ManagedPolicyProps Struct
Properties for defining an IAM managed policy.
Example
ts
const policyDocument = {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "FirstStatement",
"Effect": "Allow",
"Action": ["iam:ChangePassword"],
"Resource": ["*"],
},
{
"Sid": "SecondStatement",
"Effect": "Allow",
"Action": ["s3:ListAllMyBuckets"],
"Resource": ["*"],
},
{
"Sid": "ThirdStatement",
"Effect": "Allow",
"Action": [
"s3:List*",
"s3:Get*",
],
"Resource": [
"arn:aws:s3:::confidential-data",
"arn:aws:s3:::confidential-data/*",
],
"Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}},
},
],
};
const customPolicyDocument = iam.PolicyDocument.fromJson(policyDocument);
// You can pass this document as an initial document to a ManagedPolicy
// or inline Policy.
const newManagedPolicy = new iam.ManagedPolicy(this, 'MyNewManagedPolicy', {
document: customPolicyDocument,
});
const newPolicy = new iam.Policy(this, 'MyNewPolicy', {
document: customPolicyDocument,
});
python
policy_document = {
"Version": "2012-10-17",
"Statement": [{
"Sid": "FirstStatement",
"Effect": "Allow",
"Action": ["iam:ChangePassword"],
"Resource": ["*"]
}, {
"Sid": "SecondStatement",
"Effect": "Allow",
"Action": ["s3:ListAllMyBuckets"],
"Resource": ["*"]
}, {
"Sid": "ThirdStatement",
"Effect": "Allow",
"Action": ["s3:List*", "s3:Get*"
],
"Resource": ["arn:aws:s3:::confidential-data", "arn:aws:s3:::confidential-data/*"
],
"Condition": {"Bool": {"aws:multi_factor_auth_present": "true"}}
}
]
}
custom_policy_document = iam.PolicyDocument.from_json(policy_document)
# You can pass this document as an initial document to a ManagedPolicy
# or inline Policy.
new_managed_policy = iam.ManagedPolicy(self, "MyNewManagedPolicy",
document=custom_policy_document
)
new_policy = iam.Policy(self, "MyNewPolicy",
document=custom_policy_document
)
java
Map<String, Object> policyDocument = Map.of(
"Version", "2012-10-17",
"Statement", List.of(Map.of(
"Sid", "FirstStatement",
"Effect", "Allow",
"Action", List.of("iam:ChangePassword"),
"Resource", List.of("*")), Map.of(
"Sid", "SecondStatement",
"Effect", "Allow",
"Action", List.of("s3:ListAllMyBuckets"),
"Resource", List.of("*")), Map.of(
"Sid", "ThirdStatement",
"Effect", "Allow",
"Action", List.of("s3:List*", "s3:Get*"),
"Resource", List.of("arn:aws:s3:::confidential-data", "arn:aws:s3:::confidential-data/*"),
"Condition", Map.of("Bool", Map.of("aws:MultiFactorAuthPresent", "true")))));
PolicyDocument customPolicyDocument = PolicyDocument.fromJson(policyDocument);
// You can pass this document as an initial document to a ManagedPolicy
// or inline Policy.
ManagedPolicy newManagedPolicy = ManagedPolicy.Builder.create(this, "MyNewManagedPolicy")
.document(customPolicyDocument)
.build();
Policy newPolicy = Policy.Builder.create(this, "MyNewPolicy")
.document(customPolicyDocument)
.build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
IDictionary<string, object> policyDocument = new Dictionary<string, object> {
{ "Version", "2012-10-17" },
{ "Statement", new [] { new Dictionary<string, object> {
{ "Sid", "FirstStatement" },
{ "Effect", "Allow" },
{ "Action", new [] { "iam:ChangePassword" } },
{ "Resource", new [] { "*" } }
}, new Dictionary<string, object> {
{ "Sid", "SecondStatement" },
{ "Effect", "Allow" },
{ "Action", new [] { "s3:ListAllMyBuckets" } },
{ "Resource", new [] { "*" } }
}, new Dictionary<string, object> {
{ "Sid", "ThirdStatement" },
{ "Effect", "Allow" },
{ "Action", new [] { "s3:List*", "s3:Get*" } },
{ "Resource", new [] { "arn:aws:s3:::confidential-data", "arn:aws:s3:::confidential-data/*" } },
{ "Condition", new Dictionary<string, IDictionary<string, string>> { { "Bool", new Dictionary<string, string> { { "aws:MultiFactorAuthPresent", "true" } } } } }
} } }
};
var customPolicyDocument = PolicyDocument.FromJson(policyDocument);
// You can pass this document as an initial document to a ManagedPolicy
// or inline Policy.
