ArnPrincipal Class
Specify a principal by the Amazon Resource Name (ARN).
You can specify AWS accounts, IAM users, Federated SAML users, IAM roles, and specific assumed-role sessions. You cannot specify IAM groups or instance profiles as principals
Example
ts
// Option 2: create your custom mastersRole with scoped assumeBy arn as the Cluster prop. Switch to this role from the AWS console.
import { KubectlV36Layer } from '@aws-cdk/lambda-layer-kubectl-v36';
declare const vpc: ec2.Vpc;
const mastersRole = new iam.Role(this, 'MastersRole', {
assumedBy: new iam.ArnPrincipal('arn_for_trusted_principal'),
});
const cluster = new eks.Cluster(this, 'EksCluster', {
vpc,
version: eks.KubernetesVersion.V1_36,
kubectlLayer: new KubectlV36Layer(this, 'KubectlLayer'),
mastersRole,
});
mastersRole.addToPolicy(new iam.PolicyStatement({
actions: [
'eks:AccessKubernetesApi',
'eks:Describe*',
'eks:List*',
],
resources: [ cluster.clusterArn ],
}));
python
# Option 2: create your custom mastersRole with scoped assumeBy arn as the Cluster prop. Switch to this role from the AWS console.
from aws_cdk.lambda_layer_kubectl_v36 import KubectlV36Layer
# vpc: ec2.Vpc
masters_role = iam.Role(self, "MastersRole",
assumed_by=iam.ArnPrincipal("arn_for_trusted_principal")
)
cluster = eks.Cluster(self, "EksCluster",
vpc=vpc,
version=eks.KubernetesVersion.V1_36,
kubectl_layer=KubectlV36Layer(self, "KubectlLayer"),
masters_role=masters_role
)
masters_role.add_to_policy(iam.PolicyStatement(
actions=["eks:AccessKubernetesApi", "eks:Describe*", "eks:List*"
],
resources=[cluster.cluster_arn]
))
java
// Option 2: create your custom mastersRole with scoped assumeBy arn as the Cluster prop. Switch to this role from the AWS console.
import software.amazon.awscdk.cdk.lambdalayer.kubectl.v36.KubectlV36Layer;
Vpc vpc;
Role mastersRole = Role.Builder.create(this, "MastersRole")
.assumedBy(new ArnPrincipal("arn_for_trusted_principal"))
.build();
Cluster cluster = Cluster.Builder.create(this, "EksCluster")
.vpc(vpc)
.version(KubernetesVersion.V1_36)
.kubectlLayer(new KubectlV36Layer(this, "KubectlLayer"))
.mastersRole(mastersRole)
.build();
mastersRole.addToPolicy(PolicyStatement.Builder.create()
.actions(List.of("eks:AccessKubernetesApi", "eks:Describe*", "eks:List*"))
.resources(List.of(cluster.getClusterArn()))
.build());
csharp
// Install: dotnet add package Amazon.CDK.Lib
// Option 2: create your custom mastersRole with scoped assumeBy arn as the Cluster prop. Switch to this role from the AWS console.
using Amazon.CDK.LambdaLayer.KubectlV36;
Vpc vpc;
var mastersRole = new Role(this, "MastersRole", new RoleProps {
AssumedBy = new ArnPrincipal("arn_for_trusted_principal")
});
var cluster = new Cluster(this, "EksCluster", new ClusterProps {
Vpc = vpc,
Version = KubernetesVersion.V1_36,
KubectlLayer = new KubectlV36Layer(this, "KubectlLayer"),
MastersRole = mastersRole
});
mastersRole.AddToPolicy(new PolicyStatement(new PolicyStatementProps {
Actions = new [] { "eks:AccessKubernetesApi", "eks:Describe*", "eks:List*" },
Resources = new [] { cluster.ClusterArn }
}));
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
// Option 2: create your custom mastersRole with scoped assumeBy arn as the Cluster prop. Switch to this role from the AWS console.
import "github.com/cdklabs/awscdk-kubectl-go/kubectlv36"
var vpc Vpc
mastersRole := iam.NewRole(this, jsii.String("MastersRole"), &RoleProps{
AssumedBy: iam.NewArnPrincipal(jsii.String("arn_for_trusted_principal")),
})
cluster := eks.NewCluster(this, jsii.String("EksCluster"), &ClusterProps{
Vpc: Vpc,
Version: eks.KubernetesVersion_V1_36(),
KubectlLayer: kubectlv36.NewKubectlV36Layer(this, jsii.String("KubectlLayer")),
MastersRole: MastersRole,
})
mastersRole.AddToPolicy(iam.NewPolicyStatement(&PolicyStatementProps{
Actions: []*string{
jsii.String("eks:AccessKubernetesApi"),
jsii.String("eks:Describe*"),
jsii.String("eks:List*"),
},
Resources: []*string{
cluster.clusterArn,
},
}))
Initializer
ts
new ArnPrincipal(arn: string)
python
ArnPrincipal(arn: str)
java
new ArnPrincipal(String arn)
csharp
new ArnPrincipal(string arn)
go
NewArnPrincipal(Arn *string)
Properties
Amazon Resource Name (ARN) of the principal entity (i.e. arn:aws:iam::123456789012:user/user-name).
