PolicyStatementProps Struct
Interface for creating a policy statement.
Example
ts
// Add gateway endpoints when creating the VPC
const vpc = new ec2.Vpc(this, 'MyVpc', {
gatewayEndpoints: {
S3: {
service: ec2.GatewayVpcEndpointAwsService.S3,
},
},
});
// Alternatively gateway endpoints can be added on the VPC
const dynamoDbEndpoint = vpc.addGatewayEndpoint('DynamoDbEndpoint', {
service: ec2.GatewayVpcEndpointAwsService.DYNAMODB,
});
// This allows to customize the endpoint policy
dynamoDbEndpoint.addToPolicy(
new iam.PolicyStatement({ // Restrict to listing and describing tables
principals: [new iam.AnyPrincipal()],
actions: ['dynamodb:DescribeTable', 'dynamodb:ListTables'],
resources: ['*'],
}));
// Add an interface endpoint
vpc.addInterfaceEndpoint('EcrDockerEndpoint', {
service: ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER,
// Uncomment the following to allow more fine-grained control over
// who can access the endpoint via the '.connections' object.
// open: false
});
Properties
actionsoptionalstring[]actionsoptionaltyping.List[str]actionsoptionalList<String>Actionsoptionalstring[]Actionsoptional*[]*string#List of actions to add to the statement.
Default: no actions
conditionsoptional{ [key: string]: any }conditionsoptionaltyping.Mapping[str, Any]conditionsoptionalMap<String, Object>ConditionsoptionalIDictionary<string, object>Conditionsoptional*map[string]interface{}#Conditions to add to the statement.
Default: no condition
effectoptionalEffecteffectoptionalEffecteffectoptionalEffectEffectoptionalEffectEffectoptionalEffect= Effect.ALLOW#Whether to allow or deny the actions in this statement.
notActionsoptionalstring[]not_actionsoptionaltyping.List[str]notActionsoptionalList<String>NotActionsoptionalstring[]NotActionsoptional*[]*string#List of not actions to add to the statement.
Default: no not-actions
notPrincipalsoptionalIPrincipal[]not_principalsoptionaltyping.List[IPrincipal]notPrincipalsoptionalList<IPrincipal>NotPrincipalsoptionalIPrincipal[]NotPrincipalsoptional*[]IPrincipal#List of not principals to add to the statement.
Default: no not principals
notResourcesoptionalstring[]not_resourcesoptionaltyping.List[str]notResourcesoptionalList<String>NotResourcesoptionalstring[]NotResourcesoptional*[]*string#NotResource ARNs to add to the statement.
Default: no not-resources
principalsoptionalIPrincipal[]principalsoptionaltyping.List[IPrincipal]principalsoptionalList<IPrincipal>PrincipalsoptionalIPrincipal[]Principalsoptional*[]IPrincipal#List of principals to add to the statement.
Default: no principals
resourcesoptionalstring[]resourcesoptionaltyping.List[str]resourcesoptionalList<String>Resourcesoptionalstring[]Resourcesoptional*[]*string#Resource ARNs to add to the statement.
Default: no resources
The Sid (statement ID) is an optional identifier that you provide for the policy statement.
Default: no sid
notes
You can assign a Sid value to each statement in a statement array. In services that let you specify an ID element, such as SQS and SNS, the Sid value is just a sub-ID of the policy document's ID. In IAM, the Sid value must be unique within a JSON policy. In IAM identity policies, the Sid value must contain only alphanumeric characters.