https://pulumi.com
Join Slack
This message was deleted.
# general
s
This message was deleted.
b
aws + typescript
i create a kms key/alias
Copy code
// create KMS key
var kms_key_name = `${prefix}-kms-key-ecs`;
var kms_key = new aws.kms.Key(kms_key_name);

// create key alias
var kms_key_alias_name = `${prefix}-kms-alias-ecs`;
var kms_key_alias = new aws.kms.Alias(kms_key_alias_name, {
    name: `alias/${kms_key_alias_name}`,
    targetKeyId: kms_key.arn
},
{
    dependsOn: kms_key,
    deleteBeforeReplace: true
});
right below try to use that key ARN in a policy, but the policy takes json data as string
Copy code
// taken from pulumi example to get output into string then interpolate
const final_key_arn: pulumi.Output<string> = kms_key.arn;

let policy = new aws.iam.Policy(ecs_role_name, {
    name: ecs_role_name,
    policy: JSON.stringify({
        "Version": "2012-10-17",
        "Statement": [{
                "Effect": "Allow",
                "Action": [
                    "kms:Encrypt",
                    "kms:Decrypt"
                ],
                "Resource": `${final_key_arn}`
                }]
        })
    });
this doesnt work ^ says:
Copy code
Calling [toString] on an [Output<T>] is not supported.\\n\\nTo get the value of an Output<T> as an Output<string> consider either:\\n1: o.apply(v => `prefix${v}suffix`)\\n2: pulumi.interpolate `prefix${v}suffix`\\n\\nSee <https://pulumi.io/help/outputs> for more details.\\nThis function may throw in a future version of @pulumi/pulumi.\
s
@brave-angle-33257 this is the same pattern as for using ARNs in policies
Copy code
output({
    // your policy as a json object including references
}).apply(JSON.stringify)
b
on the output itself?
Copy code
const key_arn = kms_key.arn.apply(JSON.stringify)
sorry that snippet i cant tell exactly where it should be placed in my example context
is there a doc example?
s
One sec, I’ll dig out an example
b
ok thank you much
b
This is not a KMS example but the pattern is the same:
Copy code
const testToken = new aws.dynamodb.TableItem("test-token", {
  hashKey: jwtTokenTable.hashKey
  ,item: apiKeysOutput.apply( (keys) => 
    JSON.stringify({ 
      applicationID:   {"S":  keys.TEST.value }
      ,token:          {"S": "this-is-a-test-token"}
      ,expires:        {"S": "NEVER"}
    })
  )
  ,tableName: jwtTokenTable.name,
})
We build the dynamo tableitem by applying the the output we want then JSON stringifying it.
s
@brave-angle-33257 Here we go:
Copy code
// create KMS key
var kms_key_name = `${prefix}-kms-key-ecs`;
var kms_key = new aws.kms.Key(kms_key_name);

// create key alias
var kms_key_alias_name = `${prefix}-kms-alias-ecs`;
var kms_key_alias = new aws.kms.Alias(kms_key_alias_name, {
        name: `alias/${kms_key_alias_name}`,
        targetKeyId: kms_key.arn
    },
    {
        deleteBeforeReplace: true
    });

let policy = new aws.iam.Policy("xx", {
    name: "whatever",
    policy: pulumi.output({
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt"
            ],
            "Resource": kms_key_alias.arn,
        }]
    }).apply(JSON.stringify),
});
Note that you don’t need 
dependsOn
for the alias since it picks up the dependency via 
kms_key.arn
b
ah, ok.. I haven’t seen that pulumi.output() before
ok.. thanks for confirming that also
let me give this a shot
s
Yup, let me know if you hit issues there
b
perfect! that worked.. ok, i think this makes a bit more sense
i’ve been able to get handy with the apply() on outputs going directly to inputs such as
Copy code
subnetMappings: public_subnet_ids.apply(x => x.map(y => ({ subnetId: y }))),
s
Yup - you can do that. Basically apply is “when this value is known, do this to it and produce a new value”
b
but when going into a string, still have some issues, but i see this pattern of creating the object, passing it into an output constructor, then applying a stringify makes sense
excellent, thanks again! this is for a rushed-production endeavor so you prompt reply was much appreciated
s
No worries, feel free to tag if there’s anything else, I’ll be around most of this week
👍 1
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by