anyone got an example of adding a trust relationship assume

Question

anyone got an example of adding a trust relationship assume role policy to an IAM role that was created on earlier pulumi up

billowy-army-68599 · Answer

which language

purple-plumber-90981 · Answer

python pls

billowy-army-68599 · Answer

<https github com pulumi examples blob 258d3bad0a00020704743e37911c51be63c06bb4 aws py eks iam py L6 L22> you should just be able to update the definition like this

purple-plumber-90981 · Answer

will give it a try thx

purple-plumber-90981 · Answer

< billowy army 68599> when extending an already existing assume role policy is there a neat way to append to the existing role s assume role policy

billowy-army-68599 · Answer

if the API supports it it should just work is it trying to do a delete replace

purple-plumber-90981 · Answer

that was what i saw last week when i tried to apply over the top of the existing role yes

billowy-army-68599 · Answer

Can you share a little bit more about what you re trying to add so I can report it

billowy-army-68599 · Answer

Repro

purple-plumber-90981 · Answer

ok so this is not exactly the code for privacy reasons but essentially a sanitised version of same

purple-plumber-90981 · Answer

the role is created used to make eks cluster then after the oidc provider is created it must be updated to trust that provider

purple-plumber-90981 · Answer

so there is a cyclic dependency of sorts

purple-plumber-90981 · Answer

``` An AWS Python Pulumi program import json import pulumi from itplat region providers import providers import pulumi aws as aws provider opts = pulumi ResourceOptions provider=providers us east 1 admin role name = itplat eks clusteradmin role eks admin role = aws iam Role admin role name assume role policy= Version 2012 10 17 Statement Effect Allow Principal Service Action sts AssumeRole name=admin role name tags= clusterAccess itplat eks admin opts=pulumi ResourceOptions provider=providers us east 1 eks cluster vpc config = endpoint private access True endpoint public access False public access cidrs 0 0 0 0 0 security group ids eks securitygroup id subnet ids subnet 0e0ff2e099999c840 subnet 0b962f999996f624b subnet 09cc9999998dc4474 eks cluster config = role arn eks admin role arn version 1 19 vpc config eks cluster vpc config name itplat eks cluster create cluster resource eks cluster = aws eks Cluster itplat eks cluster opts=provider opts eks cluster config create oidc provider for cluster eks oidc provider = aws iam OpenIdConnectProvider itplat eks oidc provider client id lists= thumbprint lists= 9e99a48a999999999999999922da2b0ab7280 url=eks cluster identities 0 oidcs 0 issuer create the trust relationship assume role policy for the eks admin role crossplane provider trust relationship = Version 2012 10 17 Statement Effect Allow Principal Federated + eks oidc provider arn apply lambda arn f arn + Action sts AssumeRoleWithWebIdentity Condition StringLike + eks oidc provider id apply lambda id f id + sub system serviceaccount crossplane system provider aws Merge the oidc trust with the existing role trust current trust = json loads eks admin role assume role policy apply lambda trust f trust cpt = json loads crossplane provider trust relationship final trust = key value for key value in current trust items + cpt items apply merged trust relationship assume role policy to the eks admin role eks admin role = aws iam Role admin role name assume role policy=json dumps final trust name=admin role name tags= clusterAccess itplat eks admin opts=pulumi ResourceOptions provider=providers us east 1 ```

billowy-army-68599 · Answer

okay this is a unique case you can t declare the role twice We actually already handle this in our EKS provider is there a reason you re not using that

purple-plumber-90981 · Answer

because some other pulumi ppl suggested it was better to use the aws provider and exert a more fine grained control over what i was doing that way

purple-plumber-90981 · Answer

and now i have done almost all woth pulumi aws i dont want to redo it all with pulumi eks

purple-plumber-90981 · Answer

can you point me at the code that handles this case in the eks provider please

purple-plumber-90981 · Answer

the reason i was recommended to use the pulumi aws was because pulumi eks was not obeying providers that let me iterate this same code in several regions

billowy-army-68599 · Answer

i m just trying to track it down

purple-plumber-90981 · Answer

thx

billowy-army-68599 · Answer

ah wait hang on the `assumeRoleWithWebIdentity` shouldn t go in the admin role

billowy-army-68599 · Answer

that s the role that gets assigned to the service account it s different

purple-plumber-90981 · Answer

ok but i do all my iam roles upfront that the eks cluster need

purple-plumber-90981 · Answer

so even the service role pre exists

billowy-army-68599 · Answer

okay but you re defining two roles with the same name

purple-plumber-90981 · Answer

and i accept thats wrong and am after the learning to show me how to do it correctly

purple-plumber-90981 · Answer

i have a role created earlier with a trust that i need to update because of a subsequent condition

purple-plumber-90981 · Answer

