https://pulumi.com
Join Slack
This message was deleted.
# aws
s
This message was deleted.
b
Where are you using the using the bucket name? The issue doesn’t appear to be the stack ref
c
In an AppRunner policy (python code):
Copy code
"Resource": [f"arn:aws:s3:::{bucket}/*" for bucket in bucket_list],
b
That’s the problem, you can’t interpolate an output like that
You need to use an apply
c
Oh!
not sure I understand what it means though
b
I’m in transit right now, once I get to a stopping point I’ll post a more thorough answer.
Are you familiar with outputs at all?
c
nope
b
Then I’ll send the answer over when I get to a laptop
✅ 1
c
not much that is, besides using them in a way that worked fine
Copy code
subnets=core_stack_ref.get_output("defaultPrivateSubnetIds"),
I've a tried a ton of different things to no avail. e.g.: this did not work
Copy code
name = bucket.apply(lambda v: f"prefix{v}suffix")
b
Can you post the full code of the consuming stack
c
I can post the bits that should be relevant, edited for clarity, python code
Copy code
#  In core stack

# Create an aws.s3.BucketV2 resource with KMS server-side encryption
bucket = aws.s3.BucketV2(
    "bucket",
    tags={
        "Environment": environment,
        "Service": "core",
    },
)

bucket_attachments_policy = aws.s3.BucketServerSideEncryptionConfigurationV2(
    "bucket-policy",
    bucket=bucket.id,
    rules=[
        aws.s3.BucketServerSideEncryptionConfigurationV2RuleArgs(
            apply_server_side_encryption_by_default=aws.s3.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs(
                kms_master_key_id=config.require("KMS_BUCKET_KEY"),
                sse_algorithm="aws:kms",
            ),
            bucket_key_enabled=True,
        ),
    ],
)

# Export the S3 bucket name
pulumi.export("bucket", bucket.id)


# In other stack that uses the core stack
# Fetch config values used throughout
core_org = config.require("core-org")
core_project = config.require("core-project")
core_stack_name = config.require("core-stack")
core_stack_ref = pulumi.StackReference(f"{core_org}/{core_project}/{core_stack_name}")

bucket = core_stack_ref.require_output("bucket")

bucket_list = [bucket]

apprunner_instance_policy_document = json.dumps(
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                ],
                "Effect": "Allow",
                "Resource": [f"arn:aws:s3:::{bucket}/*" for bucket in bucket_list],
            },
        ],
    }
)
b
Copy code
apprunner_instance_policy_document = pulumi.Output.json.dumps(
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                ],
                "Effect": "Allow",
                "Resource": [
                    pulumi.Output.concat("arn:aws:s3:::", bucket),
                 ],
            },
        ],
    }
)
c
thanks! will have a look on monday
5 Views
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by