https://pulumi.com
Join Slack
This message was deleted.
# typescript
s
This message was deleted.
w
That’s right. And you can use that output as the input to another resource.
In this case you are computing a value that cannot be known until your original outputs value is known, and which is dependent on the things that your original output is dependent on - so that resulting value must itself be an output.
p
Should the 
aws.iam.getPolicyDocument
expect and 
Output<string>
and resolve it later then? This is where I’m having the issue:
Copy code
const iamExecutionPolicy = new aws.iam.Policy('foo', {
  policy: pulumi.output(
    aws.iam.getPolicyDocument({
      statements: [
        {
          effect: 'Allow',
          actions: ['ssm:GetParameters', 'kms:Decrypt'],
          resources: [
            key.arn.apply(a => a),
          ],
        },
      ],
    }),
  ).json,
});
If I replace the 
key.arn.apply(a => a)
with a string, it works fine.
w
It should be 
policy: key.arn.apply(a => aws.iam.getPolicyDocument(...))
.
p
Yep, I just found that in here, before I saw you message: https://github.com/pulumi/pulumi/issues/1911
If I had two arns to reference, it would “surround” the other one?
Copy code
policy: anotherKey.arn.apply(anotherArn =>
    key.arn.apply(keyArn =>
        aws.iam.getPolicyDocument({
Is it correct or is there a better approach to this?
w
If you have more than one output to reference - you can use `pulumi.all`: https://pulumi.io/reference/programming-model/#all
BTW - not to complicate things more here - but why are you using 
getPolicyDocument
here? That function is nearly never needed in Pulumi, since its goal is just to create a JSON document, and Pulumi/TypeScript can just do that directly. Here's a more direct way to accomplish this:
Copy code
const key = new aws.kms.Key("key");

const iamExecutionPolicy = new aws.iam.Policy('foo', {
    policy: pulumi.output({
        Version: '2008-10-17',
        Statement: [
            {
                Effect: 'Allow',
                Action: ['ssm:GetParameters', 'kms:Decrypt'],
                Resource: [ key.arn ],
            },
        ],
    }),
});
(this has the other slight benefit of using the real names of the JSON fields for an IAM policy document - instead of the slight differences the Terraform-derived 
getPolicyDocument
made up)
p
It seemed like a good option due to the typing in the policy document.
I think we may switch to your example then, seems way more simple.
@white-balloon-205 this example you sent does not work for me. I get this: 
Type 'UnwrappedObject<{ Version: string; Statement: { Effect: string; Action: string[]; Resource: string[]; }[]; }>' is not assignable to type 'string'.
Adding 
any
here made the trick: 
policy: pulumi.output<any>({
🙂
6 Views
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by