Namespace Amazon.CDK.AWS.IAM
AWS Identity and Access Management Construct Library
---AWS CDK v1 has reached End-of-Support on 2023-06-01.
This package is no longer being updated, and users should migrate to AWS CDK v2.
For more information on how to migrate, see the Migrating to AWS CDK v2 guide.
Define a role and add permissions to it. This will automatically create and attach an IAM policy to the role:
var role = new Role(this, "MyRole", new RoleProps {
AssumedBy = new ServicePrincipal("sns.amazonaws.com")
});
role.AddToPolicy(new PolicyStatement(new PolicyStatementProps {
Resources = new [] { "*" },
Actions = new [] { "lambda:InvokeFunction" }
}));
Define a policy and attach it to groups, users and roles. Note that it is possible to attach
the policy either by calling xxx.attachInlinePolicy(policy)
or policy.attachToXxx(xxx)
.
var user = new User(this, "MyUser", new UserProps { Password = SecretValue.UnsafePlainText("1234") });
var group = new Group(this, "MyGroup");
var policy = new Policy(this, "MyPolicy");
policy.AttachToUser(user);
group.AttachInlinePolicy(policy);
Managed policies can be attached using xxx.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName(policyName))
:
var group = new Group(this, "MyGroup");
group.AddManagedPolicy(ManagedPolicy.FromAwsManagedPolicyName("AdministratorAccess"));
Granting permissions to resources
Many of the AWS CDK resources have grant*
methods that allow you to grant other resources access to that resource. As an example, the following code gives a Lambda function write permissions (Put, Update, Delete) to a DynamoDB table.
Function fn;
Table table;
table.GrantWriteData(fn);
The more generic grant
method allows you to give specific permissions to a resource:
Function fn;
Table table;
table.Grant(fn, "dynamodb:PutItem");
The grant*
methods accept an IGrantable
object. This interface is implemented by IAM principlal resources (groups, users and roles) and resources that assume a role such as a Lambda function, EC2 instance or a Codebuild project.
You can find which grant*
methods exist for a resource in the AWS CDK API Reference.
Roles
Many AWS resources require Roles to operate. These Roles define the AWS API calls an instance or other AWS service is allowed to make.
Creating Roles and populating them with the right permissions Statements is a necessary but tedious part of setting up AWS infrastructure. In order to help you focus on your business logic, CDK will take care of creating roles and populating them with least-privilege permissions automatically.
All constructs that require Roles will create one for you if don't specify
one at construction time. Permissions will be added to that role
automatically if you associate the construct with other constructs from the
AWS Construct Library (for example, if you tell an AWS CodePipeline to trigger
an AWS Lambda Function, the Pipeline's Role will automatically get
lambda:InvokeFunction
permissions on that particular Lambda Function),
or if you explicitly grant permissions using grant
functions (see the
previous section).
Opting out of automatic permissions management
You may prefer to manage a Role's permissions yourself instead of having the CDK automatically manage them for you. This may happen in one of the following cases:
To prevent constructs from updating your Role's policy, pass the object
returned by myRole.withoutPolicyUpdates()
instead of myRole
itself.
For example, to have an AWS CodePipeline not automatically add the required permissions to trigger the expected targets, do the following:
var role = new Role(this, "Role", new RoleProps {
AssumedBy = new ServicePrincipal("codepipeline.amazonaws.com"),
// custom description if desired
Description = "This is a custom role..."
});
new Pipeline(this, "Pipeline", new PipelineProps {
// Give the Pipeline an immutable view of the Role
Role = role.WithoutPolicyUpdates()
});
// You now have to manage the Role policies yourself
role.AddToPolicy(new PolicyStatement(new PolicyStatementProps {
Actions = new [] { },
Resources = new [] { }
}));
Using existing roles
If there are Roles in your account that have already been created which you
would like to use in your CDK application, you can use Role.fromRoleArn
to
import them, as follows:
var role = Role.FromRoleArn(this, "Role", "arn:aws:iam::123456789012:role/MyExistingRole", new FromRoleArnOptions {
// Set 'mutable' to 'false' to use the role as-is and prevent adding new
// policies to it. The default is 'true', which means the role may be
// modified as part of the deployment.