var newManagedPolicy = new ManagedPolicy(this, "MyNewManagedPolicy", new ManagedPolicyProps {
Document = customPolicyDocument
});
var newPolicy = new Policy(this, "MyNewPolicy", new PolicyProps {
Document = customPolicyDocument
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
policyDocument := map[string]interface{}{
"Version": jsii.String("2012-10-17"),
"Statement": []interface{}{
map[string]interface{}{
"Sid": jsii.String("FirstStatement"),
"Effect": jsii.String("Allow"),
"Action": []*string{
jsii.String("iam:ChangePassword"),
},
"Resource": []*string{
jsii.String("*"),
},
},
map[string]interface{}{
"Sid": jsii.String("SecondStatement"),
"Effect": jsii.String("Allow"),
"Action": []*string{
jsii.String("s3:ListAllMyBuckets"),
},
"Resource": []*string{
jsii.String("*"),
},
},
map[string]interface{}{
"Sid": jsii.String("ThirdStatement"),
"Effect": jsii.String("Allow"),
"Action": []*string{
jsii.String("s3:List*"),
jsii.String("s3:Get*"),
},
"Resource": []*string{
jsii.String("arn:aws:s3:::confidential-data"),
jsii.String("arn:aws:s3:::confidential-data/*"),
},
"Condition": map[string]map[string]*string{
"Bool": map[string]*string{
"aws:MultiFactorAuthPresent": jsii.String("true"),
},
},
},
},
}
customPolicyDocument := iam.PolicyDocument_FromJson(policyDocument)
// You can pass this document as an initial document to a ManagedPolicy
// or inline Policy.
newManagedPolicy := iam.NewManagedPolicy(this, jsii.String("MyNewManagedPolicy"), &ManagedPolicyProps{
Document: customPolicyDocument,
})
newPolicy := iam.NewPolicy(this, jsii.String("MyNewPolicy"), &PolicyProps{
Document: customPolicyDocument,
})
Properties
descriptionoptionalstringdescriptionoptionalstrdescriptionoptionalStringDescriptionoptionalstringDescriptionoptional*string= empty#A description of the managed policy.
Typically used to store information about the permissions defined in the policy. For example, "Grants access to production DynamoDB tables." The policy description is immutable. After a value is assigned, it cannot be changed.
documentoptionalPolicyDocumentdocumentoptionalPolicyDocumentdocumentoptionalPolicyDocumentDocumentoptionalPolicyDocumentDocumentoptionalPolicyDocument#Initial PolicyDocument to use for this ManagedPolicy.
Default: An empty policy.
If omited, any PolicyStatement provided in the statements property will be applied against the empty default PolicyDocument.
groupsoptionalIGroupRef[]groupsoptionaltyping.List[IGroupRef]groupsoptionalList<IGroupRef>GroupsoptionalIGroupRef[]Groupsoptional*[]IGroupRef#Groups to attach this policy to.
Default: No groups.
You can also use attachToGroup(group) to attach this policy to a group.
managedPolicyNameoptionalstringmanaged_policy_nameoptionalstrmanagedPolicyNameoptionalStringManagedPolicyNameoptionalstringManagedPolicyNameoptional*string#The name of the managed policy.
Default: A name is automatically generated.
If you specify multiple policies for an entity, specify unique names. For example, if you specify a list of policies for an IAM role, each policy must have a unique name.
The path for the policy.
notes
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
For more information about paths, see IAM Identifiers in the IAM User Guide.
rolesoptionalIRole[]rolesoptionaltyping.List[IRole]rolesoptionalList<IRole>RolesoptionalIRole[]Rolesoptional*[]IRole#Roles to attach this policy to.
Default: No roles.
You can also use attachToRole(role) to attach this policy to a role.
statementsoptionalPolicyStatement[]statementsoptionaltyping.List[PolicyStatement]statementsoptionalList<PolicyStatement>StatementsoptionalPolicyStatement[]Statementsoptional*[]PolicyStatement#Initial set of permissions to add to this policy document.
Default: No statements.
You can also use addPermission(statement) to add permissions later.