Package software.amazon.awscdk.services.iam
AWS Identity and Access Management Construct Library
Security and Safety Dev Guide
For a detailed guide on CDK security and safety please see the CDK Security And Safety Dev Guide
The guide will cover topics like:
- What permissions to extend to CDK deployments
- How to control the permissions of CDK deployments via IAM identities and policies
- How to use CDK to configure the IAM identities and policies of deployed applications
- Using Permissions Boundaries with CDK
Overview
Define a role and add permissions to it. This will automatically create and attach an IAM policy to the role:
Role role = Role.Builder.create(this, "MyRole") .assumedBy(new ServicePrincipal("sns.amazonaws.com")) .build(); role.addToPolicy(PolicyStatement.Builder.create() .resources(List.of("*")) .actions(List.of("lambda:InvokeFunction")) .build());
Define a policy and attach it to groups, users and roles. Note that it is possible to attach
the policy either by calling xxx.attachInlinePolicy(policy)
or policy.attachToXxx(xxx)
.
User user = User.Builder.create(this, "MyUser").password(SecretValue.plainText("1234")).build(); Group group = new Group(this, "MyGroup"); Policy policy = new Policy(this, "MyPolicy"); policy.attachToUser(user); group.attachInlinePolicy(policy);
Managed policies can be attached using xxx.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName(policyName))
:
Group group = new Group(this, "MyGroup"); group.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess"));
Granting permissions to resources
Many of the AWS CDK resources have grant*
methods that allow you to grant other resources access to that resource. As an example, the following code gives a Lambda function write permissions (Put, Update, Delete) to a DynamoDB table.
Function fn; Table table; table.grantWriteData(fn);
The more generic grant
method allows you to give specific permissions to a resource:
Function fn; Table table; table.grant(fn, "dynamodb:PutItem");
The grant*
methods accept an IGrantable
object. This interface is implemented by IAM principal resources (groups, users and roles), policies, managed policies and resources that assume a role such as a Lambda function, EC2 instance or a Codebuild project.
You can find which grant*
methods exist for a resource in the AWS CDK API Reference.
Roles
Many AWS resources require Roles to operate. These Roles define the AWS API calls an instance or other AWS service is allowed to make.
Creating Roles and populating them with the right permissions Statements is a necessary but tedious part of setting up AWS infrastructure. In order to help you focus on your business logic, CDK will take care of creating roles and populating them with least-privilege permissions automatically.
All constructs that require Roles will create one for you if don't specify
one at construction time. Permissions will be added to that role
automatically if you associate the construct with other constructs from the
AWS Construct Library (for example, if you tell an AWS CodePipeline to trigger
an AWS Lambda Function, the Pipeline's Role will automatically get
lambda:InvokeFunction
permissions on that particular Lambda Function),
or if you explicitly grant permissions using grant
functions (see the
previous section).
Opting out of automatic permissions management
You may prefer to manage a Role's permissions yourself instead of having the CDK automatically manage them for you. This may happen in one of the following cases:
- You don't like the permissions that CDK automatically generates and want to substitute your own set.
- The least-permissions policy that the CDK generates is becoming too big for IAM to store, and you need to add some wildcards to keep the policy size down.
To prevent constructs from updating your Role's policy, pass the object
returned by myRole.withoutPolicyUpdates()
instead of myRole
itself.
For example, to have an AWS CodePipeline not automatically add the required permissions to trigger the expected targets, do the following:
Role role = Role.Builder.create(this, "Role") .assumedBy(new ServicePrincipal("codepipeline.amazonaws.com")) // custom description if desired .description("This is a custom role...") .build(); Pipeline.Builder.create(this, "Pipeline") // Give the Pipeline an immutable view of the Role .role(role.withoutPolicyUpdates()) .build(); // You now have to manage the Role policies yourself role.addToPolicy(PolicyStatement.Builder.create() .actions(List.of()) .resources(List.of()) .build());
Using existing roles
If there are Roles in your account that have already been created which you
would like to use in your CDK application, you can use Role.fromRoleArn
to
import them, as follows:
IRole role = Role.fromRoleArn(this, "Role", "arn:aws:iam::123456789012:role/MyExistingRole", FromRoleArnOptions.builder() // Set 'mutable' to 'false' to use the role as-is and prevent adding new // policies to it. The default is 'true', which means the role may be // modified as part of the deployment. .mutable(false) .build());
Customizing role creation
It is best practice to allow CDK to manage IAM roles and permissions. You can prevent CDK from
creating roles by using the customizeRoles
method for special cases. One such case is using CDK in
an environment where role creation is not allowed or needs to be managed through a process outside
of the CDK application.
