This message was deleted.

sparse-intern-71089

02/15/2023, 7:22 PM

This message was deleted.

dry-journalist-60579

02/15/2023, 7:23 PM

Would I just want to edit the

existing_role

itself rather than attaching a policy?

dry-journalist-60579

02/15/2023, 7:25 PM

Or would I want to add a (permission) policy to the

SSO_ROLE_ARN

that allows it to assume the

existing_role

steep-toddler-94095

02/15/2023, 7:31 PM

don't quote me on this, but i think this is correct

Would I just want to edit the
existing_role
itself rather than attaching a policy?

dry-journalist-60579

02/15/2023, 7:32 PM

existing_role = aws.iam.get_role(name="AWSControlTowerAdmin")

=> finds the existing role… But I can’t mutate it that way, right?

steep-toddler-94095

02/15/2023, 7:35 PM

nope, you'd have to import it into Pulumi State. Is this resource being managed by something else or was it created imperatively through the API/UI/CLI

dry-journalist-60579

02/15/2023, 7:36 PM

Created via Control Tower bootstrapping process in the UI

steep-toddler-94095

02/15/2023, 7:40 PM

i'm not familiar with that service, but does it manage the state of the resources it creates or is it mostly a bootstrap-and-forget process? just cause if that's the case you wouldn't want to have a resoruce be managed by both Pulumi and Control Tower

dry-journalist-60579

02/15/2023, 7:42 PM

https://docs.aws.amazon.com/controltower/latest/userguide/roles-how.html looks like it’s a bootstrap and forget situation as they recommend you “manually edit your AWS Control Tower trust policy to add at least one aws:SourceArn or aws:SourceAccount conditional to the policy statement” (in the

Optional conditions for your role trust relationships

section)

👍 1

steep-toddler-94095

02/15/2023, 7:43 PM

in that case a pulumi import would work

dry-journalist-60579

02/15/2023, 7:44 PM

would it be

Copy code

pulumi import aws:iam/role:Role AWSControlTowerAdmin AWSControlTowerAdmin

steep-toddler-94095

02/15/2023, 7:46 PM

yup

dry-journalist-60579

02/15/2023, 7:49 PM

Ok so now that I have the code that will bring me back to the base state, I can just edit that code to include the changes I want?

steep-toddler-94095

02/15/2023, 7:50 PM

yup!

dry-journalist-60579

02/15/2023, 7:50 PM

Thank you!!

p 1

4 Views

Open in Slack

Previous Next

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.