pulumi.jsonStringify

is a helper method to make this easier

I've gotten a bit closer to my desired outcome but I think my issue revolves around Output<T> and building the statement with

apply

. TypeScript is new to me and I feel this is largely where my issues have revolved around. If I do the following:

constructor(name: string, args: { clusterName: string, oidcArn: string, oidcUrl: string }, opts?: pulumi.ComponentResourceOptions) {
    super("pkg:iam:clusterAutoscalerRole", name, args, opts);
    let clusterName: string = args.clusterName;
    let clusterTag: string = `aws:ResourceTag/k8s.io/cluster-autoscaler/${clusterName}`;

    this.policy = new aws.iam.Policy(name, {
      path: "/",
      description: "Amazon EKS - Cluster autoscaler policy",
      policy: pulumi.jsonStringify({
    Version: "2012-10-17",
    Statement: [
        {
            Sid: "VisualEditor0",
            Effect: "Allow",
            Action: [
                "autoscaling:SetDesiredCapacity",
                "autoscaling:TerminateInstanceInAutoScalingGroup"
            ],
            Resource: "*",
            Condition: {
                StringEquals: {
                    [clusterTag]: "owned"
                }
            }
        },
        {
            Sid: "VisualEditor1",
            Effect: "Allow",
            Action: [
                "autoscaling:DescribeAutoScalingInstances",
                "autoscaling:DescribeAutoScalingGroups",
                "ec2:DescribeLaunchTemplateVersions",
                "autoscaling:DescribeTags",
                "autoscaling:DescribeLaunchConfigurations",
                "ec2:DescribeInstanceTypes"
            ],
            Resource: "*"
        }
    ]
})
    }, { parent: this });

I get this in preview:

policy     : "{"Version":"2012-10-17","Statement":[{"Sid":"VisualEditor0","Effect":"Allow","Action":["autoscaling:SetDesiredCapacity","autoscaling:TerminateInstanceInAutoScalingGroup"],"Resource":"*","Condition":{"StringEquals":{"aws:ResourceTag/k8s.io/cluster-autoscaler/":"owned"}}},{"Sid":"VisualEditor1","Effect":"Allow","Action":["autoscaling:DescribeAutoScalingInstances","autoscaling:DescribeAutoScalingGroups","ec2:DescribeLaunchTemplateVersions","autoscaling:DescribeTags","autoscaling:DescribeLaunchConfigurations","ec2:DescribeInstanceTypes"],"Resource":"*"}]}"

Where part of the key is populated but I am still missing the cluster name portion.

Even tried this:

constructor(name: string, args: { clusterName: string, oidcArn: string, oidcUrl: string }, opts?: pulumi.ComponentResourceOptions) {
    super("pkg:iam:clusterAutoscalerRole", name, args, opts);
    let tags = {};
    let clusterTag = pulumi.interpolate `aws:ResourceTag/k8s.io/cluster-autoscaler/${args.clusterName}`;
    clusterTag.apply(s => tags[s] = "owned");

    this.policy = new aws.iam.Policy(name, {
      path: "/",
      description: "Amazon EKS - Cluster autoscaler policy",
      policy: pulumi.jsonStringify({
    Version: "2012-10-17",
    Statement: [
        {
            Sid: "VisualEditor0",
            Effect: "Allow",
            Action: [
                "autoscaling:SetDesiredCapacity",
                "autoscaling:TerminateInstanceInAutoScalingGroup"
            ],
            Resource: "*",
            Condition: {
                StringEquals: tags
            }
        },
        {
            Sid: "VisualEditor1",
            Effect: "Allow",
            Action: [
                "autoscaling:DescribeAutoScalingInstances",
                "autoscaling:DescribeAutoScalingGroups",
                "ec2:DescribeLaunchTemplateVersions",
                "autoscaling:DescribeTags",
                "autoscaling:DescribeLaunchConfigurations",
                "ec2:DescribeInstanceTypes"
            ],
            Resource: "*"
        }
    ]
})
    }, { parent: this });

But ended up with:

policy     : "{"Version":"2012-10-17","Statement":[{"Sid":"VisualEditor0","Effect":"Allow","Action":["autoscaling:SetDesiredCapacity","autoscaling:TerminateInstanceInAutoScalingGroup"],"Resource":"*","Condition":{"StringEquals":{}}},{"Sid":"VisualEditor1","Effect":"Allow","Action":["autoscaling:DescribeAutoScalingInstances","autoscaling:DescribeAutoScalingGroups","ec2:DescribeLaunchTemplateVersions","autoscaling:DescribeTags","autoscaling:DescribeLaunchConfigurations","ec2:DescribeInstanceTypes"],"Resource":"*"}]}"

Where

StringEquals

gets set to an empty

{}

Ok, this is great. For context, the above resides in a file named

iam.ts

which is imported into

index.ts

within the project. Below is what exists in

index.ts

as it relates to the code in question:

const clusterOidcProvider = cluster.core.oidcProvider;
export const clusterOidcProviderUrl = clusterOidcProvider.url;
export const clusterOidcProviderArn = clusterOidcProvider.arn;
let clusterName = cluster.core.cluster.name;
let args = {
  clusterName: "",
  oidcArn: "", 
  oidcUrl: "",
}
clusterName.apply(s => args["clusterName"] = s);
clusterOidcProviderArn.apply(s => args["oidcArn"] = s);
clusterOidcProviderUrl.apply(s => args["oidcUrl"] = s);
export const clusterAutoscalerRole = new iam.clusterAutoscalerRole(`${projectName}-${stackName}`, args);

The intent here was to package what is required to create the necessary role into a single Component Resource. My next step was going to be creating the policy document like you did in that example as well as what I had seen here. I figured I would include this additional bit of info in case I am just way off the mark, but I see that you're using

all()

here which I haven't done and maybe that will be helpful 🤞

Got this all buttoned up. Thanks again @billowy-army-68599!