An example of how to opt in to this behavior is below:
Stack stack; Role.customizeRoles(stack);
CDK will not create any IAM roles or policies with the stack
scope. cdk synth
will fail and
it will generate a policy report to the cloud assembly (i.e. cdk.out). The iam-policy-report.txt
report will contain a list of IAM roles and associated permissions that would have been created.
This report can be used to create the roles with the appropriate permissions outside of
the CDK application.
Once the missing roles have been created, their names can be added to the usePrecreatedRoles
property, like shown below:
App app; Stack stack = new Stack(app, "MyStack"); Role.customizeRoles(this, CustomizeRolesOptions.builder() .usePrecreatedRoles(Map.of( "MyStack/MyRole", "my-precreated-role-name")) .build()); Role.Builder.create(this, "MyRole") .assumedBy(new ServicePrincipal("sns.amazonaws.com")) .build();
If any IAM policies reference deploy time values (i.e. ARN of a resource that hasn't been created yet) you will have to modify the generated report to be more generic. For example, given the following CDK code:
App app; Stack stack = new Stack(app, "MyStack"); Role.customizeRoles(stack); Function fn = Function.Builder.create(this, "MyLambda") .code(new InlineCode("foo")) .handler("index.handler") .runtime(Runtime.NODEJS_LATEST) .build(); Bucket bucket = new Bucket(this, "Bucket"); bucket.grantRead(fn);
The following report will be generated.
<missing role> (MyStack/MyLambda/ServiceRole) AssumeRole Policy: [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ] Managed Policy ARNs: [ "arn:(PARTITION):iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] Managed Policies Statements: NONE Identity Policy Statements: [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*" ], "Effect": "Allow", "Resource": [ "(MyStack/Bucket/Resource.Arn)", "(MyStack/Bucket/Resource.Arn)/*" ] } ]
You would then need to create the role with the inline & managed policies in the report and then
come back and update the customizeRoles
with the role name.
App app; Stack stack = new Stack(app, "MyStack"); Role.customizeRoles(this, CustomizeRolesOptions.builder() .usePrecreatedRoles(Map.of( "MyStack/MyLambda/ServiceRole", "my-role-name")) .build());
For more information on configuring permissions see the Security And Safety Dev Guide
Generating a permissions report
It is also possible to generate the report without preventing the role/policy creation.
Stack stack; Role.customizeRoles(this, CustomizeRolesOptions.builder() .preventSynthesis(false) .build());
Configuring an ExternalId
If you need to create Roles that will be assumed by third parties, it is generally a good idea to require an ExternalId
to assume them. Configuring
an ExternalId
works like this:
Role role = Role.Builder.create(this, "MyRole") .assumedBy(new AccountPrincipal("123456789012")) .externalIds(List.of("SUPPLY-ME")) .build();
SourceArn and SourceAccount
If you need to create resource policies using aws:SourceArn
and aws:SourceAccount
for cross-service resource access,
use addSourceArnCondition
and addSourceAccountCondition
to create the conditions.
See Cross-service confused deputy prevention for more details.
Principals vs Identities
When we say Principal, we mean an entity you grant permissions to. This
entity can be an AWS Service, a Role, or something more abstract such as "all
users in this account" or even "all users in this organization". An
Identity is an IAM representing a single IAM entity that can have
a policy attached, one of Role
, User
, or Group
.
IAM Principals
When defining policy statements as part of an AssumeRole policy or as part of a
resource policy, statements would usually refer to a specific IAM principal
under Principal
.
IAM principals are modeled as classes that derive from the iam.PolicyPrincipal
abstract class. Principal objects include principal type (string) and value
(array of string), optional set of conditions and the action that this principal
requires when it is used in an assume role policy document.