Mutable = false
});
Configuring an ExternalId
If you need to create Roles that will be assumed by third parties, it is generally a good idea to require an ExternalId
to assume them. Configuring
an ExternalId
works like this:
var role = new Role(this, "MyRole", new RoleProps {
AssumedBy = new AccountPrincipal("123456789012"),
ExternalIds = new [] { "SUPPLY-ME" }
});
Principals vs Identities
When we say Principal, we mean an entity you grant permissions to. This
entity can be an AWS Service, a Role, or something more abstract such as "all
users in this account" or even "all users in this organization". An
Identity is an IAM representing a single IAM entity that can have
a policy attached, one of Role
, User
, or Group
.
IAM Principals
When defining policy statements as part of an AssumeRole policy or as part of a
resource policy, statements would usually refer to a specific IAM principal
under Principal
.
IAM principals are modeled as classes that derive from the iam.PolicyPrincipal
abstract class. Principal objects include principal type (string) and value
(array of string), optional set of conditions and the action that this principal
requires when it is used in an assume role policy document.
To add a principal to a policy statement you can either use the abstract
statement.addPrincipal
, one of the concrete addXxxPrincipal
methods:
If multiple principals are added to the policy statement, they will be merged together:
var statement = new PolicyStatement();
statement.AddServicePrincipal("cloudwatch.amazonaws.com");
statement.AddServicePrincipal("ec2.amazonaws.com");
statement.AddArnPrincipal("arn:aws:boom:boom");
Will result in:
{
"Principal": {
"Service": [ "cloudwatch.amazonaws.com", "ec2.amazonaws.com" ],
"AWS": "arn:aws:boom:boom"
}
}
The CompositePrincipal
class can also be used to define complex principals, for example:
var role = new Role(this, "MyRole", new RoleProps {
AssumedBy = new CompositePrincipal(
new ServicePrincipal("ec2.amazonaws.com"),
new AccountPrincipal("1818188181818187272"))
});
The PrincipalWithConditions
class can be used to add conditions to a
principal, especially those that don't take a conditions
parameter in their
constructor. The principal.withConditions()
method can be used to create a
PrincipalWithConditions
from an existing principal, for example:
var principal = new AccountPrincipal("123456789000").WithConditions(new Dictionary<string, object> { { "StringEquals", new Dictionary<string, string> { { "foo", "baz" } } } });
NOTE: If you need to define an IAM condition that uses a token (such as a
deploy-time attribute of another resource) in a JSON map key, use <code>CfnJson</code> to
render this condition. See <a href="./test/integ.condition-with-ref.ts">this test</a> for
an example.
The WebIdentityPrincipal
class can be used as a principal for web identities like
Cognito, Amazon, Google or Facebook, for example:
var principal = new WebIdentityPrincipal("cognito-identity.amazonaws.com", new Dictionary<string, object> {
{ "StringEquals", new Dictionary<string, string> { { "cognito-identity.amazonaws.com:aud", "us-east-2:12345678-abcd-abcd-abcd-123456" } } },
{ "ForAnyValue:StringLike", new Dictionary<string, string> { { "cognito-identity.amazonaws.com:amr", "unauthenticated" } } }
});
If your identity provider is configured to assume a Role with session
tags, you
need to call .withSessionTags()
to add the required permissions to the Role's
policy document:
new Role(this, "Role", new RoleProps {
AssumedBy = new WebIdentityPrincipal("cognito-identity.amazonaws.com", new Dictionary<string, object> {
{ "StringEquals", new Dictionary<string, string> {
{ "cognito-identity.amazonaws.com:aud", "us-east-2:12345678-abcd-abcd-abcd-123456" }
} },
{ "ForAnyValue:StringLike", new Dictionary<string, string> {
{ "cognito-identity.amazonaws.com:amr", "unauthenticated" }
} }
}).WithSessionTags()
});
Parsing JSON Policy Documents
The PolicyDocument.fromJson
and PolicyStatement.fromJson
static methods can be used to parse JSON objects. For example:
IDictionary<string, object> policyDocument = new Dictionary<string, object> {
{ "Version", "2012-10-17" },
{ "Statement", new [] { new Dictionary<string, object> {
{ "Sid", "FirstStatement" },
{ "Effect", "Allow" },
{ "Action", new [] { "iam:ChangePassword" } },
{ "Resource", "*" }
}, new Dictionary<string, string> {
{ "Sid", "SecondStatement" },
{ "Effect", "Allow" },
{ "Action", "s3:ListAllMyBuckets" },
{ "Resource", "*" }
}, new Dictionary<string, object> {
{ "Sid", "ThirdStatement" },
{ "Effect", "Allow" },
{ "Action", new [] { "s3:List*", "s3:Get*" } },
{ "Resource", new [] { "arn:aws:s3:::confidential-data", "arn:aws:s3:::confidential-data/*" } },
{ "Condition", new Dictionary<string, IDictionary<string, string>> { { "Bool", new Dictionary<string, string> { { "aws:MultiFactorAuthPresent", "true" } } } } }
} } }
};
var customPolicyDocument = PolicyDocument.FromJson(policyDocument);
// You can pass this document as an initial document to a ManagedPolicy
// or inline Policy.
