer",
    name=logs-writer,
    assume_role_policy=tailscale_assume_role.json)
configuration_logs = tailscale.LogstreamConfiguration("configuration_logs",
    log_type="configuration",
    destination_type="s3",
    s3_bucket=tailscale_logs["id"],
    s3_region="us-west-2",
    s3_authentication_type="rolearn",
    s3_role_arn=logs_writer_iam_role["arn"],
    s3_external_id=prod.external_id)
logs_writer = aws.index.iam_policy_document(statement=[{
    "effect": "Allow",
    "actions": ["s3:*"],
    "resources": [
        "arn:aws:s3:::example-bucket",
        "arn:aws:s3:::example-bucket/*",
    ],
}])
logs_writer_iam_role_policy = aws.index.IamRolePolicy("logs_writer",
    role=logs_writer_iam_role.id,
    policy=logs_writer.json)

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/go/aws"
	"github.com/pulumi/pulumi-tailscale/sdk/go/tailscale"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		prod, err := tailscale.NewAwsExternalId(ctx, "prod", nil)
		if err != nil {
			return err
		}
		tailscaleAssumeRole, err := aws.IamPolicyDocument(ctx, map[string]interface{}{
			"statement": []map[string]interface{}{
				map[string]interface{}{
					"actions": []string{
						"sts:AssumeRole",
					},
					"principals": []map[string]interface{}{
						map[string]interface{}{
							"type": "AWS",
							"identifiers": pulumi.StringArray{
								prod.TailscaleAwsAccountId,
							},
						},
					},
					"condition": []map[string]interface{}{
						map[string]interface{}{
							"test":     "StringEquals",
							"variable": "sts:ExternalId",
							"values": pulumi.StringArray{
								prod.ExternalId,
							},
						},
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		logsWriterIamRole, err := aws.NewIamRole(ctx, "logs_writer", &aws.IamRoleArgs{
			Name:             "logs-writer",
			AssumeRolePolicy: tailscaleAssumeRole.Json,
		})
		if err != nil {
			return err
		}
		_, err = tailscale.NewLogstreamConfiguration(ctx, "configuration_logs", &tailscale.LogstreamConfigurationArgs{
			LogType:              pulumi.String("configuration"),
			DestinationType:      pulumi.String("s3"),
			S3Bucket:             pulumi.Any(tailscaleLogs.Id),
			S3Region:             pulumi.String("us-west-2"),
			S3AuthenticationType: pulumi.String("rolearn"),
			S3RoleArn:            logsWriterIamRole.Arn,
			S3ExternalId:         prod.ExternalId,
		})
		if err != nil {
			return err
		}
		logsWriter, err := aws.IamPolicyDocument(ctx, map[string]interface{}{
			"statement": []map[string]interface{}{
				map[string]interface{}{
					"effect": "Allow",
					"actions": []string{
						"s3:*",
					},
					"resources": []string{
						"arn:aws:s3:::example-bucket",
						"arn:aws:s3:::example-bucket/*",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = aws.NewIamRolePolicy(ctx, "logs_writer", &aws.IamRolePolicyArgs{
			Role:   logsWriterIamRole.Id,
			Policy: logsWriter.Json,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
using Tailscale = Pulumi.Tailscale;

return await Deployment.RunAsync(() => 
{
    var prod = new Tailscale.AwsExternalId("prod");

    var tailscaleAssumeRole = Aws.Index.IamPolicyDocument.Invoke(new()
    {
        Statement = new[]
        {
            
            {
                { "actions", new[]
                {
                    "sts:AssumeRole",
                } },
                { "principals", new[]
                {
                    
                    {
                        { "type", "AWS" },
                        { "identifiers", new[]
                        {
                            prod.TailscaleAwsAccountId,
                        } },
                    },
                } },
                { "condition", new[]
                {
                    
                    {
                        { "test", "StringEquals" },
                        { "variable", "sts:ExternalId" },
                        { "values", new[]
                        {
                            prod.ExternalId,
                        } },
                    },
                } },
            },
        },
    });

    var logsWriterIamRole = new Aws.Index.IamRole("logs_writer", new()
    {
        Name = "logs-writer",
        AssumeRolePolicy = tailscaleAssumeRole.Json,
    });

    var configurationLogs = new Tailscale.LogstreamConfiguration("configuration_logs", new()
    {
        LogType = "configuration",
        DestinationType = "s3",
        S3Bucket = tailscaleLogs.Id,
        S3Region = "us-west-2",
        S3AuthenticationType = "rolearn",
        S3RoleArn = logsWriterIamRole.Arn,
        S3ExternalId = prod.ExternalId,
    });

    var logsWriter = Aws.Index.IamPolicyDocument.Invoke(new()
    {
        Statement = new[]
        {
            
