interface IAssumeRolePrincipal

Language	Type name
.NET	Amazon.CDK.AWS.IAM.IAssumeRolePrincipal
Java	software.amazon.awscdk.services.iam.IAssumeRolePrincipal
Python	aws_cdk.aws_iam.IAssumeRolePrincipal
TypeScript (source)	@aws-cdk/aws-iam » IAssumeRolePrincipal

Implemented by AccountPrincipal, AccountRootPrincipal, AnyPrincipal, Anyone, ArnPrincipal, CanonicalUserPrincipal, CompositePrincipal, FederatedPrincipal, OpenIdConnectPrincipal, OrganizationPrincipal, PrincipalWithConditions, SamlConsolePrincipal, SamlPrincipal, ServicePrincipal, SessionTagsPrincipal, StarPrincipal, WebIdentityPrincipal, ViaServicePrincipal

A type of principal that has more control over its own representation in AssumeRolePolicyDocuments.

More complex types of identity providers need more control over Role's policy documents than simply { Effect: 'Allow', Action: 'AssumeRole', Principal: <Whatever> }.

If that control is necessary, they can implement IAssumeRolePrincipal to get full access to a Role's AssumeRolePolicyDocument.

Properties

Name	Type	Description
assumeRoleAction	string	When this Principal is used in an AssumeRole policy, the action to use.
grantPrincipal	IPrincipal	The principal to grant permissions to.
policyFragment	PrincipalPolicyFragment	Return the policy fragment that identifies this principal in a Policy.
principalAccount?	string	The AWS account ID of this principal.

---

assumeRoleAction

Type: string

When this Principal is used in an AssumeRole policy, the action to use.

---

grantPrincipal

Type: IPrincipal

The principal to grant permissions to.

---

policyFragment

Type: PrincipalPolicyFragment

Return the policy fragment that identifies this principal in a Policy.

---

principalAccount?

Type: string (optional)

The AWS account ID of this principal.

Can be undefined when the account is not known (for example, for service principals). Can be a Token - in that case, it's assumed to be AWS::AccountId.

Methods

Name	Description
addToAssumeRolePolicy(document)	Add the princpial to the AssumeRolePolicyDocument.
addToPolicy(statement)⚠️	Add to the policy of this principal.
addToPrincipalPolicy(statement)	Add to the policy of this principal.

---

addToAssumeRolePolicy(document)

public addToAssumeRolePolicy(document: PolicyDocument): void

Parameters

• document PolicyDocument

Add the princpial to the AssumeRolePolicyDocument.

Add the statements to the AssumeRolePolicyDocument necessary to give this principal permissions to assume the given role.

---

addToPolicy(statement)⚠️

public addToPolicy(statement: PolicyStatement): boolean

⚠️ Deprecated: Use addToPrincipalPolicy instead.

Parameters

• statement PolicyStatement

Returns

• boolean

Add to the policy of this principal.

---

addToPrincipalPolicy(statement)

public addToPrincipalPolicy(statement: PolicyStatement): AddToPrincipalPolicyResult

Parameters

• statement PolicyStatement

Returns

• AddToPrincipalPolicyResult

Add to the policy of this principal.