in aws updating an existing role trust relationship because a thing has changed or been added is a valid use case

billowy-army-68599 · Answer

I don t have an example in Python I can try and write one tomorrow Here s some links in typescript You need the oidc ARN and the URL which you already have because you re using it in an `apply ` create a completely distinct role called `crossplaneRole` and build the IAM document using that info <https github com pulumi cert manager examples blob master examples letsencrypt rbac ts L14 L28> I m not sure what you mean when you say you have a role created earlier do you mean in the code or outside Pulumi

purple-plumber-90981 · Answer

i mean if i was managing roles in the aws IAM ui then this is a valid use case

purple-plumber-90981 · Answer

made some roles a month ago new business requirements come up need to add new trust to an existing role

purple-plumber-90981 · Answer

that type of thing

billowy-army-68599 · Answer

you need to import it into the Pulumi state

billowy-army-68599 · Answer

pulumi drives to a desired configuration

purple-plumber-90981 · Answer

im speaking hypothetically

billowy-army-68599 · Answer

you can just patch it using the AWS python SDK but it won t be part of the lifecycle

billowy-army-68599 · Answer

Pulumi cannot manipulate any IAM resources it doesn t know about If you have existing IAM roles and you want to add something to them you ll have to get it into Pulumi s state before you can do it

purple-plumber-90981 · Answer

in the case i have a role in my pulumi stack and need to add to its trust relationship but dont want to delete the existing role as it will impact existing running prod service

purple-plumber-90981 · Answer

what is the process

billowy-army-68599 · Answer

you d just update the code with the new trust relationship

billowy-army-68599 · Answer

I m sorry it s really hard to understand what s going on

purple-plumber-90981 · Answer

yeah but in this case its all in the same pulumi up run

purple-plumber-90981 · Answer

lol im having the same problem on my side having trouble understanding how this shoudl work we are porting something from ansible to pulumi

billowy-army-68599 · Answer

Okay here s a hypothetical EKS role ```eks role = iam Role eks iam role assume role policy=json dumps Version 2012 10 17 Statement Action sts AssumeRole Principal Service <http eks amazonaws com|eks amazonaws com> Effect Allow Sid ```

purple-plumber-90981 · Answer

and in the ansible code we get down to the oidc createion then we update the role

billowy-army-68599 · Answer

okay ansible and Pulumi work very very differently so we need to take a step back

billowy-army-68599 · Answer

You have your EKS role right the role you use for EKS to work properly as above ^^ then you define your OIDC connector to enable IAM roles for service accounts ```eks oidc provider = aws iam OpenIdConnectProvider itplat eks oidc provider client id lists= <http sts amazonaws com|sts amazonaws com> thumbprint lists= 9e99a48a999999999999999922da2b0ab7280 url=eks cluster identities 0 oidcs 0 issuer ``` okay if I m reafing between the lines correctly you now want to create a role that allows crossplane to function inside EKS with the right perms right

billowy-army-68599 · Answer

or are you trying to add the OIDC provider to this ```eks role = iam Role eks iam role assume role policy=json dumps Version 2012 10 17 Statement Action sts AssumeRole Principal Service <http eks amazonaws com|eks amazonaws com> Effect Allow Sid ```

purple-plumber-90981 · Answer

yes

purple-plumber-90981 · Answer

the latter

purple-plumber-90981 · Answer

is what we achieve in ansible

purple-plumber-90981 · Answer

so i was following the same structure

billowy-army-68599 · Answer

ooookay now I understand you need this resource <https www pulumi com docs reference pkg aws iam rolepolicyattachment >

billowy-army-68599 · Answer

which will attach a policy document to an existing resource

billowy-army-68599 · Answer

but also that s not the right way to do IAM roles with service accounts slightly smiling face

purple-plumber-90981 · Answer

cool happy to learn some best practice

purple-plumber-90981 · Answer

rolepolicyattachment is not for trust relationship i think

purple-plumber-90981 · Answer

only for regular policies

purple-plumber-90981 · Answer

i am already making use of that

billowy-army-68599 · Answer

the right way to do is to create a whole new distinct role ```crossplan role = iam Role crossplane role assume role policy=json dumps You ll need an `apply ` in here ``` add your policy there then assign THAT role to your k8s service account

purple-plumber-90981 · Answer

hmm ok i can try that out

billowy-army-68599 · Answer

you might be right on the role policy thing i don t think you can do what you want in this case

purple-plumber-90981 · Answer

something else my json loads Output apply code always fails

billowy-army-68599 · Answer

there s an example of how to it in Python here <https pulumi awsworkshop io 50 eks platform 30 deploy ingress controller 10 create iam role html>

purple-plumber-90981 · Answer

am i doing it wrong

purple-plumber-90981 · Answer

ie

purple-plumber-90981 · Answer