To add a principal to a policy statement you can either use the abstract
statement.addPrincipal
, one of the concrete addXxxPrincipal
methods:
addAwsPrincipal
,addArnPrincipal
ornew ArnPrincipal(arn)
for{ "AWS": arn }
addAwsAccountPrincipal
ornew AccountPrincipal(accountId)
for{ "AWS": account-arn }
addServicePrincipal
ornew ServicePrincipal(service)
for{ "Service": service }
addAccountRootPrincipal
ornew AccountRootPrincipal()
for{ "AWS": { "Ref: "AWS::AccountId" } }
addCanonicalUserPrincipal
ornew CanonicalUserPrincipal(id)
for{ "CanonicalUser": id }
addFederatedPrincipal
ornew FederatedPrincipal(federated, conditions, assumeAction)
for{ "Federated": arn }
and a set of optional conditions and the assume role action to use.addAnyPrincipal
ornew AnyPrincipal
for{ "AWS": "*" }
If multiple principals are added to the policy statement, they will be merged together:
PolicyStatement statement = new PolicyStatement(); statement.addServicePrincipal("cloudwatch.amazonaws.com"); statement.addServicePrincipal("ec2.amazonaws.com"); statement.addArnPrincipal("arn:aws:boom:boom");
Will result in:
{ "Principal": { "Service": [ "cloudwatch.amazonaws.com", "ec2.amazonaws.com" ], "AWS": "arn:aws:boom:boom" } }
The CompositePrincipal
class can also be used to define complex principals, for example:
Role role = Role.Builder.create(this, "MyRole") .assumedBy(new CompositePrincipal( new ServicePrincipal("ec2.amazonaws.com"), new AccountPrincipal("1818188181818187272"))) .build();
The PrincipalWithConditions
class can be used to add conditions to a
principal, especially those that don't take a conditions
parameter in their
constructor. The principal.withConditions()
method can be used to create a
PrincipalWithConditions
from an existing principal, for example:
PrincipalBase principal = new AccountPrincipal("123456789000").withConditions(Map.of("StringEquals", Map.of("foo", "baz")));
NOTE: If you need to define an IAM condition that uses a token (such as a deploy-time attribute of another resource) in a JSON map key, use
CfnJson
to render this condition. See this test for an example.
The WebIdentityPrincipal
class can be used as a principal for web identities like
Cognito, Amazon, Google or Facebook, for example:
WebIdentityPrincipal principal = new WebIdentityPrincipal("cognito-identity.amazonaws.com", Map.of( "StringEquals", Map.of("cognito-identity.amazonaws.com:aud", "us-east-2:12345678-abcd-abcd-abcd-123456"), "ForAnyValue:StringLike", Map.of("cognito-identity.amazonaws.com:amr", "unauthenticated")));
If your identity provider is configured to assume a Role with session
tags, you
need to call .withSessionTags()
to add the required permissions to the Role's
policy document:
Role.Builder.create(this, "Role") .assumedBy(new WebIdentityPrincipal("cognito-identity.amazonaws.com", Map.of( "StringEquals", Map.of( "cognito-identity.amazonaws.com:aud", "us-east-2:12345678-abcd-abcd-abcd-123456"), "ForAnyValue:StringLike", Map.of( "cognito-identity.amazonaws.com:amr", "unauthenticated"))).withSessionTags()) .build();
Granting a principal permission to assume a role
A principal can be granted permission to assume a role using grantAssumeRole
.
Note that this does not apply to service principals or account principals as they must be added to the role trust policy via assumeRolePolicy
.
User user = new User(this, "user"); Role role = Role.Builder.create(this, "role") .assumedBy(new AccountPrincipal(this.account)) .build(); role.grantAssumeRole(user);
Granting service and account principals permission to assume a role
Service principals and account principals can be granted permission to assume a role using assumeRolePolicy
which modifies the role trust policy.
Role role = Role.Builder.create(this, "role") .assumedBy(new AccountPrincipal(this.account)) .build(); role.assumeRolePolicy.addStatements(PolicyStatement.Builder.create() .actions(List.of("sts:AssumeRole")) .principals(List.of( new AccountPrincipal("123456789"), new ServicePrincipal("beep-boop.amazonaws.com"))) .build());
Parsing JSON Policy Documents
The PolicyDocument.fromJson
and PolicyStatement.fromJson
static methods can be used to parse JSON objects. For example:
Map<String, Object> policyDocument = Map.of( "Version", "2012-10-17", "Statement", List.of(Map.of( "Sid", "FirstStatement", "Effect", "Allow", "Action", List.of("iam:ChangePassword"), "Resource", List.of("*")), Map.of( "Sid", "SecondStatement", "Effect", "Allow", "Action", List.of("s3:ListAllMyBuckets"), "Resource", List.of("*")), Map.of( "Sid", "ThirdStatement", "Effect", "Allow", "Action", List.of("s3:List*", "s3:Get*"), "Resource", List.of("arn:aws:s3:::confidential-data", "arn:aws:s3:::confidential-data/*"), "Condition", Map.of("Bool", Map.of("aws:MultiFactorAuthPresent", "true"))))); PolicyDocument customPolicyDocument = PolicyDocument.fromJson(policyDocument); // You can pass this document as an initial document to a ManagedPolicy // or inline Policy. ManagedPolicy newManagedPolicy = ManagedPolicy.Builder.create(this, "MyNewManagedPolicy") .document(customPolicyDocument) .build(); Policy newPolicy = Policy.Builder.create(this, "MyNewPolicy") .document(customPolicyDocument) .build();
Permissions Boundaries
Permissions
Boundaries
can be used as a mechanism to prevent privilege escalation by creating new
Role
s. Permissions Boundaries are a Managed Policy, attached to Roles or
Users, that represent the maximum set of permissions they can have. The
effective set of permissions of a Role (or User) will be the intersection of
the Identity Policy and the Permissions Boundary attached to the Role (or
User). Permissions Boundaries are typically created by account
Administrators, and their use on newly created Role
s will be enforced by
IAM policies.
