https://pulumi.com logo
Join Slack
Powered by
This message was deleted.
# aws
s
This message was deleted.
b
Where are you using the using the bucket name? The issue doesn’t appear to be the stack ref
c
In an AppRunner policy (python code):
Copy code
"Resource": [f"arn:aws:s3:::{bucket}/*" for bucket in bucket_list],
b
That’s the problem, you can’t interpolate an output like that
You need to use an apply
c
Oh!
not sure I understand what it means though
b
I’m in transit right now, once I get to a stopping point I’ll post a more thorough answer.
Are you familiar with outputs at all?
c
nope
b
Then I’ll send the answer over when I get to a laptop
✅ 1
c
not much that is, besides using them in a way that worked fine
Copy code
subnets=core_stack_ref.get_output("defaultPrivateSubnetIds"),
I've a tried a ton of different things to no avail. e.g.: this did not work
Copy code
name = bucket.apply(lambda v: f"prefix{v}suffix")
b
Can you post the full code of the consuming stack
c
I can post the bits that should be relevant, edited for clarity, python code
Copy code
#  In core stack

# Create an aws.s3.BucketV2 resource with KMS server-side encryption
bucket = aws.s3.BucketV2(
    "bucket",
    tags={
        "Environment": environment,
        "Service": "core",
    },
)

bucket_attachments_policy = aws.s3.BucketServerSideEncryptionConfigurationV2(
    "bucket-policy",
    bucket=bucket.id,
    rules=[
        aws.s3.BucketServerSideEncryptionConfigurationV2RuleArgs(
            apply_server_side_encryption_by_default=aws.s3.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs(
                kms_master_key_id=config.require("KMS_BUCKET_KEY"),
                sse_algorithm="aws:kms",
            ),
            bucket_key_enabled=True,
        ),
    ],
)

# Export the S3 bucket name
pulumi.export("bucket", bucket.id)


# In other stack that uses the core stack
# Fetch config values used throughout
core_org = config.require("core-org")
core_project = config.require("core-project")
core_stack_name = config.require("core-stack")
core_stack_ref = pulumi.StackReference(f"{core_org}/{core_project}/{core_stack_name}")

bucket = core_stack_ref.require_output("bucket")

bucket_list = [bucket]

apprunner_instance_policy_document = json.dumps(
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                ],
                "Effect": "Allow",
                "Resource": [f"arn:aws:s3:::{bucket}/*" for bucket in bucket_list],
            },
        ],
    }
)
b
Copy code
apprunner_instance_policy_document = pulumi.Output.json.dumps(
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                ],
                "Effect": "Allow",
                "Resource": [
                    pulumi.Output.concat("arn:aws:s3:::", bucket),
                 ],
            },
        ],
    }
)
c
thanks! will have a look on monday
5 Views
Open in Slack
PreviousNext
Powered by