var newManagedPolicy = new ManagedPolicy(this, "MyNewManagedPolicy", new ManagedPolicyProps {
Document = customPolicyDocument
});
var newPolicy = new Policy(this, "MyNewPolicy", new PolicyProps {
Document = customPolicyDocument
});
Permissions Boundaries
Permissions
Boundaries
can be used as a mechanism to prevent privilege esclation by creating new
Role
s. Permissions Boundaries are a Managed Policy, attached to Roles or
Users, that represent the maximum set of permissions they can have. The
effective set of permissions of a Role (or User) will be the intersection of
the Identity Policy and the Permissions Boundary attached to the Role (or
User). Permissions Boundaries are typically created by account
Administrators, and their use on newly created Role
s will be enforced by
IAM policies.
It is possible to attach Permissions Boundaries to all Roles created in a construct tree all at once:
// Directly apply the boundary to a Role you create
Role role;
// Apply the boundary to an Role that was implicitly created for you
Function fn;
// Remove a Permissions Boundary that is inherited, for example from the Stack level
CustomResource customResource;
// This imports an existing policy.
var boundary = ManagedPolicy.FromManagedPolicyArn(this, "Boundary", "arn:aws:iam::123456789012:policy/boundary");
// This creates a new boundary
var boundary2 = new ManagedPolicy(this, "Boundary2", new ManagedPolicyProps {
Statements = new [] {
new PolicyStatement(new PolicyStatementProps {
Effect = Effect.DENY,
Actions = new [] { "iam:*" },
Resources = new [] { "*" }
}) }
});
PermissionsBoundary.Of(role).Apply(boundary);
PermissionsBoundary.Of(fn).Apply(boundary);
// Apply the boundary to all Roles in a stack
PermissionsBoundary.Of(this).Apply(boundary);
PermissionsBoundary.Of(customResource).Clear();
OpenID Connect Providers
OIDC identity providers are entities in IAM that describe an external identity provider (IdP) service that supports the OpenID Connect (OIDC) standard, such as Google or Salesforce. You use an IAM OIDC identity provider when you want to establish trust between an OIDC-compatible IdP and your AWS account. This is useful when creating a mobile app or web application that requires access to AWS resources, but you don't want to create custom sign-in code or manage your own user identities. For more information about this scenario, see [About Web Identity Federation] and the relevant documentation in the [Amazon Cognito Identity Pools Developer Guide].
The following examples defines an OpenID Connect provider. Two client IDs (audiences) are will be able to send authentication requests to https://openid/connect.
var provider = new OpenIdConnectProvider(this, "MyProvider", new OpenIdConnectProviderProps {
Url = "https://openid/connect",
ClientIds = new [] { "myclient1", "myclient2" }
});
You can specify an optional list of thumbprints
. If not specified, the
thumbprint of the root certificate authority (CA) will automatically be obtained
from the host as described
here.
Once you define an OpenID connect provider, you can use it with AWS services that expect an IAM OIDC provider. For example, when you define an Amazon Cognito identity pool you can reference the provider's ARN as follows:
using Amazon.CDK.AWS.Cognito;
OpenIdConnectProvider myProvider;
new CfnIdentityPool(this, "IdentityPool", new CfnIdentityPoolProps {
OpenIdConnectProviderArns = new [] { myProvider.OpenIdConnectProviderArn },
// And the other properties for your identity pool
AllowUnauthenticatedIdentities = false
});
The OpenIdConnectPrincipal
class can be used as a principal used with a OpenIdConnectProvider
, for example:
var provider = new OpenIdConnectProvider(this, "MyProvider", new OpenIdConnectProviderProps {
Url = "https://openid/connect",
ClientIds = new [] { "myclient1", "myclient2" }
});
var principal = new OpenIdConnectPrincipal(provider);
SAML provider
An IAM SAML 2.0 identity provider is an entity in IAM that describes an external identity provider (IdP) service that supports the SAML 2.0 (Security Assertion Markup Language 2.0) standard. You use an IAM identity provider when you want to establish trust between a SAML-compatible IdP such as Shibboleth or Active Directory Federation Services and AWS, so that users in your organization can access AWS resources. IAM SAML identity providers are used as principals in an IAM trust policy.
