This message was deleted.

async getAccountId() {
        const awsIdentity = await aws.getCallerIdentity({ async: true });
        const accountId = awsIdentity.accountId;
        return accountId;
    }

is the function Im trying to use to get the account ID, then I want to use it in a policy like:

// IAM role
        var ecs_role_name = `${ecs_cluster_name}-role-main`;
        this.holder["ecs_role_name"] = ecs_role_name;
        let assume_policy_document: aws.iam.PolicyDocument = {
            Version: "2012-10-17",
            Statement: [
                {
                    Action: "sts:AssumeRole",
                    Principal: {
                        AWS: this.getAccountId().then((x) => x),
                    },
                    Effect: "Allow",
                    Sid: "",
                },
            ],
        };

could you try returning awsIdentity then doing

awsIdentity.accountId.apply(id => id)

you want something like:

const identity = pulumi.output(aws.getCallerIdentity());
let policyDocument = identity.accountId.apply(id =>
{
    return {
        Version: "2012-10-17",
        Statement: [
            {
                Action: "sts:AssumeRole",
                Principal: {
                    AWS: id,
                },
                Effect: "Allow",
                Sid: "",
            },
        ],
    };
});

joshua with the better option 😉

excellent, thank you. i always get tripped up on these heh

checkout this in the docs: https://www.pulumi.com/docs/intro/concepts/inputs-outputs/ and then look for some examples of using the

.get

methods in here: https://github.com/pulumi/examples

after playing with this, getting stuck, and coming back to it, this was the final way I got this to work, not the easiest to figure out:

const identity = pulumi.output(aws.getCallerIdentity());

        let role = new aws.iam.Role(ecs_role_name, {
            name: ecs_role_name,
            assumeRolePolicy: pulumi
                .output(
                    identity.accountId.apply((id) => {
                        return {
                            Version: "2012-10-17",
                            Statement: [
                                {
                                    Action: "sts:AssumeRole",
                                    Principal: {
                                        AWS: `arn:aws:iam::${id}:root`,
                                    },
                                    Effect: "Allow",
                                    Sid: "",
                                },
                            ],
                        };
                    })
                )
                .apply(JSON.stringify),
        });

that is very odd to me - because

.apply(...)

is just for transforming

Output<T>

. So you apply an output, get a new output, and pass it to

pulumi.output(...)

when it is already an output

let me try, i thought I tried that, but let me check

yea! well I'm glad you figured out. I'm used to dotnet so there's definitely some small semantic differences to accomplish the same task that I tend to trip over so I'm glad you got it to work.

Thanks for your help!