import * as aws from "@pulumi/aws" ; import * as pulumi from "@pulumi/pulumi" ; import * as common from "./common" ; type IBaselineIamGroups = { [ Group in "admins" | "networkAdmins" | "billing" | "securityAuditors" | "readOnly" | "useExistingIamRoles" | "eksAdmins" | "support" | "dataScientists" | "devPowerUsers" | "databaseAdmins" | "sysAdmins" ] : aws . iam . Group | undefined ; } ; export type BaselineGroupArgs = Pick < aws . iam . GroupArgs , Exclude < keyof aws . iam . GroupArgs , "groups" > > ; export type InternalBaselineIamGroupOptions = "defineAdminsGroup" | "defineNetworkAdminsGroup" | "defineDatabaseAdminsGroup" | "defineBillingGroup" | "defineSecurityAuditorsGroup" | "defineReadOnlyGroup" | "defineEksAdminsGroup" | "defineSupportGroup" | "defineDataScientistsGroup" | "defineDevPowerUsersGroup" | "defineSysAdminsGroup" ; export type BaselineIamGroupsOptions = { [ GroupCreateOption in InternalBaselineIamGroupOptions | "defineUseExistingIamRolesGroup" ] ? : boolean | aws . iam . GroupArgs ; } ; export class BaselineIamGroups extends pulumi . ComponentResource implements IBaselineIamGroups { public readonly admins : aws . iam . Group | undefined ; public readonly networkAdmins : aws . iam . Group | undefined ; public readonly databaseAdmins : aws . iam . Group | undefined ; public readonly billing : aws . iam . Group | undefined ; public readonly securityAuditors : aws . iam . Group | undefined ; public readonly readOnly : aws . iam . Group | undefined ; public readonly useExistingIamRoles : aws . iam . Group | undefined ; public readonly eksAdmins : aws . iam . Group | undefined ; public readonly support : aws . iam . Group | undefined ; public readonly dataScientists : aws . iam . Group | undefined ; public readonly devPowerUsers : aws . iam . Group | undefined ; public readonly sysAdmins : aws . iam . Group | undefined ; constructor ( name , args = { } , opts ? ) { super ( `${ common . groupName }:index:BaselineIamGroups` , name , args , opts ) ; args . defineAdminsGroup = args . defineAdminsGroup === undefined ? true : args . defineAdminsGroup ; args . defineNetworkAdminsGroup = args . defineNetworkAdminsGroup === undefined ? true : args . defineNetworkAdminsGroup ; args . defineDatabaseAdminsGroup = args . defineDatabaseAdminsGroup === undefined ? true : args . defineDatabaseAdminsGroup ; args . defineBillingGroup = args . defineBillingGroup === undefined ? true : args . defineBillingGroup ; args . defineSecurityAuditorsGroup = args . defineSecurityAuditorsGroup === undefined ? true : args . defineSecurityAuditorsGroup ; args . defineReadOnlyGroup = args . defineReadOnlyGroup === undefined ? true : args . defineReadOnlyGroup ; this . admins = this . defineGroup ( args . defineAdminsGroup , "admins" , { administratorAccess : aws . iam . AdministratorAccess , } ) ; this . networkAdmins = this . defineGroup ( args . defineNetworkAdminsGroup , "networkAdmins" , { networkAdministrator : aws . iam . NetworkAdministrator , } ) ; this . databaseAdmins = this . defineGroup ( args . defineDatabaseAdminsGroup , "databaseAdmins" , { databaseAdministrator : aws . iam . DatabaseAdministrator , } ) ; this . eksAdmins = this . defineGroup ( args . defineEksAdminsGroup , "eksAdmins" , { administratorAccess : aws . iam . AdministratorAccess , } ) ; this . billing = this . defineGroup ( args . defineBillingGroup , "billing" , { billing : aws . iam . Billing , } ) ; this . securityAuditors = this . defineGroup ( args . defineSecurityAuditorsGroup , "securityAuditors" , { securityAudit : aws . iam . SecurityAudit } ) ; this . readOnly = this . defineGroup ( args . defineReadOnlyGroup , "readOnly" , { readOnly : aws . iam . ViewOnlyAccess , } ) ; const passArn = args . useExistingIamRolesPolicy && args . useExistingIamRolesPolicy . arn ; this . useExistingIamRoles = passArn && this . defineGroup ( args . useExistingIamRolesPolicy !== undefined , "useExistingIamRoles" , { useExistingIamRoles : passArn , } ) ; this . support = this . defineGroup ( args . defineSupportGroup , "support" , { supportUser : aws . iam . SupportUser , } ) ; this . dataScientists = this . defineGroup ( args . defineDataScientistsGroup , "dataScientists" , { dataScientist : aws . iam . DataScientist , } ) ; this . devPowerUsers = this . defineGroup ( args . defineDevPowerUsersGroup , "developerPowerUsers" , { powerUserAccess : aws . iam . PowerUserAccess } ) ; this . sysAdmins = this . defineGroup ( args . defineSysAdminsGroup , "systemAdmins" , { systemAdministrator : aws . iam . SystemAdministrator , } ) ; } public groups ( ) { const groups = { } ; for ( const key in this ) { if ( ! this . hasOwnProperty ( key ) || this [ key ] === undefined ) { continue ; } const group = this [ key ] ; groups [ key ] = group ; } return groups ; } public arns ( ) { const arns = { } ; const groups = this . groups ( ) ; for ( const key of Object . keys ( groups ) ) { arns [ key ] = groups [ key ] . arn ; } return arns ; } private defineGroup ( defineOpt , name , policies ) { let group = undefined ; let groupArgs = { path : "/users/" } ; if ( defineOpt === false || defineOpt === undefined ) { return ; } else if ( defineOpt !== true ) { groupArgs = defineOpt ; } group = new aws . iam . Group ( name , groupArgs , { parent : this } ) ; for ( const policy of Object . keys ( policies ) ) { new aws . iam . GroupPolicyAttachment ( `${ name }-${ policy }` , { policyArn : policies [ policy ] , group } , { parent : group } ) ; } return group ; } }