Bootstrap Permissions Boundary
If a permissions boundary has been enforced as part of CDK bootstrap, all IAM
Roles and Users that are created as part of the CDK application must be created
with the permissions boundary attached. The most common scenario will be to
apply the enforced permissions boundary to the entire CDK app. This can be done
either by adding the value to cdk.json
or directly in the App
constructor.
For example if your organization has created and is enforcing a permissions
boundary with the name
cdk-${Qualifier}-PermissionsBoundary
{ "context": { "@aws-cdk/core:permissionsBoundary": { "name": "cdk-${Qualifier}-PermissionsBoundary" } } }
OR
App.Builder.create() .context(Map.of( PERMISSIONS_BOUNDARY_CONTEXT_KEY, Map.of( "name", "cdk-${Qualifier}-PermissionsBoundary"))) .build();
Another scenario might be if your organization enforces different permissions boundaries for different environments. For example your CDK application may have
DevStage
that deploys to a personal dev environment where you have elevated privilegesBetaStage
that deploys to a beta environment which and has a relaxed permissions boundaryGammaStage
that deploys to a gamma environment which has the prod permissions boundaryProdStage
that deploys to the prod environment and has the prod permissions boundary
App app; new Stage(app, "DevStage"); Stage.Builder.create(app, "BetaStage") .permissionsBoundary(PermissionsBoundary.fromName("beta-permissions-boundary")) .build(); Stage.Builder.create(app, "GammaStage") .permissionsBoundary(PermissionsBoundary.fromName("prod-permissions-boundary")) .build(); Stage.Builder.create(app, "ProdStage") .permissionsBoundary(PermissionsBoundary.fromName("prod-permissions-boundary")) .build();
The provided name can include placeholders for the partition, region, qualifier, and account These placeholders will be replaced with the actual values if available. This requires that the Stack has the environment specified, it does not work with environment.
- '${AWS::Partition}'
- '${AWS::Region}'
- '${AWS::AccountId}'
- '${Qualifier}'
App app; Stage prodStage = Stage.Builder.create(app, "ProdStage") .permissionsBoundary(PermissionsBoundary.fromName("cdk-${Qualifier}-PermissionsBoundary-${AWS::AccountId}-${AWS::Region}")) .build(); Stack.Builder.create(prodStage, "ProdStack") .synthesizer(DefaultStackSynthesizer.Builder.create() .qualifier("custom") .build()) .build();
For more information on configuring permissions see the Security And Safety Dev Guide
Custom Permissions Boundary
It is possible to attach Permissions Boundaries to all Roles created in a construct tree all at once:
// Directly apply the boundary to a Role you create Role role; // Apply the boundary to an Role that was implicitly created for you Function fn; // Remove a Permissions Boundary that is inherited, for example from the Stack level CustomResource customResource; // This imports an existing policy. IManagedPolicy boundary = ManagedPolicy.fromManagedPolicyArn(this, "Boundary", "arn:aws:iam::123456789012:policy/boundary"); // This creates a new boundary ManagedPolicy boundary2 = ManagedPolicy.Builder.create(this, "Boundary2") .statements(List.of( PolicyStatement.Builder.create() .effect(Effect.DENY) .actions(List.of("iam:*")) .resources(List.of("*")) .build())) .build(); PermissionsBoundary.of(role).apply(boundary); PermissionsBoundary.of(fn).apply(boundary); // Apply the boundary to all Roles in a stack PermissionsBoundary.of(this).apply(boundary); PermissionsBoundary.of(customResource).clear();
OpenID Connect Providers
OIDC identity providers are entities in IAM that describe an external identity provider (IdP) service that supports the OpenID Connect (OIDC) standard, such as Google or Salesforce. You use an IAM OIDC identity provider when you want to establish trust between an OIDC-compatible IdP and your AWS account. This is useful when creating a mobile app or web application that requires access to AWS resources, but you don't want to create custom sign-in code or manage your own user identities. For more information about this scenario, see About Web Identity Federation and the relevant documentation in the Amazon Cognito Identity Pools Developer Guide.
The following examples defines an OpenID Connect provider. Two client IDs (audiences) are will be able to send authentication requests to https://openid/connect.
