import * as aws from "@pulumi/aws" ; import * as iam from "../../" ; import * as util from "./util" ; const baseline = new iam . BaselineIam ( "baselineIam" , { groups : { defineEksAdminsGroup : true , defineAdminsGroup : false , defineDatabaseAdminsGroup : false , } , } ) ; const networkAdminCiUser = new util . BotUser ( "networkAdminCiUser" , { groupMembership : { groups : [ baseline . groups . networkAdmins ! . name ] } , } ) ; const networkAdminCiUserKey = networkAdminCiUser . createAccessKey ( "networkAdminCiUser" ) ; export const networkAdminCiUserAccessKey = { id : networkAdminCiUserKey . id , secret : networkAdminCiUserKey . secret , } ; const eksAdminCiUser = new util . BotUser ( "eksAdminCiUser" , { groupMembership : { groups : [ baseline . groups . eksAdmins ! . name , baseline . groups . networkAdmins ! . name , baseline . groups . useExistingIamRoles ! . name , ] , } , } ) ; const eksAdminCiUserKey = eksAdminCiUser . createAccessKey ( "eksAdminCiUser" ) ; export const eksUserCiUserAccessKey = { id : eksAdminCiUserKey . id , secret : eksAdminCiUserKey . secret , } ; const kubeAppRole = util . newRoleWithPolicies ( "kubeAppRole" , { description : "Infrastructure management role for CI users" , assumeRolePolicy : eksAdminCiUser . user . arn . apply ( util . assumeRolePolicy ) , } , { ecrPowerUser : aws . iam . AmazonEC2ContainerRegistryPowerUser , passRole : baseline . policies . useExistingIamRoles ! . arn , } ) ; export const kubeAppRoleArn = kubeAppRole . arn ; export const policyArns = baseline . policies . arns ( ) ; export const groupArns = baseline . groups . arns ( ) ;