I am trying to add the ARN of a log group at an IAM policy b

Question

I am trying to add the ARN of a log group at an IAM policy but Pulumi doesn t like me doing it I get the error `error aws iam policy Policy resource Amazing Lambda can log to cloudwatch has a problem policy contains an invalid JSON invalid character n in string literal Examine values at Policy Policy ` Here s the code surely I can use the output of `LogGroup` in my `Policy` ```export class Lambda extends pulumi ComponentResource constructor name string args any opts pulumi ComponentResourceOptions lt lt lt gt gt gt lt lt lt gt gt gt this cloudwatchLog = new aws cloudwatch LogGroup `$ name lambda vpc cloudwatch log` name ` aws lambda amazingLambda` retentionInDays 14 parent this this cloudwatchPolicy = new aws iam Policy `AmazingLambda can log to cloudwatch` description `Grants AmazingLambda permission to write to Cloudwatch logs for monitoring` policy ` Version 2012 10 17 Statement Sid AmazingLambdaCanLog Effect Allow Action logs PutLogEvents logs CreateLogStream logs CreateLogGroup Resource $ this cloudwatchLog arn ` parent this ```

little-cartoon-10569 · Answer

No You re building a string there and `this cloudwatchLog` is an output so `this cloudwatchLog arn` is a lifted output

little-cartoon-10569 · Answer

Instead of building the JSON document yourself build an aws iam PolicyDocument object Then you can use the output in the expected way

little-cartoon-10569 · Answer

And you get syntax checking

little-cartoon-10569 · Answer

If you just get rid of the backticks and change the JSON syntax to TS JS syntax remove the quotes around the keys it should work Maybe some capitalization issues not sure

green-bird-4706 · Answer

It s definitely an issue trying to use template literals with the Pulumi Ouput lt string gt type which seems to be a pseudo promise But I can t work out how else to do it `PolicyDocument` looks to be the answer I m just trying to port what I had in Terraform to Pulumi and learning along the way Thanks for the help

green-bird-4706 · Answer

```this cloudwatchPolicy = new aws iam Policy `$ name can log to cloudwatch` description `Grants $ name permission to write to Cloudwatch logs for monitoring` policy Version 2012 10 17 Statement Sid `$ snakeCaseName CanLog` Effect Allow Action logs PutLogEvents logs CreateLogStream logs CreateLogGroup Resource this cloudwatchLog arn apply arn string = gt arn parent this ``` For anyone else with this issue this worked for me And I think this is how it s done

little-cartoon-10569 · Answer

The policy object is a normal object so you don t need to quote the keys

little-cartoon-10569 · Answer

And this is redundant `this cloudwatchLog arn apply arn string = gt arn ` Just use `this cloudwatchLog arn`

green-bird-4706 · Answer

gt And this is redundant `this cloudwatchLog arn apply arn string = gt arn ` Just use `this cloudwatchLog arn` I did try that and it failed Error message said I should try this and it worked Let me try it again

green-bird-4706 · Answer

``` this cloudwatchPolicy = new aws iam Policy `$ name can log to cloudwatch` description `Grants $ name permission to write to Cloudwatch logs for monitoring` policy Version 2012 10 17 Statement Sid `$ snakeCaseName CanLog` Effect Allow Action logs PutLogEvents logs CreateLogStream logs CreateLogGroup Resource this cloudwatchLog arn apply value string = gt value parent this vpcRole ``` And it works I think my state got a little bit funky and might have caused the error last night Thank you thank you

green-bird-4706 · Answer

Also found this little gem hidden in the docs today for string interpolation ```pulumi interpolate`$ myS3Bucket arn ```` Which is good for making policies Just if anyone else reads this before Slack deletes it