OpenIdConnectProvider provider = OpenIdConnectProvider.Builder.create(this, "MyProvider") .url("https://openid/connect") .clientIds(List.of("myclient1", "myclient2")) .build();
You can specify an optional list of thumbprints
. If not specified, the
thumbprint of the root certificate authority (CA) will automatically be obtained
from the host as described
here.
Once you define an OpenID connect provider, you can use it with AWS services that expect an IAM OIDC provider. For example, when you define an Amazon Cognito identity pool you can reference the provider's ARN as follows:
import software.amazon.awscdk.services.cognito.*; OpenIdConnectProvider myProvider; CfnIdentityPool.Builder.create(this, "IdentityPool") .openIdConnectProviderArns(List.of(myProvider.getOpenIdConnectProviderArn())) // And the other properties for your identity pool .allowUnauthenticatedIdentities(false) .build();
The OpenIdConnectPrincipal
class can be used as a principal used with a OpenIdConnectProvider
, for example:
OpenIdConnectProvider provider = OpenIdConnectProvider.Builder.create(this, "MyProvider") .url("https://openid/connect") .clientIds(List.of("myclient1", "myclient2")) .build(); OpenIdConnectPrincipal principal = new OpenIdConnectPrincipal(provider);
SAML provider
An IAM SAML 2.0 identity provider is an entity in IAM that describes an external identity provider (IdP) service that supports the SAML 2.0 (Security Assertion Markup Language 2.0) standard. You use an IAM identity provider when you want to establish trust between a SAML-compatible IdP such as Shibboleth or Active Directory Federation Services and AWS, so that users in your organization can access AWS resources. IAM SAML identity providers are used as principals in an IAM trust policy.
SamlProvider.Builder.create(this, "Provider") .metadataDocument(SamlMetadataDocument.fromFile("/path/to/saml-metadata-document.xml")) .build();
The SamlPrincipal
class can be used as a principal with a SamlProvider
:
SamlProvider provider = SamlProvider.Builder.create(this, "Provider") .metadataDocument(SamlMetadataDocument.fromFile("/path/to/saml-metadata-document.xml")) .build(); SamlPrincipal principal = new SamlPrincipal(provider, Map.of( "StringEquals", Map.of( "SAML:iss", "issuer")));
When creating a role for programmatic and AWS Management Console access, use the SamlConsolePrincipal
class:
SamlProvider provider = SamlProvider.Builder.create(this, "Provider") .metadataDocument(SamlMetadataDocument.fromFile("/path/to/saml-metadata-document.xml")) .build(); Role.Builder.create(this, "Role") .assumedBy(new SamlConsolePrincipal(provider)) .build();
Users
IAM manages users for your AWS account. To create a new user:
User user = new User(this, "MyUser");
To import an existing user by name with path:
IUser user = User.fromUserName(this, "MyImportedUserByName", "johnsmith");
To import an existing user by ARN:
IUser user = User.fromUserArn(this, "MyImportedUserByArn", "arn:aws:iam::123456789012:user/johnsmith");
To import an existing user by attributes:
IUser user = User.fromUserAttributes(this, "MyImportedUserByAttributes", UserAttributes.builder() .userArn("arn:aws:iam::123456789012:user/johnsmith") .build());
Access Keys
The ability for a user to make API calls via the CLI or an SDK is enabled by the user having an access key pair. To create an access key:
User user = new User(this, "MyUser"); AccessKey accessKey = AccessKey.Builder.create(this, "MyAccessKey").user(user).build();
You can force CloudFormation to rotate the access key by providing a monotonically increasing serial
property. Simply provide a higher serial value than any number used previously:
User user = new User(this, "MyUser"); AccessKey accessKey = AccessKey.Builder.create(this, "MyAccessKey").user(user).serial(1).build();
An access key may only be associated with a single user and cannot be "moved" between users. Changing the user associated with an access key replaces the access key (and its ID and secret value).
Groups
An IAM user group is a collection of IAM users. User groups let you specify permissions for multiple users.
