<http://pulumicdk.App|pulumicdk.App>

<http://pulumicdk.App|pulumicdk.App>

import * as aws from '@pulumi/aws';
import * as pulumi from '@pulumi/pulumi';
import * as pulumicdk from '@pulumi/cdk';
import { ConsumerInfraConstruct } from "@redacted/service-hub-consumer-infra";
import { ServiceHubEnvironment, ServiceHubManagementAccountId } from '../../types/service-hub';

interface ServiceHubTargetInfraStackOptions extends pulumicdk.StackOptions {
    managementAccountId: ServiceHubManagementAccountId;

    serviceHubS3BucketArn: string;

    secretArn: string;

    environment: ServiceHubEnvironment;
}

class ServiceHubInfraStack extends pulumicdk.Stack {
    serviceRoleArn: pulumi.Output<string>;

    constructor(scope: pulumicdk.App, id: string, options: ServiceHubTargetInfraStackOptions) {
        super(scope, id, options);

        const service = new ConsumerInfraConstruct(this, 'service', {
            managementAccountId: options.managementAccountId,
            serviceHubS3BucketArn: options.serviceHubS3BucketArn,
            secretArn: options.secretArn,
            environment: options.environment,
        });

        this.serviceRoleArn = this.asOutput(service.serviceRole.roleArn);
    }
}

export class ServiceHubTargetInfraComponent extends pulumi.ComponentResource {

    constructor(id: string, args: { 
        provider: aws.Provider,
        serviceHubEnvironment: ServiceHubEnvironment,
    }, opts?: pulumi.ComponentResourceOptions) {

        // By calling super(), we ensure any instantiation of this class
        // inherits from the ComponentResource class so we don't have to
        // declare all the same things all over again.
        super("pkg:index:ServiceHubTargetInfraComponent", id, args, opts);

        const { provider, serviceHubEnvironment } = args;

        // Work out service hub settings based on only one service hub setting (the serviceHubEnvironment), so that we reduce setting fatigue for users/cloud operations.
        const managementAccountId = 'redacted';
        const serviceHubS3BucketArn = 'redacted';
        const secretArn = 'redacted';

        // Pulumi's CDK adapter requires you to define an App and a Stack
        const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
            const stack = new ServiceHubInfraStack(scope, 'service-hub-target-account-infra', {
                managementAccountId: managementAccountId,
                serviceHubS3BucketArn: serviceHubS3BucketArn,
                secretArn: secretArn,
                environment: serviceHubEnvironment,
                provider: provider,
            });

            return {
                serviceRoleArn: stack.serviceRoleArn,
            };
        }, {
            // This is fine, since we are using a cross-account provider, and the stack is deployed in the desired target account.
            provider: provider
        });


        // Register any Pulumi outputs from the stack if needed
        this.registerOutputs({}); // This is required for a ComponentResource
    }
}

{
  "Version": "2012-10-17",
  "Id": "require-ssl",
  "Statement": [
    {
      "Sid": "ssl",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::pulumi-cdk-staging-assets-access-123456789012-9f15c80",
        "arn:aws:s3:::pulumi-cdk-staging-assets-access-123456789012-9f15c80/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Sid": "AllowOrgGetListAccess",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "s3:Get*",
        "s3:List*"
      ],
      "Resource": [
        "arn:aws:s3:::pulumi-cdk-staging-assets-access-123456789012-9f15c80",
        "arn:aws:s3:::pulumi-cdk-staging-assets-access-123456789012-9f15c80/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:PrincipalOrgID": "o-MYORGIDHERE"
        }
      }
    }
  ]
}