import * as aws from "@pulumi/aws" ; import * as pulumi from "@pulumi/pulumi" ; import * as common from "./common" ; type IamPolicyDocuments = "eksAdmins" | "useExistingIamRoles" ; export const baselineIamPolicyDocuments = { eksAdmins : { Version : "2012-10-17" , Statement : [ { Effect : "Allow" , Action : [ "eks:*" , "ec2:DescribeImages" ] , Resource : "*" } ] , } , useExistingIamRoles : { Version : "2012-10-17" , Statement : [ { Effect : "Allow" , Action : "iam:PassRole" , Resource : "*" } ] , } , } ; type IBaselineIamPolicies = { [ PolicyDocument in IamPolicyDocuments ] : aws . iam . Policy | undefined ; } ; export type BaselinePolicyArgs = Pick < aws . iam . AccessKeyArgs , Exclude < keyof aws . iam . AccessKeyArgs , "policy" > > ; export type BaselineIamPoliciesOptions = { [ PolicyCreateOption in "defineEksAdminsPolicy" | "defineUseExistingIamRolesPolicy" ] ? : boolean | BaselinePolicyArgs ; } ; export class BaselineIamPolicies extends pulumi . ComponentResource implements IBaselineIamPolicies { public readonly eksAdmins : aws . iam . Policy | undefined ; public readonly useExistingIamRoles : aws . iam . Policy | undefined ; constructor ( name , args ? , opts ? ) { super ( `${ common . groupName }:index:BaselineIamPolicies` , name , args , opts ) ; args = args === undefined ? { } : args ; args . defineUseExistingIamRolesPolicy = args . defineUseExistingIamRolesPolicy === undefined ? true : args . defineUseExistingIamRolesPolicy ; this . eksAdmins = this . definePolicy ( args . defineEksAdminsPolicy , "eksAdmins" , { description : "Administrative access for EKS clusters" , policy : JSON . stringify ( baselineIamPolicyDocuments . eksAdmins ) , } ) ; this . useExistingIamRoles = this . definePolicy ( args . defineUseExistingIamRolesPolicy , "iamPass" , { description : "Allows IAM Users to attach or modify existing IAM Roles to AWS resources" , policy : JSON . stringify ( baselineIamPolicyDocuments . useExistingIamRoles ) , } ) ; } public policies ( ) { const policies = { } ; for ( const key in this ) { if ( ! this . hasOwnProperty ( key ) || this [ key ] === undefined ) { continue ; } const policy = this [ key ] ; policies [ key ] = policy ; } return policies ; } public arns ( ) { const arns = { } ; const policies = this . policies ( ) ; for ( const key of Object . keys ( policies ) ) { arns [ key ] = policies [ key ] . arn ; } return arns ; } private definePolicy ( defineOpt , name , args ) { let policyArgs = args ; if ( defineOpt === false || defineOpt === undefined ) { return undefined ; } else if ( defineOpt !== true ) { policyArgs = { ... policyArgs , ... defineOpt } ; } return new aws . iam . Policy ( name , policyArgs , { parent : this } ) ; } }