Group group = new Group(this, "MyGroup");
To import an existing group by ARN:
IGroup group = Group.fromGroupArn(this, "MyImportedGroupByArn", "arn:aws:iam::account-id:group/group-name");
To import an existing group by name with path:
IGroup group = Group.fromGroupName(this, "MyImportedGroupByName", "group-name");
To add a user to a group (both for a new and imported user/group):
User user = new User(this, "MyUser"); // or User.fromUserName(this, 'User', 'johnsmith'); Group group = new Group(this, "MyGroup"); // or Group.fromGroupArn(this, 'Group', 'arn:aws:iam::account-id:group/group-name'); user.addToGroup(group); // or group.addUser(user);
Instance Profiles
An IAM instance profile is a container for an IAM role that you can use to pass role information to an EC2 instance when the instance starts. By default, an instance profile must be created with a role:
Role role = Role.Builder.create(this, "Role") .assumedBy(new ServicePrincipal("ec2.amazonaws.com")) .build(); InstanceProfile instanceProfile = InstanceProfile.Builder.create(this, "InstanceProfile") .role(role) .build();
An instance profile can also optionally be created with an instance profile name and/or a path to the instance profile:
Role role = Role.Builder.create(this, "Role") .assumedBy(new ServicePrincipal("ec2.amazonaws.com")) .build(); InstanceProfile instanceProfile = InstanceProfile.Builder.create(this, "InstanceProfile") .role(role) .instanceProfileName("MyInstanceProfile") .path("/sample/path/") .build();
To import an existing instance profile by name:
IInstanceProfile instanceProfile = InstanceProfile.fromInstanceProfileName(this, "ImportedInstanceProfile", "MyInstanceProfile");
To import an existing instance profile by ARN:
IInstanceProfile instanceProfile = InstanceProfile.fromInstanceProfileArn(this, "ImportedInstanceProfile", "arn:aws:iam::account-id:instance-profile/MyInstanceProfile");
To import an existing instance profile with an associated role:
Role role = Role.Builder.create(this, "Role") .assumedBy(new ServicePrincipal("ec2.amazonaws.com")) .build(); IInstanceProfile instanceProfile = InstanceProfile.fromInstanceProfileAttributes(this, "ImportedInstanceProfile", InstanceProfileAttributes.builder() .instanceProfileArn("arn:aws:iam::account-id:instance-profile/MyInstanceProfile") .role(role) .build());
Features
- Policy name uniqueness is enforced. If two policies by the same name are attached to the same principal, the attachment will fail.
- Policy names are not required - the CDK logical ID will be used and ensured to be unique.
- Policies are validated during synthesis to ensure that they have actions, and that policies attached to IAM principals specify relevant resources, while policies attached to resources specify which IAM principals they apply to.
-
ClassDescriptionDefine a new IAM Access Key.A fluent builder for
AccessKey
.Properties for defining an IAM access key.A builder forAccessKeyProps
An implementation forAccessKeyProps
Valid statuses for an IAM Access Key.Specify AWS account ID as the principal entity in a policy to delegate authority to the account.Use the AWS account into which a stack is deployed as the principal entity in a policy.Result of callingaddToPrincipalPolicy
.A builder forAddToPrincipalPolicyResult
An implementation forAddToPrincipalPolicyResult
Result of calling addToResourcePolicy.A builder forAddToResourcePolicyResult
An implementation forAddToResourcePolicyResult
A principal representing all AWS identities in all accounts.Specify a principal by the Amazon Resource Name (ARN).A policy principal for canonicalUserIds - useful for S3 bucket policies that use Origin Access identities.Creates a new AWS secret access key and corresponding AWS access key ID for the specified user.A fluent builder forCfnAccessKey
.Properties for defining aCfnAccessKey
.A builder forCfnAccessKeyProps
An implementation forCfnAccessKeyProps
Creates a new group.A fluent builder forCfnGroup
.Contains information about an attached policy.A builder forCfnGroup.PolicyProperty
An implementation forCfnGroup.PolicyProperty
Adds or updates an inline policy document that is embedded in the specified IAM group.A fluent builder forCfnGroupPolicy
.Properties for defining aCfnGroupPolicy
.A builder forCfnGroupPolicyProps
An implementation forCfnGroupPolicyProps
Properties for defining aCfnGroup
.A builder forCfnGroupProps
An implementation forCfnGroupProps
Creates a new instance profile.A fluent builder forCfnInstanceProfile
.Properties for defining aCfnInstanceProfile
.A builder forCfnInstanceProfileProps
An implementation forCfnInstanceProfileProps
Creates a new managed policy for your AWS account .A fluent builder forCfnManagedPolicy
.Properties for defining aCfnManagedPolicy
.A builder forCfnManagedPolicyProps
An implementation forCfnManagedPolicyProps
Creates or updates an IAM entity to describe an identity provider (IdP) that supports OpenID Connect (OIDC) .A fluent builder forCfnOIDCProvider
.Properties for defining aCfnOIDCProvider
.A builder forCfnOIDCProviderProps
An implementation forCfnOIDCProviderProps