            {
                { "effect", "Allow" },
                { "actions", new[]
                {
                    "s3:*",
                } },
                { "resources", new[]
                {
                    "arn:aws:s3:::example-bucket",
                    "arn:aws:s3:::example-bucket/*",
                } },
            },
        },
    });

    var logsWriterIamRolePolicy = new Aws.Index.IamRolePolicy("logs_writer", new()
    {
        Role = logsWriterIamRole.Id,
        Policy = logsWriter.Json,
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.tailscale.AwsExternalId;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.IamRole;
import com.pulumi.aws.IamRoleArgs;
import com.pulumi.tailscale.LogstreamConfiguration;
import com.pulumi.tailscale.LogstreamConfigurationArgs;
import com.pulumi.aws.IamRolePolicy;
import com.pulumi.aws.IamRolePolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var prod = new AwsExternalId("prod");

        final var tailscaleAssumeRole = AwsFunctions.IamPolicyDocument(Map.of("statement", List.of(Map.ofEntries(
            Map.entry("actions", List.of("sts:AssumeRole")),
            Map.entry("principals", List.of(Map.ofEntries(
                Map.entry("type", "AWS"),
                Map.entry("identifiers", List.of(prod.tailscaleAwsAccountId()))
            ))),
            Map.entry("condition", List.of(Map.ofEntries(
                Map.entry("test", "StringEquals"),
                Map.entry("variable", "sts:ExternalId"),
                Map.entry("values", List.of(prod.externalId()))
            )))
        ))));

        var logsWriterIamRole = new IamRole("logsWriterIamRole", IamRoleArgs.builder()
            .name("logs-writer")
            .assumeRolePolicy(tailscaleAssumeRole.json())
            .build());

        var configurationLogs = new LogstreamConfiguration("configurationLogs", LogstreamConfigurationArgs.builder()
            .logType("configuration")
            .destinationType("s3")
            .s3Bucket(tailscaleLogs.id())
            .s3Region("us-west-2")
            .s3AuthenticationType("rolearn")
            .s3RoleArn(logsWriterIamRole.arn())
            .s3ExternalId(prod.externalId())
            .build());

        final var logsWriter = AwsFunctions.IamPolicyDocument(Map.of("statement", Map.ofEntries(
            Map.entry("effect", "Allow"),
            Map.entry("actions", "s3:*"),
            Map.entry("resources",             
                "arn:aws:s3:::example-bucket",
                "arn:aws:s3:::example-bucket/*")
        )));

        var logsWriterIamRolePolicy = new IamRolePolicy("logsWriterIamRolePolicy", IamRolePolicyArgs.builder()
            .role(logsWriterIamRole.id())
            .policy(logsWriter.json())
            .build());

    }
}

resources:
  prod:
    type: tailscale:AwsExternalId
  configurationLogs:
    type: tailscale:LogstreamConfiguration
    name: configuration_logs
    properties:
      logType: configuration
      destinationType: s3
      s3Bucket: ${tailscaleLogs.id}
      s3Region: us-west-2
      s3AuthenticationType: rolearn
      s3RoleArn: ${logsWriterIamRole.arn}
      s3ExternalId: ${prod.externalId}
  logsWriterIamRole:
    type: aws:IamRole
    name: logs_writer
    properties:
      name: logs-writer
      assumeRolePolicy: ${tailscaleAssumeRole.json}
  logsWriterIamRolePolicy:
    type: aws:IamRolePolicy
    name: logs_writer
    properties:
      role: ${logsWriterIamRole.id}
      policy: ${logsWriter.json}
variables:
  tailscaleAssumeRole:
    fn::invoke:
      function: aws:IamPolicyDocument
      arguments:
        statement:
          - actions:
              - sts:AssumeRole
            principals:
              - type: AWS
                identifiers:
                  - ${prod.tailscaleAwsAccountId}
            condition:
              - test: StringEquals
                variable: sts:ExternalId
                values:
                  - ${prod.externalId}
  logsWriter:
    fn::invoke:
      function: aws:IamPolicyDocument
      arguments:
        statement:
          - effect: Allow
            actions:
              - s3:*
            resources:
              - arn:aws:s3:::example-bucket
              - arn:aws:s3:::example-bucket/*

var awsExternalIdResource = new Tailscale.AwsExternalId("awsExternalIdResource");

example, err := tailscale.NewAwsExternalId(ctx, "awsExternalIdResource", nil)

var awsExternalIdResource = new AwsExternalId("awsExternalIdResource");

aws_external_id_resource = tailscale.AwsExternalId("awsExternalIdResource")

const awsExternalIdResource = new tailscale.AwsExternalId("awsExternalIdResource", {});

type: tailscale:AwsExternalId
properties: {}