assumeRoleActionstringassume_role_actionstrassumeRoleActionStringAssumeRoleActionstringAssumeRoleAction*stringrequired#When this Principal is used in an AssumeRole policy, the action to use.
grantPrincipalIPrincipalgrant_principalIPrincipalgrantPrincipalIPrincipalGrantPrincipalIPrincipalGrantPrincipalIPrincipalrequired#The principal to grant permissions to.
policyFragmentPrincipalPolicyFragmentpolicy_fragmentPrincipalPolicyFragmentpolicyFragmentPrincipalPolicyFragmentPolicyFragmentPrincipalPolicyFragmentPolicyFragmentPrincipalPolicyFragmentrequired#Return the policy fragment that identifies this principal in a Policy.
principalAccountmay be undefinedstringprincipal_accountmay be undefinedstrprincipalAccountmay be undefinedStringPrincipalAccountmay be undefinedstringPrincipalAccountmay be undefined*string#The AWS account ID of this principal.
Can be undefined when the account is not known (for example, for service principals). Can be a Token - in that case, it's assumed to be AWS::AccountId.
Methods
addToAssumeRolePolicy(document: PolicyDocument): voiddef add_to_assume_role_policy(self, document: PolicyDocument) -> Nonepublic void addToAssumeRolePolicy(PolicyDocument document)public void AddToAssumeRolePolicy(PolicyDocument document)func AddToAssumeRolePolicy(Document PolicyDocument)#Add the principal to the AssumeRolePolicyDocument.
Add the statements to the AssumeRolePolicyDocument necessary to give this principal permissions to assume the given role.
addToPolicy(statement: PolicyStatement): booleandef add_to_policy(self, statement: PolicyStatement) -> boolpublic Boolean addToPolicy(PolicyStatement statement)public bool AddToPolicy(PolicyStatement statement)func AddToPolicy(Statement PolicyStatement) *bool#Add to the policy of this principal.
addToPrincipalPolicy(_statement: PolicyStatement): AddToPrincipalPolicyResultdef add_to_principal_policy(self, _statement: PolicyStatement) -> AddToPrincipalPolicyResultpublic AddToPrincipalPolicyResult addToPrincipalPolicy(PolicyStatement _statement)public AddToPrincipalPolicyResult AddToPrincipalPolicy(PolicyStatement _statement)func AddToPrincipalPolicy(_statement PolicyStatement) AddToPrincipalPolicyResult#Add to the policy of this principal.
dedupeString(): stringdef dedupe_string(self, ) -> strpublic String dedupeString()public string DedupeString()func DedupeString() *string#Return whether or not this principal is equal to the given principal.
inOrganization(organizationId: string): PrincipalBasedef in_organization(self, organization_id: str) -> PrincipalBasepublic PrincipalBase inOrganization(String organizationId)public PrincipalBase InOrganization(string organizationId)func InOrganization(OrganizationId *string) PrincipalBase#A convenience method for adding a condition that the principal is part of the specified AWS Organization.
toJSON(): { [key: string]: string[] }def to_json(self, ) -> typing.Mapping[str, typing.List[str]]public Map<String, List<String>> toJSON()public IDictionary<string, string[]> ToJSON()func ToJSON() *map[string]*[]*string#JSON-ify the principal.
Used when JSON.stringify() is called
toString(): stringdef to_string(self, ) -> strpublic String toString()public string ToString()func ToString() *string#Returns a string representation of an object.
withConditions(conditions: { [key: string]: any }): PrincipalBasedef with_conditions(self, conditions: typing.Mapping[str, Any]) -> PrincipalBasepublic PrincipalBase withConditions(Map<String, Object> conditions)public PrincipalBase WithConditions(IDictionary<string, object> conditions)func WithConditions(Conditions *map[string]interface{}) PrincipalBase#Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added.
When there is a value for the same operator and key in both the principal and the conditions parameter, the value from the conditions parameter will be used.
returns
Returns: a new PrincipalWithConditions object.
withSessionTags(): PrincipalBasedef with_session_tags(self, ) -> PrincipalBasepublic PrincipalBase withSessionTags()public PrincipalBase WithSessionTags()func WithSessionTags() PrincipalBase#Returns a new principal using this principal as the base, with session tags enabled.
returns
Returns: a new SessionTagsPrincipal object.