```current trustz = json loads eks admin role assume role policy apply lambda policy f current trust= policy print == current trust == pprint pprint current trustz ```

purple-plumber-90981 · Answer

this was so i could see the json as object

purple-plumber-90981 · Answer

resulted in

purple-plumber-90981 · Answer

``` current trustz = json loads eks admin role assume role policy apply lambda policy f current trust= policy File Users bmeehan pyenv versions 3 8 5 lib python3 8 json init py line 341 in loads raise TypeError f the JSON object must be str bytes or bytearray TypeError the JSON object must be str bytes or bytearray not Output error an unhandled error occurred Program exited with non zero exit code 1```

purple-plumber-90981 · Answer

oh wait thats the wrong output

billowy-army-68599 · Answer

yeah current trustz becomes a future do you have an understanding of how `apply ` works

purple-plumber-90981 · Answer

the whole Output promise future thing is doing my head in

billowy-army-68599 · Answer

see if this helps <https www leebriggs co uk blog 2021 05 09 pulumi apply html>

purple-plumber-90981 · Answer

when i am iterating over pulumi up add new code block pulumi up again

purple-plumber-90981 · Answer

then when a resource already exists in stack from last pulumi up im expecting its outputs to resolve

purple-plumber-90981 · Answer

but they fail

purple-plumber-90981 · Answer

reading now thx for the link

billowy-army-68599 · Answer

i have to head to bed if you re still struggling tomorrow I m happy to jump on a call to see if we can get this resolved I ll also build a proper EKS example tomorrow if I get chance

billowy-army-68599 · Answer

last thing your `current trustz` example above if you want to print it you do it inside the `apply ` then it ll work much like the example in the blog post

purple-plumber-90981 · Answer

like ```current trustz = json loads eks admin role assume role policy apply lambda policy pprint pprint json loads f policy ```

billowy-army-68599 · Answer

exactly

billowy-army-68599 · Answer

that should work

purple-plumber-90981 · Answer