new SamlProvider(this, "Provider", new SamlProviderProps {
MetadataDocument = SamlMetadataDocument.FromFile("/path/to/saml-metadata-document.xml")
});
The SamlPrincipal
class can be used as a principal with a SamlProvider
:
var provider = new SamlProvider(this, "Provider", new SamlProviderProps {
MetadataDocument = SamlMetadataDocument.FromFile("/path/to/saml-metadata-document.xml")
});
var principal = new SamlPrincipal(provider, new Dictionary<string, object> {
{ "StringEquals", new Dictionary<string, string> {
{ "SAML:iss", "issuer" }
} }
});
When creating a role for programmatic and AWS Management Console access, use the SamlConsolePrincipal
class:
var provider = new SamlProvider(this, "Provider", new SamlProviderProps {
MetadataDocument = SamlMetadataDocument.FromFile("/path/to/saml-metadata-document.xml")
});
new Role(this, "Role", new RoleProps {
AssumedBy = new SamlConsolePrincipal(provider)
});
Users
IAM manages users for your AWS account. To create a new user:
var user = new User(this, "MyUser");
To import an existing user by name with path:
var user = User.FromUserName(this, "MyImportedUserByName", "johnsmith");
To import an existing user by ARN:
var user = User.FromUserArn(this, "MyImportedUserByArn", "arn:aws:iam::123456789012:user/johnsmith");
To import an existing user by attributes:
var user = User.FromUserAttributes(this, "MyImportedUserByAttributes", new UserAttributes {
UserArn = "arn:aws:iam::123456789012:user/johnsmith"
});
Access Keys
The ability for a user to make API calls via the CLI or an SDK is enabled by the user having an access key pair. To create an access key:
var user = new User(this, "MyUser");
var accessKey = new AccessKey(this, "MyAccessKey", new AccessKeyProps { User = user });
You can force CloudFormation to rotate the access key by providing a monotonically increasing serial
property. Simply provide a higher serial value than any number used previously:
var user = new User(this, "MyUser");
var accessKey = new AccessKey(this, "MyAccessKey", new AccessKeyProps { User = user, Serial = 1 });
An access key may only be associated with a single user and cannot be "moved" between users. Changing the user associated with an access key replaces the access key (and its ID and secret value).
Groups
An IAM user group is a collection of IAM users. User groups let you specify permissions for multiple users.
var group = new Group(this, "MyGroup");
To import an existing group by ARN:
var group = Group.FromGroupArn(this, "MyImportedGroupByArn", "arn:aws:iam::account-id:group/group-name");
To import an existing group by name with path:
var group = Group.FromGroupName(this, "MyImportedGroupByName", "group-name");
To add a user to a group (both for a new and imported user/group):
var user = new User(this, "MyUser"); // or User.fromUserName(stack, 'User', 'johnsmith');
var group = new Group(this, "MyGroup"); // or Group.fromGroupArn(stack, 'Group', 'arn:aws:iam::account-id:group/group-name');
user.AddToGroup(group);
// or
group.AddUser(user);
Features
Classes
AccessKey | Define a new IAM Access Key. |
AccessKeyProps | Properties for defining an IAM access key. |
AccessKeyStatus | Valid statuses for an IAM Access Key. |
AccountPrincipal | Specify AWS account ID as the principal entity in a policy to delegate authority to the account. |
AccountRootPrincipal | Use the AWS account into which a stack is deployed as the principal entity in a policy. |
AddToPrincipalPolicyResult | Result of calling |
AddToResourcePolicyResult | Result of calling addToResourcePolicy. |
Anyone | (deprecated) A principal representing all identities in all accounts. |
AnyPrincipal | A principal representing all AWS identities in all accounts. |
ArnPrincipal | Specify a principal by the Amazon Resource Name (ARN). |
CanonicalUserPrincipal | A policy principal for canonicalUserIds - useful for S3 bucket policies that use Origin Access identities. |
CfnAccessKey | A CloudFormation |
CfnAccessKeyProps | Properties for defining a |
CfnGroup | A CloudFormation |
CfnGroup.PolicyProperty | Contains information about an attached policy. |
CfnGroupProps | Properties for defining a |
CfnInstanceProfile | A CloudFormation |
CfnInstanceProfileProps | Properties for defining a |
