aws-cdk.aws-iam

AWS IAM Construct Library

Define a role and add permissions to it. This will automatically create and attach an IAM policy to the role:

    const role = new Role(this, 'MyRole', {
      assumedBy: new ServicePrincipal('sns.amazonaws.com')
    });

    role.addToPolicy(new PolicyStatement()
        .addAllResources()
        .addAction('lambda:InvokeFunction'));

Define a policy and attach it to groups, users and roles. Note that it is possible to attach the policy either by calling xxx.attachInlinePolicy(policy) or policy.attachToXxx(xxx).

    const user = new User(this, 'MyUser', { password: SecretValue.plainText('1234') });
    const group = new Group(this, 'MyGroup');

    const policy = new Policy(this, 'MyPolicy');
    policy.attachToUser(user);
    group.attachInlinePolicy(policy);

Managed policies can be attached using xxx.attachManagedPolicy(arn):

const group = new Group(this, 'MyGroup');
group.attachManagedPolicy('arn:aws:iam::aws:policy/AdministratorAccess');

Configuring an ExternalId

If you need to create roles that will be assumed by 3rd parties, it is generally a good idea to require an ExternalId to assume them. Configuring an ExternalId works like this:

const role = new iam.Role(this, 'MyRole', {
  assumedBy: new iam.AccountPrincipal('123456789012'),
  externalId: 'SUPPLY-ME',
});

Principals vs Identities

When we say Principal, we mean an entity you grant permissions to. This entity can be an AWS Service, a Role, or something more abstract such as "all users in this account" or even "all users in this organization". An Identity is an IAM representing a single IAM entity that can have a policy attached, one of Role, User, or Group.

IAM Principals

When defining policy statements as part of an AssumeRole policy or as part of a resource policy, statements would usually refer to a specific IAM principal under Principal.

IAM principals are modeled as classes that derive from the iam.PolicyPrincipal abstract class. Principal objects include principal type (string) and value (array of string), optional set of conditions and the action that this principal requires when it is used in an assume role policy document.

To add a principal to a policy statement you can either use the abstract statement.addPrincipal, one of the concrete addXxxPrincipal methods:

addAwsPrincipal, addArnPrincipal or new ArnPrincipal(arn) for { "AWS": arn }
addAwsAccountPrincipal or new AccountPrincipal(accountId) for { "AWS": account-arn }
addServicePrincipal or new ServicePrincipal(service) for { "Service": service }
addAccountRootPrincipal or new AccountRootPrincipal() for { "AWS": { "Ref: "AWS::AccountId" } }
addCanonicalUserPrincipal or new CanonicalUserPrincipal(id) for { "CanonicalUser": id }
addFederatedPrincipal or new FederatedPrincipal(federated, conditions, assumeAction) for { "Federated": arn } and a set of optional conditions and the assume role action to use.
addAnyPrincipal or new AnyPrincipal for { "AWS": "*" }

If multiple principals are added to the policy statement, they will be merged together:

const statement = new PolicyStatement();
statement.addServicePrincipal('cloudwatch.amazonaws.com');
statement.addServicePrincipal('ec2.amazonaws.com');
statement.addAwsPrincipal('arn:aws:boom:boom');

Will result in:

{
  "Principal": {
    "Service": [ "cloudwatch.amazonaws.com", "ec2.amazonaws.com" ],
    "AWS": "arn:aws:boom:boom"
  }
}

The CompositePrincipal class can also be used to define complex principals, for example:

const role = new iam.Role(this, 'MyRole', {
  assumedBy: new iam.CompositePrincipal(
    new iam.ServicePrincipal('ec2.amazonawas.com'),
    new iam.AccountPrincipal('1818188181818187272')
  )
});

Features

Policy name uniqueness is enforced. If two policies by the same name are attached to the same principal, the attachment will fail.
Policy names are not required - the CDK logical ID will be used and ensured to be unique.

Release files for aws-cdk.aws-iam 0.28.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for aws-cdk.aws-iam 0.28.0
File	Size	Uploaded
aws-cdk.aws-iam-0.28.0.tar.gz	140.6 kB	Apr 4, 2019	Details

Built distribution (wheel)

Table of built distributions (wheels) for aws-cdk.aws-iam 0.28.0
File	Interpreter	ABI	Platform	Reset
aws_cdk.aws_iam-0.28.0-py3-none-any.whl 138.4 kB Apr 4, 2019	Python 3	none	any	Details

Total release size: 279.0 kB

Release files / aws-cdk.aws-iam-0.28.0.tar.gz

Download URL	aws-cdk.aws-iam-0.28.0.tar.gz
Size	140.6 kB
Tags	Source
SHA-256 checksum How to use checksums	`98212ec862e8c723a604b8a15d75747d334d1325832384c9e6c2a0492b927929`
BLAKE2b-256 checksum How to use checksums	`9896afc6ad4fdeaf7bcb94e215ee7256ecb16580f4c028e3eb1423419e8cd6fc`
Upload date	Apr 4, 2019
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/1.13.0 pkginfo/1.5.0.1 requests/2.21.0 setuptools/39.0.1 requests-toolbelt/0.9.1 tqdm/4.31.1 CPython/3.6.5`

Release files / aws_cdk.aws_iam-0.28.0-py3-none-any.whl

Download URL	aws_cdk.aws_iam-0.28.0-py3-none-any.whl
Size	138.4 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`50fd128b744191c17567b2c9706ef0bd0fab6db69eede84effe1a12bf27a8fce`
BLAKE2b-256 checksum How to use checksums	`8a114e8ca08878799e691656046bfbd1f96818412bd0d9b2422d67748c25f270`
Upload date	Apr 4, 2019
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/1.13.0 pkginfo/1.5.0.1 requests/2.21.0 setuptools/39.0.1 requests-toolbelt/0.9.1 tqdm/4.31.1 CPython/3.6.5`