Adds or updates an inline policy document that is embedded in the specified IAM group, user or role.A fluent builder forCfnPolicy
.Properties for defining aCfnPolicy
.A builder forCfnPolicyProps
An implementation forCfnPolicyProps
Creates a new role for your AWS account .A fluent builder forCfnRole
.Contains information about an attached policy.A builder forCfnRole.PolicyProperty
An implementation forCfnRole.PolicyProperty
Adds or updates an inline policy document that is embedded in the specified IAM role.A fluent builder forCfnRolePolicy
.Properties for defining aCfnRolePolicy
.A builder forCfnRolePolicyProps
An implementation forCfnRolePolicyProps
Properties for defining aCfnRole
.A builder forCfnRoleProps
An implementation forCfnRoleProps
Creates an IAM resource that describes an identity provider (IdP) that supports SAML 2.0.A fluent builder forCfnSAMLProvider
.Properties for defining aCfnSAMLProvider
.A builder forCfnSAMLProviderProps
An implementation forCfnSAMLProviderProps
Uploads a server certificate entity for the AWS account .A fluent builder forCfnServerCertificate
.Properties for defining aCfnServerCertificate
.A builder forCfnServerCertificateProps
An implementation forCfnServerCertificateProps
Creates an IAM role that is linked to a specific AWS service.A fluent builder forCfnServiceLinkedRole
.Properties for defining aCfnServiceLinkedRole
.A builder forCfnServiceLinkedRoleProps
An implementation forCfnServiceLinkedRoleProps
Creates a new IAM user for your AWS account .A fluent builder forCfnUser
.Creates a password for the specified user, giving the user the ability to access AWS services through the AWS Management Console .A builder forCfnUser.LoginProfileProperty
An implementation forCfnUser.LoginProfileProperty
Contains information about an attached policy.A builder forCfnUser.PolicyProperty
An implementation forCfnUser.PolicyProperty
Adds or updates an inline policy document that is embedded in the specified IAM user.A fluent builder forCfnUserPolicy
.Properties for defining aCfnUserPolicy
.A builder forCfnUserPolicyProps
An implementation forCfnUserPolicyProps
Properties for defining aCfnUser
.A builder forCfnUserProps
An implementation forCfnUserProps
Adds the specified user to the specified group.A fluent builder forCfnUserToGroupAddition
.Properties for defining aCfnUserToGroupAddition
.A builder forCfnUserToGroupAdditionProps
An implementation forCfnUserToGroupAdditionProps
Creates a new virtual MFA device for the AWS account .A fluent builder forCfnVirtualMFADevice
.Properties for defining aCfnVirtualMFADevice
.A builder forCfnVirtualMFADeviceProps
An implementation forCfnVirtualMFADeviceProps
Basic options for a grant operation.A builder forCommonGrantOptions
An implementation forCommonGrantOptions
Helper class for working withIComparablePrincipal
s.Composite dependable.Represents a principal that has multiple types of principals.Options for customizing IAM role creation.A builder forCustomizeRolesOptions
An implementation forCustomizeRolesOptions
The Effect element of an IAM policy.Principal entity that represents a federated identity provider such as Amazon Cognito, that can be used to provide temporary security credentials to users who have been authenticated.Options allowing customizing the behavior ofRole.fromRoleArn
.A builder forFromRoleArnOptions
An implementation forFromRoleArnOptions
Options allowing customizing the behavior ofRole.fromRoleName
.A builder forFromRoleNameOptions
An implementation forFromRoleNameOptions
Result of a grant() operation.Options for a grant operation to both identity and resource.A builder forGrantOnPrincipalAndResourceOptions
An implementation forGrantOnPrincipalAndResourceOptions
Options for a grant operation that only applies to principals.A builder forGrantOnPrincipalOptions
An implementation forGrantOnPrincipalOptions
Options for a grant operation.A builder forGrantWithResourceOptions
An implementation forGrantWithResourceOptions
An IAM Group (collection of IAM users) lets you specify permissions for multiple users, which can make it easier to manage permissions for those users.A fluent builder forGroup
.Properties for defining an IAM group.A builder forGroupProps
An implementation forGroupProps
Represents an IAM Access Key.Internal default implementation forIAccessKey
.A proxy class which represents a concrete javascript instance of this type.A type of principal that has more control over its own representation in AssumeRolePolicyDocuments.Internal default implementation forIAssumeRolePrincipal
.A proxy class which represents a concrete javascript instance of this type.Interface for principals that can be compared.Internal default implementation forIComparablePrincipal
.A proxy class which represents a concrete javascript instance of this type.Any object that has an associated principal that a permission can be granted to.Internal default implementation forIGrantable
.A proxy class which represents a concrete javascript instance of this type.Represents an IAM Group.Internal default implementation forIGroup
.A proxy class which represents a concrete javascript instance of this type.A construct that represents an IAM principal, such as a user, group or role.Internal default implementation forIIdentity
