This message was deleted.

something like this

import * as aws from '@pulumi/aws';

const defaultTags = { Creator: 'pulumi' };

const awsAccountId = pulumi.output(aws.getCallerIdentity()).accountId;

const infrastructureRole = new aws.iam.Role('infrastructure', {
  name: 'infrastructure',
  assumeRolePolicy: {
    Version: '2012-10-17',
    Statement: [{
      Effect: 'Allow',
      Action: 'sts:AssumeRole',
      Principal: {
        AWS: pulumi.interpolate`${awsAccountId}`,
      }
    }],
  },
  tags: defaultTags,
})

new aws.iam.RolePolicyAttachment('infrastructure-admin', {
  role: infrastructureRole.name,
  policyArn: aws.iam.getPolicyOutput({ name: 'SystemAdministrator'}).arn,
});
new aws.iam.RolePolicyAttachment('infrastructure-iam', {
  role: infrastructureRole.name,
  policyArn: aws.iam.getPolicyOutput({ name: 'IAMFullAccess' }).arn,
});

But for golang

@damp-continent-75299 yes, you need to use an

ApplyT

here’s a similarish example: https://github.com/lbrlabs/pulumi-aws-tailscale/blob/main/provider/pkg/provider/bastion.go#L102-L128

awesome, thank you so much 🙏