microscopic-zoo-3564
05/10/2021, 3:09 AMoriginAccessIdentity.id
value is not working, and results in an error Error putting S3 policy: MalformedPolicy: Policy has invalid principal
I can't seem to find an example anywhere that uses anything other than the bucket name in the policy.
const domain = "<mailto:testing@example.com|testing@example.com>";
const contentBucket = new aws.s3.Bucket("content-bucket", {
bucket: domain,
acl: "private",
website: {
indexDocument: "index.html",
errorDocument: "index.html",
},
forceDestroy: true,
});
const originAccessIdentity = new aws.cloudfront.OriginAccessIdentity(
"cloudfront-oai",
{
comment: pulumi.interpolate`OAI-${contentBucket.bucketDomainName}`,
}
);
new aws.s3.BucketPolicy("bucket-policy", {
bucket: contentBucket.bucket,
policy: contentBucket.bucket.apply((bucketName) =>
JSON.stringify({
Version: "2012-10-17",
Statement: [
{
Sid: "CloudfrontAllow",
Effect: "Allow",
Principal: {
AWS: pulumi.interpolate`arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${originAccessIdentity.id}`,
},
Action: "s3:GetObject",
Resource: `arn:aws:s3:::${bucketName}/*`,
},
],
})
),
});
red-match-15116
05/10/2021, 3:19 AMinterpolate
inside an apply
. You’ll need to use Output.all
new aws.s3.BucketPolicy("bucket-policy", {
bucket: contentBucket.bucket,
policy: pulumi.all([contentBucket.bucket, originAccessIdentity.id]).apply(([bucketName, accessId]) =>
JSON.stringify({
Version: "2012-10-17",
Statement: [
{
Sid: "CloudfrontAllow",
Effect: "Allow",
Principal: {
AWS: `arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${accessId}`,
},
Action: "s3:GetObject",
Resource: `arn:aws:s3:::${bucketName}/*`,
},
],
})
),
});
little-cartoon-10569
05/10/2021, 3:24 AMInput<string | PolicyDocument>
. This is one of them. If you see that, then you don't need to do the "big" interpolation, and often you can skip interpolating entirely.red-match-15116
05/10/2021, 3:29 AMpulumi.interpolate
for the principal toolittle-cartoon-10569
05/10/2021, 3:30 AMred-match-15116
05/10/2021, 3:35 AMmake build
at the repo rootlittle-cartoon-10569
05/10/2021, 3:36 AMbillowy-army-68599
05/10/2021, 3:38 AMiamArn
output to make life a little easier 😄microscopic-zoo-3564
05/10/2021, 3:48 AMbillowy-army-68599
05/10/2021, 3:49 AMmicroscopic-zoo-3564
05/10/2021, 3:49 AMeager-librarian-67047
01/11/2022, 9:31 PMlittle-cartoon-10569
01/11/2022, 9:45 PMred-match-15116
01/11/2022, 9:48 PMPolicyDocument
alt type to any resource property where it would make senseTransform
policy
is the name of the field: https://github.com/pulumi/pulumi-aws/blob/e8ed71ede8a9cb457085859bff662a8b45e4b698/provider/resources.go#L1645-L1650little-cartoon-10569
01/11/2022, 9:51 PMred-match-15116
01/11/2022, 9:51 PM