I’m losing my mind trying to pass an S3 resource to an IAM policy using TypeScript, can someone tell me what rookie mistake I’m making in trying to get the Output<String> value of contentBucket.arn in the below code:

const contentBucket = new aws.s3.Bucket('s3bucket',
  {
    bucket: 'bucket-1',
    acl: 'public-read',
  });

const s3Policy = new aws.iam.Policy('s3-test-policy', {
  policy: JSON.stringify({
    Version: '2012-10-17',
    Statement: [{
      Action: [
        's3:ListBucket',
        's3:GetObject ',
      ],
      Effect: 'Allow',
      Resource: contentBucket.arn
    }]
  })
});

Which returns

aws:iam:Policy (s3-test-policy):
    error: 1 error occurred:
        * Error creating IAM policy shu-tower-frontend-dev-s3-policy-4518918: MalformedPolicyDocument: Partition "
        1" is not valid for resource "arn:
        1: o.apply(v => v.toJSON())
        2: o.apply(v => JSON.stringify(v))

I’ve read the Inputs and Outputs page, but nothing I do seems to reveal the ARN of the resource (even though I can see in the Pulumi console that it was successfully created.

I am quite new to pulumi too. But I would certainly try something like this:

policy = contentBucket.arn.apply((arn) => {
  return JSON.stringify({
    Version: '2012-10-17',
    ...
    Resource: arn
  }
})

const s3Policy = new aws.iam.Policy('s3-test-policy', {
  policy: policy
});

Here's a similar aws s3 bucketpolicy usage: Note the

pulumi.all([bucket.arn, bucket.arn]).apply(..

Similar to what Brian already mentioned

Something similar happened to me the other day (also new). Have you tried @fierce-television-51712’s code @rich-leather-25702? I am wondering if you have to do

contentBucket.apply((bucket) => bucket.arn ...)

instead of

contentBucket.arn.apply()

. I would have guessed that the arn attr is not available at runtime yet and throws an error.

It should be

contentBucket.arn.apply()

.

@little-cartoon-10569 that code produces:

TS2554: Expected 1 arguments, but got 0.  output.d.ts(139, 14): An argument for 'func' was not provided.

That would produce a new output with the same value. You need to produce an output that is the entire policy document.

@little-cartoon-10569 not to seem daft, but that’s the exact code I posted at the beginning that was throwing the error - am I missing a change you’ve made?

@fierce-television-51712 thanks for the suggestion but

const arnVal = contentBucket.arn.apply((arn) => {
  return arn;
});

or

const arnVal = contentBucket.arn.apply((arn) => {
  return arn;
});

both return the same error:

Calling [toString] on an [Output<T>] is not supported.
    To get the value of an Output<T> as an Output<string> consider either:
    1: o.apply(v => `prefix${v}suffix`)
    2: pulumi.interpolate `prefix${v}suffix`

The JSON.stringify() explanation is the only problem in your code. You can't use JSON.stringify() if there's an output anywhere inside the object being stringified.

@little-cartoon-10569I think we’re making progress - without the Stringify line, I instead get

index.ts(273,3): error TS2322: Type '{ Version: string; Statement: { Action: string[]; Effect: string; Resource: pulumi.Output<string>[]; }[]; }' is not assignable to type 'Input<string | PolicyDocument>'.
      Type '{ Version: string; Statement: { Action: string[]; Effect: string; Resource: pulumi.Output<string>[]; }[]; }' is not assignable to type 'PolicyDocument'.
        Types of property 'Version' are incompatible.
          Type 'string' is not assignable to type 'Input<"2012-10-17" | "2008-10-17">'.

My solution was to return the document from a function with return type

aws.iam.PolicyDocument

. TS looked after everything else. It even highlighted my syntax errors in VSCode as I typed...

@little-cartoon-10569 we have a winner, casting to

aws.iam.PolicyDocument

yields the result, can’t believe the gotcha was the JSON.stringify bit!

Yep. I've learned that (almost?) all of the time with Pulumi, JSON.stringify isn't needed. Just build your objects directly as needed, and the stringification happens

Very cool - @rich-leather-25702 can you share your final solution just for posterity?

Of course, this was the winning solution, which eventually needed to be for CloudFront.

const cfPolicyDoc: aws.iam.PolicyDocument = {
  Version: '2012-10-17',
  Statement: [{
    Action: [
      'cloudfront:CreateInvalidation'
    ],
    Effect: 'Allow',
    Resource: [cdn.arn]
  }]
};

const cfPolicy = new aws.iam.Policy('cf-policy', {
  policy: cfPolicyDoc
});

Great news 🎉. I’d be interested in knowing what the “cdn” object is?