is there a way to specify the trust relationship w...
# aws
is there a way to specify the trust relationship when creating an iam role? or is there another way to go about it? trying to link an iam role with a eks serviceaccount..
hmm, maybe this trust relationship is just part of the policy, but separated in the ui for some reason?
The trust relationship is the
thank you!
const keelRole = new aws.iam.Role("keel-eksDeployer", { assumeRolePolicy: aws.getCallerIdentity().then(id =>
Copy code
      "Version": "2012-10-17",
      "Statement": [
   	  "Action": "sts:AssumeRoleWithWebIdentity",
          "Principal": {
   	  	"Federated": "arn:aws:iam::${id.accountId}:oidc-provider/${oidcProvider}"
	  "Condition": {
		"StringEquals": {
			"${oidcProvider}:sub": "system:serviceaccount:${config.clusterSvcsNamespaceName}:keel",
          "Effect": "Allow",
          "Sid": "serviceaccount"
,) });
Removing the Condition and I can get it to compile , but leaving it in there i get the error invalid JSON: invalid character '\n'. what have I done?
hmm, seems to a problem with my config.clusterSvcsNamespaceName as I can replace that with "foo" and the error goes away..hmm
I believe you may need to JSON.stringify() that policy body
oh, wow, thank you @miniature-musician-31262. that worked...
Awesome! Kind of unintuitive to have to do that, though, I admit.
really appreciate the help!
👍 1
well, the preview works, but creation fails.. pulumi up details look like this:
+ awsiam/roleRole: (create) [urn=urnpulumistage:keelawsiam/roleRole:keel-eksDeployer] [provider=urnpulumistage:keelpulumiprovidersawsdefault 1 20 0:31ba9] assumeRolePolicy : "\"{\\n \\\"Version\\\": \\\"2012-10-17\\\",\\n \\\"Statement\\\": [\\n {\\n \\t \\\"Action\\\": \\\"sts:AssumeRoleWithWebIdentity\\\",\\n \\\"Principal\\\": {\\n \\t \\t\\\"Federated\\\": \\\"arnawsiam::***:oidc-provider/***\\\"\\n },\\n\\t \\\"Condition\\\": {\\n\\t\\t\\\"Stri ngEquals\\\": {\\n\\t\\t\\t\\\"***:sub\\\": \\\"systemserviceaccountCalling [toString] on an [Output<T>] is not supported.\\n\\nTo get the value of an Output<T> as an Output<string> consider either\\n1 o.apply(v =>
)\\n2: pulumi.interpolate `prefix${v}suffix`\\n\\nSee for more details.\\nThis function may t hrow in a future version of @pulumi/pulumi.:keel\\\"\\n\\t\\t}\\n\\t },\\n \\\"Effect\\\": \\\"Allow\\\",\\n \\\"Sid\\\": \\\"serviceaccount\\\"\\n }\\n ]\\n }\\n\"" forceDetachPolicies: false maxSessionDuration : 3600 name : "keel-eksDeployer-1260ba1" path : "/"
tried replacing ${config.clusterSrvcsNamespace} with ${config.clusterSrvcsNamespace.apply(v =>
) } but still got a warning there, not sure if that is related or not
if i remove that bit and just hardcode the cluster service namespace, then i hit a policy contains invalid json during the up.
hmm, that goes away if i remove the JSON.stringify()..
in summary, the above code works as long as i hardcode the namespace name in the Condition.
If you could toss this part of your code into a GitHib Gist, it’d probably be easier to see what’s going on there.
(wondering where oidcProvider is coming from)
Oidcprovider isn't important, can replace that with string foo.
It looks like you are trying to stringify an output, which is an async promise. You need to wrap the stringify in apply() to create another promise