.A proxy class which represents a concrete javascript instance of this type.Represents an IAM Instance Profile.Internal default implementation forIInstanceProfile
.A proxy class which represents a concrete javascript instance of this type.A managed policy.Internal default implementation forIManagedPolicy
.A proxy class which represents a concrete javascript instance of this type.IAM Instance Profile.A fluent builder forInstanceProfile
.Attributes of an Instance Profile.A builder forInstanceProfileAttributes
An implementation forInstanceProfileAttributes
Properties of an Instance Profile.A builder forInstanceProfileProps
An implementation forInstanceProfileProps
Represents an IAM OpenID Connect provider.Internal default implementation forIOpenIdConnectProvider
.A proxy class which represents a concrete javascript instance of this type.Represents an IAM Policy.Internal default implementation forIPolicy
.A proxy class which represents a concrete javascript instance of this type.Represents a logical IAM principal.Internal default implementation forIPrincipal
.A proxy class which represents a concrete javascript instance of this type.A resource with a resource policy that can be added to.Internal default implementation forIResourceWithPolicy
.A proxy class which represents a concrete javascript instance of this type.A Role object.Internal default implementation forIRole
.A proxy class which represents a concrete javascript instance of this type.A SAML provider.Internal default implementation forISamlProvider
.A proxy class which represents a concrete javascript instance of this type.Represents an IAM user.Internal default implementation forIUser
.A proxy class which represents a concrete javascript instance of this type.An IAM role that only gets attached to the construct tree once it gets used, not before.A fluent builder forLazyRole
.Properties for defining a LazyRole.A builder forLazyRoleProps
An implementation forLazyRoleProps
Managed policy.A fluent builder forManagedPolicy
.Properties for defining an IAM managed policy.A builder forManagedPolicyProps
An implementation forManagedPolicyProps
A principal that represents a federated identity provider as from a OpenID Connect provider.IAM OIDC identity providers are entities in IAM that describe an external identity provider (IdP) service that supports the OpenID Connect (OIDC) standard, such as Google or Salesforce.A fluent builder forOpenIdConnectProvider
.Initialization properties forOpenIdConnectProvider
.A builder forOpenIdConnectProviderProps
An implementation forOpenIdConnectProviderProps
A principal that represents an AWS Organization.Modify the Permissions Boundaries of Users and Roles in a construct tree.The AWS::IAM::Policy resource associates an inline IAM policy with IAM users, roles, or groups.A fluent builder forPolicy
.A PolicyDocument is a collection of statements.A fluent builder forPolicyDocument
.Properties for a new PolicyDocument.A builder forPolicyDocumentProps
An implementation forPolicyDocumentProps
Properties for defining an IAM inline policy document.A builder forPolicyProps
An implementation forPolicyProps
Represents a statement in an IAM policy document.A fluent builder forPolicyStatement
.Interface for creating a policy statement.A builder forPolicyStatementProps
An implementation forPolicyStatementProps
Base class for policy principals.A collection of the fields in a PolicyStatement that can be used to identify a principal.An IAM principal with additional conditions specifying when the policy is in effect.IAM Role.A fluent builder forRole
.Properties for defining an IAM Role.A builder forRoleProps
An implementation forRoleProps
Principal entity that represents a SAML federated identity provider for programmatic and AWS Management Console access.A SAML metadata document.Principal entity that represents a SAML federated identity provider.A SAML provider.A fluent builder forSamlProvider
.Properties for a SAML provider.A builder forSamlProviderProps
An implementation forSamlProviderProps
An IAM principal that represents an AWS service (i.e.A fluent builder forServicePrincipal
.Options for a service principal.A builder forServicePrincipalOpts
An implementation forServicePrincipalOpts
Enables session tags on role assumptions from a principal.A principal that uses a literal '*' in the IAM JSON language.A principal for use in resources that need to have a role but it's unknown.A fluent builder forUnknownPrincipal
.Properties for an UnknownPrincipal.A builder forUnknownPrincipalProps
An implementation forUnknownPrincipalProps
Define a new IAM user.A fluent builder forUser
.Represents a user defined outside of this stack.A builder forUserAttributes
An implementation forUserAttributes
Properties for defining an IAM user.A builder forUserProps
An implementation forUserProps
A principal that represents a federated identity provider as Web Identity such as Cognito, Amazon, Facebook, Google, etc.Options for thewithoutPolicyUpdates()
modifier of a Role.A builder forWithoutPolicyUpdatesOptions
An implementation forWithoutPolicyUpdatesOptions