``` current trustz = json loads eks admin role assume role policy apply lambda policy pprint pprint json loads f policy File Users bmeehan pyenv versions 3 8 5 lib python3 8 json init py line 341 in loads raise TypeError f the JSON object must be str bytes or bytearray TypeError the JSON object must be str bytes or bytearray not Output error an unhandled error occurred Program exited with non zero exit code 1```

purple-plumber-90981 · Answer

it seems like it is still a type Output

billowy-army-68599 · Answer

ah your JSON call needs to be inside the apply too

purple-plumber-90981 · Answer

erm it is

billowy-army-68599 · Answer

the first one

billowy-army-68599 · Answer

`current trustz = json loads lt ` this one

purple-plumber-90981 · Answer

lol my bad

billowy-army-68599 · Answer

but also <https www pulumi com docs intro concepts logging >

purple-plumber-90981 · Answer

is the result of the apply not assigned to the varaible

billowy-army-68599 · Answer

yes it will be but it s resolved when the apply is finished so it also has a value which is an output

purple-plumber-90981 · Answer

x = output stringthing apply lambda y f y

purple-plumber-90981 · Answer

so how do i get it as a string

purple-plumber-90981 · Answer

or a json object

purple-plumber-90981 · Answer

see this is where it bites me i get its a promise but if i need to do an action against the eventual value of that promise it fails in the preview phase of pulumi up

bored-oyster-3147 · Answer

You have an output that you would like to be interpolated into JSON Since it is an output there is no way to get it at runtime This means that your resulting JSON must be a transformation of that output and thus also an output So it should be something like `current trustz = eks admin role assume role policy apply lambda policy pprint pprint json loads f policy `

bored-oyster-3147 · Answer

but I m confused by why you would want to deserialize JSON and then immediately print it as a string Do you need just the deserialized JSON at the end Than it would be `current trustz = eks admin role assume role policy apply lambda policy json loads f policy `

purple-plumber-90981 · Answer

morning so the intent was to pull the current trust from the role merge it with the additional stuff trust required and update the role with the merged trust

purple-plumber-90981 · Answer

and also i wanted to look at the structure of the json currently in the role trust policy to understand if my merge as dict gt restore to serialised json would work

purple-plumber-90981 · Answer

part of iterating towards an eventual solution

purple-plumber-90981 · Answer

im moving forward now with the suggested alternate role for crossplane

purple-plumber-90981 · Answer

but that concept of look at the data structure of the output of a resource i created figure out how to morph it to what i need apply it finally as an input to a subsequent resource creation is the dev loop i still dont have a handle on

purple-plumber-90981 · Answer

i usually dev in pycharm and can see data structures in debug mode so i know how they are layed out but of course in a pulumi world they are hidden until applied

purple-plumber-90981 · Answer

im thinking maybe my dev loop needs to be 1 pulumi export the pulumi Output i want to inspect 2 work out how to tweek the data structure to what i need outside of pulumi 3 write a function to achieve that tweek 4 pass the new resource input value as x apply tweek function pulumi Output to achieve transformation of the existing resource A output to the required new resource B input

billowy-army-68599 · Answer

I m still struggling to understand why you need to inspect the values or modify them in anyway Pulumi is not procedural in any way what you define is exactly how the data looks You can t really modify anything that has already defined on the fly like this

purple-plumber-90981 · Answer

as aws resource have parameters and options that are modify able so it follows that we may need to modify adjust these parameters and options

purple-plumber-90981 · Answer

thus we may want to pull the existing value and make modifications based upon logic that applies to the current value

purple-plumber-90981 · Answer

this is the core of what i am trying to do

purple-plumber-90981 · Answer

i am iterating over a pulumi stack to create a desired end state stack that sets up an EKS cluster to how we need it

purple-plumber-90981 · Answer

i add in one component at a time

purple-plumber-90981 · Answer

sometimes the latest resource addition to my pulumi stack then requires me to modify a resource created in a past iteration

billowy-army-68599 · Answer

gt as aws resource have parameters and options that are modify able so it follows that we may need to modify adjust these parameters and options If you have a resource you ve defined and you update it Pulumi will perform an `update` action and modify it for you Is that not what you re seeing If if you add one resource component at a time it ll only add the changes you ve made

purple-plumber-90981 · Answer

so in this case i had a role with a trust i create an oidc provider and then i wanted to add a trust relationship for that to a role that had been created earlier

purple-plumber-90981 · Answer

because this is all in one stack this does not work as pulumi knows the dependency chain and does things in an order because of this

purple-plumber-90981 · Answer

and acting on the same resource twice in different ways in a single deployment does not work

