aws-cdk-lib.aws_iam.IAssumeRolePrincipal

IAssumeRolePrincipal Interface

A type of principal that has more control over its own representation in AssumeRolePolicyDocuments.

More complex types of identity providers need more control over Role's policy documents than simply { Effect: 'Allow', Action: 'AssumeRole', Principal: <Whatever> }.

If that control is necessary, they can implement IAssumeRolePrincipal to get full access to a Role's AssumeRolePolicyDocument.

IAssumeRolePrincipal

extends

• IPrincipal

implemented by

• AccountPrincipal,
• AccountRootPrincipal,
• AnyPrincipal,
• ArnPrincipal,
• 14 more

  • CanonicalUserPrincipal,
  • CompositePrincipal,
  • FederatedPrincipal,
  • OpenIdConnectPrincipal,
  • OrganizationPrincipal,
  • PrincipalBase,
  • PrincipalWithConditions,
  • SamlConsolePrincipal,
  • SamlPrincipal,
  • ServicePrincipal,
  • SessionTagsPrincipal,
  • StarPrincipal,
  • WebIdentityPrincipal,
  • ViaServicePrincipal

Source

aws-iam/lib/principals.ts

Type last changed

v2.4.0 · 6 Jan 2022

Properties

assumeRoleActionstringassume_role_actionstrassumeRoleActionStringAssumeRoleActionstringAssumeRoleAction*string#

When this Principal is used in an AssumeRole policy, the action to use.

grantPrincipalIPrincipalgrant_principalIPrincipalgrantPrincipalIPrincipalGrantPrincipalIPrincipalGrantPrincipalIPrincipal#

The principal to grant permissions to.

policyFragmentPrincipalPolicyFragmentpolicy_fragmentPrincipalPolicyFragmentpolicyFragmentPrincipalPolicyFragmentPolicyFragmentPrincipalPolicyFragmentPolicyFragmentPrincipalPolicyFragment#

Return the policy fragment that identifies this principal in a Policy.

principalAccount?may be undefinedstringprincipal_account?may be undefinedstrprincipalAccount?may be undefinedStringPrincipalAccount?may be undefinedstringPrincipalAccount?may be undefined*string#

The AWS account ID of this principal.

Can be undefined when the account is not known (for example, for service principals). Can be a Token - in that case, it's assumed to be AWS::AccountId.

Methods

addToAssumeRolePolicy(document: PolicyDocument): voiddef add_to_assume_role_policy(self, document: PolicyDocument) -> Nonepublic void addToAssumeRolePolicy(PolicyDocument document)public void AddToAssumeRolePolicy(PolicyDocument document)func AddToAssumeRolePolicy(Document PolicyDocument)#

Add the principal to the AssumeRolePolicyDocument.

Add the statements to the AssumeRolePolicyDocument necessary to give this principal permissions to assume the given role.

addToPrincipalPolicy(statement: PolicyStatement): AddToPrincipalPolicyResultdef add_to_principal_policy(self, statement: PolicyStatement) -> AddToPrincipalPolicyResultpublic AddToPrincipalPolicyResult addToPrincipalPolicy(PolicyStatement statement)public AddToPrincipalPolicyResult AddToPrincipalPolicy(PolicyStatement statement)func AddToPrincipalPolicy(Statement PolicyStatement) AddToPrincipalPolicyResult#

Add to the policy of this principal.