https://pulumi.com logo
Join Slack
Powered by
I'm trying to write a iam policy which depends on ...
# general
d
I'm trying to write a iam policy which depends on an iam role But I'm unable to reference it in the policy doc like:
Copy code
const iamRole = new aws.iam.Role(clusterName + "-server", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Principal: {
                "AWS": cluster.instanceRole <- this is type=pulumi.Output<aws.iam.Role>;
            },
            Effect: "Allow"
        }]
    })
});
c
@damp-book-35965 this is a trick part of the API, you want 
cluster.instanceRole.apply(ir => JSON.stringify(...))
✔️ 1
where 
assumeRolePolicy
goes.
that field is really supposed to be a string, but we’ve added some nice sugar to make it a JSON object — the downside is that you can’t use 
Input
in there.
if that makes sense.
d
Kind of..still trying to grok it fully with using pulumi .Output
But basically this makes the instance role available to use within the apply() function
c
ok so here’s what’s happening.
assumeRolePolicy
in the AWS API is actually type 
string
right? So 
new aws.iam.Role
actually converts the JSON you provide into`string`. It does this by calling 
toString
, I believe.
So, what this means is:
oh wait
no it doesn’t actually even do that, YOU have to do that.
d
toString is not supported
c
So the reason 
cluster.instanceRole
doesn’t work inside 
JSON.stringify
is actually because 
Output
is basically a promise.
So, in order to generate the correct string, 
JSON.stringfy
has to be run inside the 
.apply
—
d
Yes got that
c
otherwise you’re just `toString`’ing the promise. But you don’t want that. You want the value inside the promise once it resolves
d
Yes..makes sense..I think i got a bit confused because in some places it is supported to directly use the pulumi.Output<> but not everywhere
c
yeah
It’s hard to grok, we’re actively working on simplifying. 🙂
👍 1
d
Have to say it's beautiful when it works
Open in Slack
PreviousNext
Powered by