class PrincipalWithConditions

Language	Type name
.NET	Amazon.CDK.AWS.IAM.PrincipalWithConditions
Java	software.amazon.awscdk.services.iam.PrincipalWithConditions
Python	aws_cdk.aws_iam.PrincipalWithConditions
TypeScript (source)	@aws-cdk/aws-iam » PrincipalWithConditions

Implements IAssumeRolePrincipal, IGrantable, IPrincipal, IComparablePrincipal

Extends PrincipalBase

An IAM principal with additional conditions specifying when the policy is in effect.

For more information about conditions, see: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html

Example

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import * as iam from '@aws-cdk/aws-iam';

declare const conditions: any;
declare const principal: iam.IPrincipal;
const principalWithConditions = new iam.PrincipalWithConditions(principal, {
  conditionsKey: conditions,
});

Initializer

new PrincipalWithConditions(principal: IPrincipal, conditions: { [string]: any })

Parameters

• principal IPrincipal
• conditions { [string]: any }

Properties

Name	Type	Description
assumeRoleAction	string	When this Principal is used in an AssumeRole policy, the action to use.
conditions	{ [string]: any }	The conditions under which the policy is in effect.
grantPrincipal	IPrincipal	The principal to grant permissions to.
policyFragment	PrincipalPolicyFragment	Return the policy fragment that identifies this principal in a Policy.
principalAccount?	string	The AWS account ID of this principal.

---

assumeRoleAction

Type: string

When this Principal is used in an AssumeRole policy, the action to use.

---

conditions

Type: { [string]: any }

The conditions under which the policy is in effect.

See the IAM documentation.

---

grantPrincipal

Type: IPrincipal

The principal to grant permissions to.

---

policyFragment

Type: PrincipalPolicyFragment

Return the policy fragment that identifies this principal in a Policy.

---

principalAccount?

Type: string (optional)

The AWS account ID of this principal.

Can be undefined when the account is not known (for example, for service principals). Can be a Token - in that case, it's assumed to be AWS::AccountId.

Methods

Name	Description
addCondition(key, value)	Add a condition to the principal.
addConditions(conditions)	Adds multiple conditions to the principal.
addToAssumeRolePolicy(document)	Add the princpial to the AssumeRolePolicyDocument.
addToPolicy(statement)	Add to the policy of this principal.
addToPrincipalPolicy(statement)	Add to the policy of this principal.
dedupeString()	Return whether or not this principal is equal to the given principal.
toJSON()	JSON-ify the principal.
toString()	Returns a string representation of an object.
withConditions(conditions)	Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added.
withSessionTags()	Returns a new principal using this principal as the base, with session tags enabled.
protected appendDedupe(append)	Append the given string to the wrapped principal's dedupe string (if available).

---

addCondition(key, value)

public addCondition(key: string, value: any): void

Parameters

• key string
• value any

Add a condition to the principal.

---

addConditions(conditions)

public addConditions(conditions: { [string]: any }): void

Parameters

• conditions { [string]: any }

Adds multiple conditions to the principal.

Values from the conditions parameter will overwrite existing values with the same operator and key.

---

addToAssumeRolePolicy(document)

public addToAssumeRolePolicy(document: PolicyDocument): void

Parameters

• document PolicyDocument

Add the princpial to the AssumeRolePolicyDocument.

Add the statements to the AssumeRolePolicyDocument necessary to give this principal permissions to assume the given role.

---

addToPolicy(statement)

public addToPolicy(statement: PolicyStatement): boolean

Parameters

• statement PolicyStatement

Returns

• boolean

Add to the policy of this principal.

---

addToPrincipalPolicy(statement)

public addToPrincipalPolicy(statement: PolicyStatement): AddToPrincipalPolicyResult

Parameters

• statement PolicyStatement

Returns

• AddToPrincipalPolicyResult

Add to the policy of this principal.

---

dedupeString()

public dedupeString(): string

Returns

• string

Return whether or not this principal is equal to the given principal.

---

toJSON()

public toJSON(): { [string]: string[] }

Returns

• { [string]: string[] }

JSON-ify the principal.

Used when JSON.stringify() is called

---

toString()

public toString(): string

Returns

• string

Returns a string representation of an object.

---

withConditions(conditions)

public withConditions(conditions: { [string]: any }): PrincipalBase

Parameters

• conditions { [string]: any }

Returns

• PrincipalBase

Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added.

When there is a value for the same operator and key in both the principal and the conditions parameter, the value from the conditions parameter will be used.

---

withSessionTags()

public withSessionTags(): PrincipalBase

Returns

• PrincipalBase

Returns a new principal using this principal as the base, with session tags enabled.

---

protected appendDedupe(append)

protected appendDedupe(append: string): string

Parameters

• append string

Returns

• string

Append the given string to the wrapped principal's dedupe string (if available).