CfnManagedPolicy | A CloudFormation |
CfnManagedPolicyProps | Properties for defining a |
CfnOIDCProvider | A CloudFormation |
CfnOIDCProviderProps | Properties for defining a |
CfnPolicy | A CloudFormation |
CfnPolicyProps | Properties for defining a |
CfnRole | A CloudFormation |
CfnRole.PolicyProperty | Contains information about an attached policy. |
CfnRoleProps | Properties for defining a |
CfnSAMLProvider | A CloudFormation |
CfnSAMLProviderProps | Properties for defining a |
CfnServerCertificate | A CloudFormation |
CfnServerCertificateProps | Properties for defining a |
CfnServiceLinkedRole | A CloudFormation |
CfnServiceLinkedRoleProps | Properties for defining a |
CfnUser | A CloudFormation |
CfnUser.LoginProfileProperty | Creates a password for the specified user, giving the user the ability to access AWS services through the AWS Management Console . |
CfnUser.PolicyProperty | Contains information about an attached policy. |
CfnUserProps | Properties for defining a |
CfnUserToGroupAddition | A CloudFormation |
CfnUserToGroupAdditionProps | Properties for defining a |
CfnVirtualMFADevice | A CloudFormation |
CfnVirtualMFADeviceProps | Properties for defining a |
CommonGrantOptions | Basic options for a grant operation. |
ComparablePrincipal | Helper class for working with |
CompositeDependable | Composite dependable. |
CompositePrincipal | Represents a principal that has multiple types of principals. |
Effect | The Effect element of an IAM policy. |
FederatedPrincipal | Principal entity that represents a federated identity provider such as Amazon Cognito, that can be used to provide temporary security credentials to users who have been authenticated. |
FromRoleArnOptions | Options allowing customizing the behavior of {@link Role.fromRoleArn}. |
Grant | Result of a grant() operation. |
GrantOnPrincipalAndResourceOptions | Options for a grant operation to both identity and resource. |
GrantOnPrincipalOptions | Options for a grant operation that only applies to principals. |
GrantWithResourceOptions | Options for a grant operation. |
Group | An IAM Group (collection of IAM users) lets you specify permissions for multiple users, which can make it easier to manage permissions for those users. |
GroupProps | Properties for defining an IAM group. |
LazyRole | An IAM role that only gets attached to the construct tree once it gets used, not before. |
LazyRoleProps | Properties for defining a LazyRole. |
ManagedPolicy | Managed policy. |
ManagedPolicyProps | Properties for defining an IAM managed policy. |
OpenIdConnectPrincipal | A principal that represents a federated identity provider as from a OpenID Connect provider. |
OpenIdConnectProvider | IAM OIDC identity providers are entities in IAM that describe an external identity provider (IdP) service that supports the OpenID Connect (OIDC) standard, such as Google or Salesforce. |
OpenIdConnectProviderProps | Initialization properties for |
OrganizationPrincipal | A principal that represents an AWS Organization. |
PermissionsBoundary | Modify the Permissions Boundaries of Users and Roles in a construct tree. |
Policy | The AWS::IAM::Policy resource associates an IAM policy with IAM users, roles, or groups. |
PolicyDocument | A PolicyDocument is a collection of statements. |
PolicyDocumentProps | Properties for a new PolicyDocument. |
PolicyProps | Properties for defining an IAM inline policy document. |
PolicyStatement | Represents a statement in an IAM policy document. |
PolicyStatementProps | Interface for creating a policy statement. |
PrincipalBase | Base class for policy principals. |
PrincipalPolicyFragment | A collection of the fields in a PolicyStatement that can be used to identify a principal. |
PrincipalWithConditions | An IAM principal with additional conditions specifying when the policy is in effect. |
Role | IAM Role. |
RoleProps | Properties for defining an IAM Role. |
SamlConsolePrincipal | Principal entity that represents a SAML federated identity provider for programmatic and AWS Management Console access. |
SamlMetadataDocument | A SAML metadata document. |
SamlPrincipal | Principal entity that represents a SAML federated identity provider. |
SamlProvider | A SAML provider. |
