https://pulumi.com logo
#general
Title
# general
b

billions-lock-73409

02/25/2019, 6:42 PM
Struggling to get my IAM policy to work, I’m trying to reference an ARN for a KMS key I created and marked as a dependency, but the
Output
isn’t ever resolved and the object (not the arn) ends up getting shoved in the json thus causing the error:
Copy code
Plan apply failed: Error putting IAM role policy ******: MalformedPolicyDocument: Syntax errors in policy.
    	status code: 400, request id: 5d766e02-392b-11e9-b9bc-f57a45e4467f
c

creamy-potato-29402

02/25/2019, 6:46 PM
@billions-lock-73409 policy documents are weird, the fields can’t be outputs for $REASONS
Can you paste, the code? I can show you how to fix it.
b

billions-lock-73409

02/25/2019, 7:23 PM
sure,
Copy code
const rolePolicy = new aws.iam.RolePolicy(
    'probot_task_policy',
    {
        role: role,
        policy: JSON.stringify({
            Version: '2012-10-17',
            Statement: [
                {
                    Effect: 'Allow',
                    Action: [
                        'kms:ListKeys',
                        'kms:ListAliases',
                        'kms:Describe*',
                        'kms:Decrypt',
                    ],
                    Resource: [paramStoreKms.arn],
                },
                {
                    Effect: 'Allow',
                    Action: 'ssm:GetParameters',
                    Resource: [
                        `arn:aws:ssm:*:${config.require(
                            'accountId'
                        )}:parameter/secrets_probot_scanner/*`,
                    ],
                },
            ],
        }),
    },
    { parent: role }
);
paramStoreKms
is defined in a different module that I’m including, but is available and exported correctly
could the json string be the result of an apply?
c

creamy-potato-29402

02/25/2019, 8:00 PM
@billions-lock-73409 you probably want something like
policy: paramStoreKms.arn.apply(arn => JSON.stringify({ ... })
if that makes sense.
b

billions-lock-73409

02/25/2019, 8:01 PM
yeah it does, I’ll give it a go, thanks!
worked perfectly, thanks a bunch 👍
if I needed multiple Outputs i can use pulumi.all right?
to wrap them in a promise like that
c

creamy-potato-29402

02/25/2019, 8:07 PM
yeah
b

billions-lock-73409

02/25/2019, 8:25 PM
awesome 👍
3 Views