In this case you are computing a value that cannot be known until your original outputs value is known, and which is dependent on the things that your original output is dependent on - so that resulting value must itself be an output.

If I replace the

key.arn.apply(a => a)

with a string, it works fine.

If I had two arns to reference, it would “surround” the other one?

policy: anotherKey.arn.apply(anotherArn =>
    key.arn.apply(keyArn =>
        aws.iam.getPolicyDocument({

Is it correct or is there a better approach to this?

BTW - not to complicate things more here - but why are you using

getPolicyDocument

here? That function is nearly never needed in Pulumi, since its goal is just to create a JSON document, and Pulumi/TypeScript can just do that directly. Here's a more direct way to accomplish this:

const key = new aws.kms.Key("key");

const iamExecutionPolicy = new aws.iam.Policy('foo', {
    policy: pulumi.output({
        Version: '2008-10-17',
        Statement: [
            {
                Effect: 'Allow',
                Action: ['ssm:GetParameters', 'kms:Decrypt'],
                Resource: [ key.arn ],
            },
        ],
    }),
});

(this has the other slight benefit of using the real names of the JSON fields for an IAM policy document - instead of the slight differences the Terraform-derived

getPolicyDocument

made up)

I think we may switch to your example then, seems way more simple.

@white-balloon-205 this example you sent does not work for me. I get this:

Type 'UnwrappedObject<{ Version: string; Statement: { Effect: string; Action: string[]; Resource: string[]; }[]; }>' is not assignable to type 'string'.

Adding

any

here made the trick:

policy: pulumi.output<any>({

🙂

For anyone who ends here, this was the issue: https://pulumi-community.slack.com/archives/C84L4E3N1/p1561146259221800?thread_ts=1561145480.213800&cid=C84L4E3N1