https://pulumi.com logo
Join Slack
Powered by
This message was deleted.
# python
s
This message was deleted.
c
I am creating an 
iam policy
that gets attached to a 
role
that my 
lambda
will assume in order to write logs to 
cloudwatch.
Here, I am trying to interpolate the lambda's physical name in the policy to help construct the 
log-group
arn:
Copy code
lambda_physical_name = my_lambda.name.apply(lambda name: name)

lambda_policy = aws.iam.RolePolicy(
            "lambdaPolicy",
            role=iam_for_lambda.name,
            policy=json.dumps(
                {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": "logs:CreateLogGroup",
                            "Resource": "arn:aws:logs:us-east-1:826697897825:*"
                        },
                        {
                            "Effect": "Allow",
                            "Action": [
                                "logs:CreateLogStream",
                                "logs:PutLogEvents"
                            ],
                            "Resource": [
                                f"arn:aws:logs:us-east-1:826697897825:log-group:/aws/lambda/{lambda_physical_name}*"
                            ]
                        },
                    ]
                }
            ),
        )
But the provisioned policy ends up reading:
Copy code
...

"Resource": ["arn:aws:logs:us-east-1:826697897825:log-group:/aws/lambda/<pulumi.output.Output object at 0x7f02baf74b80>*"]
However, when I refactor my policy resource this way, `it works as expected`:
Copy code
lambda_policy = aws.iam.RolePolicy(
            "lambdaPolicy",
            role=iam_for_lambda.name,
            policy=my_lambda.name.apply(
                lambda physical_name : json.dumps(
                {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": "logs:CreateLogGroup",
                            "Resource": "arn:aws:logs:us-east-1:826697897825:*"
                        },
                        {
                            "Effect": "Allow",
                            "Action": [
                                "logs:CreateLogStream",
                                "logs:PutLogEvents"
                            ],
                            "Resource": [
                                f"arn:aws:logs:us-east-1:826697897825:log-group:/aws/lambda/{physical_name}:*"
                            ]
                        }
                    ]
                }
            )
        ),
    )
I think my initial attempt initialized the 
policy
input property as type 
str
(a stringed json policy doc) and as a result, resolved 
lambda_physical_name
as the str representation of the 
Output<T>
object. Whereas my refactor initialized the 
policy
input as type 
Output<T>
, which is why my call to 
apply
resolved as expected. Am I understanding this correctly?
e
Yes your understanding this correctly Our other SDKs actually return a warning string if you try to convert an ouput to string. e.g in the C# sdk if you 
ToString
it returns the string:
Copy code
Calling [ToString] on an [Output<T>] is not supported.

To get the value of an Output<T> as an Output<string> consider:
1. o.Apply(v => $\"prefix{v}suffix\")
2. Output.Format($\"prefix{hostname}suffix\");

See <https://pulumi.io/help/outputs> for more details.
This function may throw in a future version of Pulumi.
We should probably do this for the python SDK as well, to help with users stumbling over it like this.
c
Thanks for the confirmation @echoing-dinner-19531 and for sharing that PR (v cool to see how you fix it 'under the hood')!
18 Views
Open in Slack
PreviousNext
Powered by