https://pulumi.com logo
Join Slack
Powered by
This message was deleted.
# general
s
This message was deleted.
b
aws + typescript
i create a kms key/alias
Copy code
// create KMS key
var kms_key_name = `${prefix}-kms-key-ecs`;
var kms_key = new aws.kms.Key(kms_key_name);

// create key alias
var kms_key_alias_name = `${prefix}-kms-alias-ecs`;
var kms_key_alias = new aws.kms.Alias(kms_key_alias_name, {
    name: `alias/${kms_key_alias_name}`,
    targetKeyId: kms_key.arn
},
{
    dependsOn: kms_key,
    deleteBeforeReplace: true
});
right below try to use that key ARN in a policy, but the policy takes json data as string
Copy code
// taken from pulumi example to get output into string then interpolate
const final_key_arn: pulumi.Output<string> = kms_key.arn;

let policy = new aws.iam.Policy(ecs_role_name, {
    name: ecs_role_name,
    policy: JSON.stringify({
        "Version": "2012-10-17",
        "Statement": [{
                "Effect": "Allow",
                "Action": [
                    "kms:Encrypt",
                    "kms:Decrypt"
                ],
                "Resource": `${final_key_arn}`
                }]
        })
    });
this doesnt work ^ says:
Copy code
Calling [toString] on an [Output<T>] is not supported.\\n\\nTo get the value of an Output<T> as an Output<string> consider either:\\n1: o.apply(v => `prefix${v}suffix`)\\n2: pulumi.interpolate `prefix${v}suffix`\\n\\nSee <https://pulumi.io/help/outputs> for more details.\\nThis function may throw in a future version of @pulumi/pulumi.\
s
@brave-angle-33257 this is the same pattern as for using ARNs in policies
Copy code
output({
    // your policy as a json object including references
}).apply(JSON.stringify)
b
on the output itself?
Copy code
const key_arn = kms_key.arn.apply(JSON.stringify)
sorry that snippet i cant tell exactly where it should be placed in my example context
is there a doc example?
s
One sec, I’ll dig out an example
b
ok thank you much
b
This is not a KMS example but the pattern is the same:
Copy code
const testToken = new aws.dynamodb.TableItem("test-token", {
  hashKey: jwtTokenTable.hashKey
  ,item: apiKeysOutput.apply( (keys) => 
    JSON.stringify({ 
      applicationID:   {"S":  keys.TEST.value }
      ,token:          {"S": "this-is-a-test-token"}
      ,expires:        {"S": "NEVER"}
    })
  )
  ,tableName: jwtTokenTable.name,
})
We build the dynamo tableitem by applying the the output we want then JSON stringifying it.
s
@brave-angle-33257 Here we go:
Copy code
// create KMS key
var kms_key_name = `${prefix}-kms-key-ecs`;
var kms_key = new aws.kms.Key(kms_key_name);

// create key alias
var kms_key_alias_name = `${prefix}-kms-alias-ecs`;
var kms_key_alias = new aws.kms.Alias(kms_key_alias_name, {
        name: `alias/${kms_key_alias_name}`,
        targetKeyId: kms_key.arn
    },
    {
        deleteBeforeReplace: true
    });

let policy = new aws.iam.Policy("xx", {
    name: "whatever",
    policy: pulumi.output({
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt"
            ],
            "Resource": kms_key_alias.arn,
        }]
    }).apply(JSON.stringify),
});
Note that you don’t need 
dependsOn
for the alias since it picks up the dependency via 
kms_key.arn
b
ah, ok.. I haven’t seen that pulumi.output() before
ok.. thanks for confirming that also
let me give this a shot
s
Yup, let me know if you hit issues there
b
perfect! that worked.. ok, i think this makes a bit more sense
i’ve been able to get handy with the apply() on outputs going directly to inputs such as
Copy code
subnetMappings: public_subnet_ids.apply(x => x.map(y => ({ subnetId: y }))),
s
Yup - you can do that. Basically apply is “when this value is known, do this to it and produce a new value”
b
but when going into a string, still have some issues, but i see this pattern of creating the object, passing it into an output constructor, then applying a stringify makes sense
excellent, thanks again! this is for a rushed-production endeavor so you prompt reply was much appreciated
s
No worries, feel free to tag if there’s anything else, I’ll be around most of this week
👍 1
Open in Slack
PreviousNext
Powered by