https://pulumi.com
Join Slack
This message was deleted.
# general
s
This message was deleted.
w
I use 
PolicyDocument
in .NET/C# using 
Output.Tuple
as follows:
Copy code
private static Output<string> AssumeRoleForServiceAccount(Output<string> oidcArn, Output<string> oidcUrl, string saNamespace, string saName) =>
    Output.Tuple(oidcArn, oidcUrl).Apply(((string OidcArn, string OidcUrl)tuple) => GetPolicyDocument.InvokeAsync(
        new GetPolicyDocumentArgs
        {
            Statements =
            {
                new GetPolicyDocumentStatementArgs
                {
                    Effect = "Allow",
                    Principals =
                    {
                        new GetPolicyDocumentStatementPrincipalArgs
                        {
                            Type = "Federated",
                            Identifiers = { tuple.OidcArn }
                        }
                    },
                    Actions = { "sts:AssumeRoleWithWebIdentity" },
                    Conditions =
                    {
                        new GetPolicyDocumentStatementConditionArgs
                        {
                            Test = "StringEquals",
                            Values = { $"system:serviceaccount:{saNamespace}:{saName}" },
                            Variable = $"{tuple.OidcUrl}:sub"
                        }
                    }
                }
            }
        })).Apply(policy => policy.Json);
The sample principle would apply to TypeScript
k
thanks, I'm trying to avoid the apply nesting as it's kind of painful, and the snippet I posted works, just not sure why casting to any works (at runtime)
this is the equivalent, using the correct apply flow (I guess)
Copy code
const assumeDevelopersRolePolicyData = devRole.name.apply((name) => {
    return aws.iam.getPolicyDocument({
      version: "2012-10-17",
      statements: [
        {
          effect: "Allow",
          actions: ["sts:AssumeRole"],
          resources: [`arn:aws:iam::${dev_account_id}:role/${name}`],
        },
      ],
    });
  });
Sorry, missed the last apply to return Output<string> from doc.json, but you get the idea 🙂
I really need to just get it through my head
YOU CANNOT CONVERT OUTPUT<T> TO T 😄
m
Yeah, I think you worked this out. You might also like `pulumi.all([foo.value, bar.arn]).apply(([fooValue, barArn]) => { return `${fooValue}-${barArn}`; });` https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/pulumi/#all
also in your case, you might be able to use the shortcut for apply: `pulumi.interpolate`arnawsiam::${dev_account_id}:role/${name}``
I’m curious if the ARN you’re building is different than 
devRole.arn
— in which case you should be able to just specify that,
k
re the interpolate, yes, but that's the thing, as I have to convert it to string, casting it to <any> works but otherwise there's no implicit conversion from Output<T> to T
👍 1
you're correct, nice catch, devRole.arn will suffice on its own, thanks 🙂
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by