import * as aws from "@pulumi/aws" ; import * as pulumi from "@pulumi/pulumi" ; class User extends pulumi . ComponentResource { public readonly user : aws . iam . User ; public readonly accessKeys : aws . iam . AccessKey [ ] ; public readonly groupMemberships : aws . iam . UserGroupMembership [ ] ; constructor ( name , args = { } , opts ? ) { super ( `awsinfra:x:iam:User` , name , args , opts ) ; const groupMembership = args . groupMembership ; delete args . groupMembership ; this . user = args . user || new aws . iam . User ( name , args , { parent : this } ) ; this . accessKeys = [ ] ; this . groupMemberships = [ ] ; if ( groupMembership !== undefined ) { this . groupMemberships . push ( new aws . iam . UserGroupMembership ( name , { ... groupMembership , user : this . user . name } , { parent : this } ) ) ; } } param name param args param opts public createAccessKey ( name , args ? , opts ? ) { const key = new aws . iam . AccessKey ( name , { ... args , user : this . user . name } , { ... opts , parent : this } ) ; this . accessKeys . push ( key ) ; return key ; } param name param args param opts public addToGroups ( name , args , opts ? ) { const membership = new aws . iam . UserGroupMembership ( name , { ... args , user : this . user . name } , { ... opts , parent : this } ) ; this . groupMemberships . push ( membership ) ; return membership ; } public static fromExistingId ( name , id , args = { } , opts = { } ) { return new User ( name , { ... args , user : aws . iam . User . get ( name , id , { } , opts ) } , opts ) ; } } export type AccessKeyArgs = Pick < aws . iam . AccessKeyArgs , Exclude < keyof aws . iam . AccessKeyArgs , "user" > > ; export type UserGroupMembershipArgs = Pick < aws . iam . UserGroupMembershipArgs , Exclude < keyof aws . iam . UserGroupMembershipArgs , "user" > > ; export type UserArgs = aws . iam . UserArgs & { groupMembership ? : UserGroupMembershipArgs ; user ? : aws . iam . User ; } ; /**
 * EmployeeUser represents an AWS IAM User that is a full-time employee. Because it is useful to
 * quickly distinguish between various types of users, all EmployeeUsers are allocated names of the
 * form `employee.${name}`.
 */ export class EmployeeUser extends User { param name param args param opts constructor ( name , args ? , opts ? ) { super ( `employee.${ name }` , args , opts ) ; } } /**
 * ContractorUser represents an AWS IAM User that is a contracting employee. Because it is useful to
 * quickly distinguish between various types of users, all ContractorUsers are allocated names of
 * the form `contractor.${name}`.
 */ export class ContractorUser extends User { param name param args param opts constructor ( name , args ? , opts ? ) { super ( `contractor.${ name }` , args , opts ) ; } } /**
 * BotUser represents an AWS IAM User that is a bot, such as a CI system. Because it is useful to
 * quickly distinguish between various types of users, all BotUsers are allocated names of the form
 * `bot.${name}`.
 */ export class BotUser extends User { param name param args param opts constructor ( name , args ? , opts ? ) { super ( `bot.${ name }` , args , opts ) ; } } export type Policies = { [ name ] : pulumi . Input < aws . ARN > ; } ; export function newRoleWithPolicies ( name , args , policies ) { const role = new aws . iam . Role ( name , args ) ; for ( const policy of Object . keys ( policies ) ) { new aws . iam . RolePolicyAttachment ( `${ name }-${ policy }` , { policyArn : policies [ policy ] , role } , { parent : role } ) ; } return role ; } export function assumeRolePolicy ( user ) { return { Version : "2012-10-17" , Statement : [ { Effect : "Allow" , Principal : { AWS : [ user ] } , Action : "sts:AssumeRole" , } , ] , } ; }