Role

Source: src/AWS/IAM/Role.ts

An IAM role for AWS services and runtimes.

Creating Roles

const role = yield* Role("TaskRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { Service: "ecs-tasks.amazonaws.com" },
      Action: ["sts:AssumeRole"],
    }],
  },
});

Granting Permissions

const policy = yield* Policy("AppPolicy", {
  policyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Action: ["s3:GetObject"],
      Resource: ["arn:aws:s3:::my-bucket/*"],
    }],
  },
});

const role = yield* Role("AppRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { Service: "lambda.amazonaws.com" },
      Action: ["sts:AssumeRole"],
    }],
  },
  managedPolicyArns: [policy.policyArn],
  inlinePolicies: {
    Logs: {
      Version: "2012-10-17",
      Statement: [{
        Effect: "Allow",
        Action: ["logs:CreateLogStream", "logs:PutLogEvents"],
        Resource: ["*"],
      }],
    },
  },
});