SamlProviderProps | Properties for a SAML provider. |
ServicePrincipal | An IAM principal that represents an AWS service (i.e. sqs.amazonaws.com). |
ServicePrincipalOpts | Options for a service principal. |
SessionTagsPrincipal | Enables session tags on role assumptions from a principal. |
StarPrincipal | A principal that uses a literal '*' in the IAM JSON language. |
UnknownPrincipal | A principal for use in resources that need to have a role but it's unknown. |
UnknownPrincipalProps | Properties for an UnknownPrincipal. |
User | Define a new IAM user. |
UserAttributes | Represents a user defined outside of this stack. |
UserProps | Properties for defining an IAM user. |
WebIdentityPrincipal | A principal that represents a federated identity provider as Web Identity such as Cognito, Amazon, Facebook, Google, etc. |
WithoutPolicyUpdatesOptions | Options for the |
Interfaces
CfnGroup.IPolicyProperty | Contains information about an attached policy. |
CfnRole.IPolicyProperty | Contains information about an attached policy. |
CfnUser.ILoginProfileProperty | Creates a password for the specified user, giving the user the ability to access AWS services through the AWS Management Console . |
CfnUser.IPolicyProperty | Contains information about an attached policy. |
IAccessKey | Represents an IAM Access Key. |
IAccessKeyProps | Properties for defining an IAM access key. |
IAddToPrincipalPolicyResult | Result of calling |
IAddToResourcePolicyResult | Result of calling addToResourcePolicy. |
IAssumeRolePrincipal | A type of principal that has more control over its own representation in AssumeRolePolicyDocuments. |
ICfnAccessKeyProps | Properties for defining a |
ICfnGroupProps | Properties for defining a |
ICfnInstanceProfileProps | Properties for defining a |
ICfnManagedPolicyProps | Properties for defining a |
ICfnOIDCProviderProps | Properties for defining a |
ICfnPolicyProps | Properties for defining a |
ICfnRoleProps | Properties for defining a |
ICfnSAMLProviderProps | Properties for defining a |
ICfnServerCertificateProps | Properties for defining a |
ICfnServiceLinkedRoleProps | Properties for defining a |
ICfnUserProps | Properties for defining a |
ICfnUserToGroupAdditionProps | Properties for defining a |
ICfnVirtualMFADeviceProps | Properties for defining a |
ICommonGrantOptions | Basic options for a grant operation. |
IComparablePrincipal | Interface for principals that can be compared. |
IFromRoleArnOptions | Options allowing customizing the behavior of {@link Role.fromRoleArn}. |
IGrantable | Any object that has an associated principal that a permission can be granted to. |
IGrantOnPrincipalAndResourceOptions | Options for a grant operation to both identity and resource. |
IGrantOnPrincipalOptions | Options for a grant operation that only applies to principals. |
IGrantWithResourceOptions | Options for a grant operation. |
IGroup | Represents an IAM Group. |
IGroupProps | Properties for defining an IAM group. |
IIdentity | A construct that represents an IAM principal, such as a user, group or role. |
ILazyRoleProps | Properties for defining a LazyRole. |
IManagedPolicy | A managed policy. |
IManagedPolicyProps | Properties for defining an IAM managed policy. |
IOpenIdConnectProvider | Represents an IAM OpenID Connect provider. |
IOpenIdConnectProviderProps | Initialization properties for |
IPolicy | Represents an IAM Policy. |
IPolicyDocumentProps | Properties for a new PolicyDocument. |
IPolicyProps | Properties for defining an IAM inline policy document. |
IPolicyStatementProps | Interface for creating a policy statement. |
IPrincipal | Represents a logical IAM principal. |
IResourceWithPolicy | A resource with a resource policy that can be added to. |
IRole | A Role object. |
IRoleProps | Properties for defining an IAM Role. |
ISamlProvider | A SAML provider. |
ISamlProviderProps | Properties for a SAML provider. |
IServicePrincipalOpts | Options for a service principal. |
IUnknownPrincipalProps | Properties for an UnknownPrincipal. |
IUser | Represents an IAM user. |
IUserAttributes | Represents a user defined outside of this stack. |
IUserProps | Properties for defining an IAM user. |
IWithoutPolicyUpdatesOptions | Options for the |