class ServicePrincipal
Language | Type name |
---|---|
![]() | Amazon.CDK.AWS.IAM.ServicePrincipal |
![]() | software.amazon.awscdk.services.iam.ServicePrincipal |
![]() | aws_cdk.aws_iam.ServicePrincipal |
![]() | @aws-cdk/aws-iam » ServicePrincipal |
Implements
IAssume
, IGrantable
, IPrincipal
, IComparable
Extends
Principal
An IAM principal that represents an AWS service (i.e. sqs.amazonaws.com).
Example
const lambdaRole = new iam.Role(this, 'Role', {
assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
description: 'Example role...',
});
const stream = new kinesis.Stream(this, 'MyEncryptedStream', {
encryption: kinesis.StreamEncryption.KMS,
});
// give lambda permissions to read stream
stream.grantRead(lambdaRole);
Initializer
new ServicePrincipal(service: string, opts?: ServicePrincipalOpts)
Parameters
- service
string
— AWS service (i.e. sqs.amazonaws.com). - opts
Service
Principal Opts
Properties
Name | Type | Description |
---|---|---|
assume | string | When this Principal is used in an AssumeRole policy, the action to use. |
grant | IPrincipal | The principal to grant permissions to. |
policy | Principal | Return the policy fragment that identifies this principal in a Policy. |
service | string | AWS service (i.e. sqs.amazonaws.com). |
principal | string | The AWS account ID of this principal. |
assumeRoleAction
Type:
string
When this Principal is used in an AssumeRole policy, the action to use.
grantPrincipal
Type:
IPrincipal
The principal to grant permissions to.
policyFragment
Type:
Principal
Return the policy fragment that identifies this principal in a Policy.
service
Type:
string
AWS service (i.e. sqs.amazonaws.com).
principalAccount?
Type:
string
(optional)
The AWS account ID of this principal.
Can be undefined when the account is not known (for example, for service principals). Can be a Token - in that case, it's assumed to be AWS::AccountId.
Methods
Name | Description |
---|---|
add | Add the princpial to the AssumeRolePolicyDocument. |
add | Add to the policy of this principal. |
add | Add to the policy of this principal. |
dedupe | Return whether or not this principal is equal to the given principal. |
to | JSON-ify the principal. |
to | Returns a string representation of an object. |
with | Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added. |
with | Returns a new principal using this principal as the base, with session tags enabled. |
static service | Translate the given service principal name based on the region it's used in. |
addToAssumeRolePolicy(document)
public addToAssumeRolePolicy(document: PolicyDocument): void
Parameters
- document
Policy
Document
Add the princpial to the AssumeRolePolicyDocument.
Add the statements to the AssumeRolePolicyDocument necessary to give this principal permissions to assume the given role.
addToPolicy(statement)
public addToPolicy(statement: PolicyStatement): boolean
Parameters
- statement
Policy
Statement
Returns
boolean
Add to the policy of this principal.
addToPrincipalPolicy(_statement)
public addToPrincipalPolicy(_statement: PolicyStatement): AddToPrincipalPolicyResult
Parameters
- _statement
Policy
Statement
Returns
Add to the policy of this principal.
dedupeString()
public dedupeString(): string
Returns
string
Return whether or not this principal is equal to the given principal.
toJSON()
public toJSON(): { [string]: string[] }
Returns
{ [string]: string[] }
JSON-ify the principal.
Used when JSON.stringify() is called
toString()
public toString(): string
Returns
string
Returns a string representation of an object.
withConditions(conditions)
public withConditions(conditions: { [string]: any }): PrincipalBase
Parameters
- conditions
{ [string]: any }
Returns
Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added.
When there is a value for the same operator and key in both the principal and the conditions parameter, the value from the conditions parameter will be used.
withSessionTags()
public withSessionTags(): PrincipalBase
Returns
Returns a new principal using this principal as the base, with session tags enabled.
static servicePrincipalName(service)
public static servicePrincipalName(service: string): string
Parameters
- service
string
Returns
string
Translate the given service principal name based on the region it's used in.
For example, for Chinese regions this may (depending on whether that's necessary
for the given service principal) append .cn
to the name.
The region-info
module is used to obtain this information.
Example
const principalName = iam.ServicePrincipal.servicePrincipalName('ec2.amazonaws.com');