purple-plumber-90981 · Answer

anyhow its not overly relevant now because i am moving to a different role for crossplane i get what you are saying generally speaking

billowy-army-68599 · Answer

right in your specific example there s a chicken and egg problem because you re creating 3 resources IAM Role EKS cluster that uses that IAM role OIDC provider You can t create the cluster without the IAM role and you can t create the OIDC provider without creating the cluster The point I m trying to get across is that there s an inherent reason for this None of the declarative IaC tools can do this because you re not supposed to do it Pulumi has resources to attach things to existing roles the `IamRolePolicyAttachment` which makes uses of specific API calls if you need to attach objects to other objects but if it doesn t exist it s because it s not a good idea

purple-plumber-90981 · Answer

sure or the use case hasnt yet been described covered

purple-plumber-90981 · Answer

anyhow i think for now i am ok progressing down the seperate role path and trying to figure out how to have to crossplane provider make use of that role instead

purple-plumber-90981 · Answer

it is different to our ansible build but thats ok as long as i can make it work the same way at the end of the path

purple-plumber-90981 · Answer

i think our helm charts may just need some modification to work with the crossplane role instead of the admin role

purple-plumber-90981 · Answer

``` create oidc provider for cluster eks oidc provider = aws iam OpenIdConnectProvider itplat eks oidc provider client id lists= <http sts amazonaws com|sts amazonaws com> thumbprint lists= 9e99a48a9960b14926bb7f3b02e22da2b0ab7280 url=eks cluster identities 0 oidcs 0 issuer create crossplaneadmin role crossplane admin role = aws iam Role itplat eks crossplaneadmin role assume role policy=pulumi Output all eks oidc provider arn eks oidc provider id apply lambda args json dumps Version 2012 10 17 Statement Effect Allow Principal Federated args 0 Action sts AssumeRoleWithWebIdentity Condition StringLike f args 1 sub system serviceaccount crossplane system provider aws name= itplat eks crossplaneadmin role tags= clusterAccess itplat eks admin opts=pulumi ResourceOptions provider=providers us east 1 ``` got me ``` File aws eks py line 116 in create assume role policy=pulumi Output all eks oidc provider arn eks oidc provider id apply TypeError apply got an unexpected keyword argument name error an unhandled error occurred Program exited with non zero exit code 1``` and im lost again

billowy-army-68599 · Answer

< purple plumber 90981> `pulumi Output all` takes a list ```pulumi Output all eks oidc provider arn eks oidc provider id ``` note the square brackets

purple-plumber-90981 · Answer

ah sweet thanks

purple-plumber-90981 · Answer

``` assume role policy=pulumi Output all eks oidc provider arn eks oidc provider id apply TypeError apply got an unexpected keyword argument name error an unhandled error occurred Program exited with non zero exit code 1```

purple-plumber-90981 · Answer

i think it must be the name keyword i pass aster assume role policy

bored-oyster-3147 · Answer

```assume role policy=pulumi Output all eks oidc provider arn eks oidc provider id apply lambda args json dumps Version 2012 10 17 Statement Effect Allow Principal Federated args 0 Action sts AssumeRoleWithWebIdentity Condition StringLike f args 1 sub system serviceaccount crossplane system provider aws name= itplat eks crossplaneadmin role ``` yea you re missing a closing parenthesis on the apply

purple-plumber-90981 · Answer

it was in the wrong place encapsulating the name= in the apply

purple-plumber-90981 · Answer

fixed now it was really late last night and i couldnt see it

bored-oyster-3147 · Answer

ah yea it was behind options i see it ok glad its working

purple-plumber-90981 · Answer

``` StringLike f args 1 sub system serviceaccount crossplane system provider aws IndexError list index out of range error an unhandled error occurred Program exited with non zero exit code 1```

purple-plumber-90981 · Answer

now i think the square brackets i added in teh output all are borking it

purple-plumber-90981 · Answer

trying without

purple-plumber-90981 · Answer

yeah it works without the square brackets

bored-oyster-3147 · Answer

probably just getting the languages confused easy to do around here