Struggling to get my IAM policy to work, I’m trying to reference an ARN for a KMS key I created and marked as a dependency, but the

Output

isn’t ever resolved and the object (not the arn) ends up getting shoved in the json thus causing the error:

Plan apply failed: Error putting IAM role policy ******: MalformedPolicyDocument: Syntax errors in policy.
    	status code: 400, request id: 5d766e02-392b-11e9-b9bc-f57a45e4467f

@billions-lock-73409 policy documents are weird, the fields can’t be outputs for $REASONS

sure,

const rolePolicy = new aws.iam.RolePolicy(
    'probot_task_policy',
    {
        role: role,
        policy: JSON.stringify({
            Version: '2012-10-17',
            Statement: [
                {
                    Effect: 'Allow',
                    Action: [
                        'kms:ListKeys',
                        'kms:ListAliases',
                        'kms:Describe*',
                        'kms:Decrypt',
                    ],
                    Resource: [paramStoreKms.arn],
                },
                {
                    Effect: 'Allow',
                    Action: 'ssm:GetParameters',
                    Resource: [
                        `arn:aws:ssm:*:${config.require(
                            'accountId'
                        )}:parameter/secrets_probot_scanner/*`,
                    ],
                },
            ],
        }),
    },
    { parent: role }
);

@billions-lock-73409 you probably want something like

policy: paramStoreKms.arn.apply(arn => JSON.stringify({ ... })

yeah it does, I’ll give it a go, thanks!

yeah

awesome 👍