PolicyStatement

class aws_cdk.aws_iam.PolicyStatement(*, actions=None, conditions=None, effect=None, not_actions=None, not_principals=None, not_resources=None, principals=None, resources=None, sid=None)

Bases: object

Represents a statement in an IAM policy document.

ExampleMetadata

lit=aws-ec2/test/integ.vpc-endpoint.lit.ts infused

Example:

# Add gateway endpoints when creating the VPC
vpc = ec2.Vpc(self, "MyVpc",
    gateway_endpoints={
        "S3": cdk.aws_ec2.GatewayVpcEndpointOptions(
            service=ec2.GatewayVpcEndpointAwsService.S3
        )
    }
)

# Alternatively gateway endpoints can be added on the VPC
dynamo_db_endpoint = vpc.add_gateway_endpoint("DynamoDbEndpoint",
    service=ec2.GatewayVpcEndpointAwsService.DYNAMODB
)

# This allows to customize the endpoint policy
dynamo_db_endpoint.add_to_policy(
    iam.PolicyStatement( # Restrict to listing and describing tables
        principals=[iam.AnyPrincipal()],
        actions=["dynamodb:DescribeTable", "dynamodb:ListTables"],
        resources=["*"]))

# Add an interface endpoint
vpc.add_interface_endpoint("EcrDockerEndpoint",
    service=ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER
)
Parameters
  • actions (Optional[Sequence[str]]) – List of actions to add to the statement. Default: - no actions

  • conditions (Optional[Mapping[str, Any]]) – Conditions to add to the statement. Default: - no condition

  • effect (Optional[Effect]) – Whether to allow or deny the actions in this statement. Default: Effect.ALLOW

  • not_actions (Optional[Sequence[str]]) – List of not actions to add to the statement. Default: - no not-actions

  • not_principals (Optional[Sequence[IPrincipal]]) – List of not principals to add to the statement. Default: - no not principals

  • not_resources (Optional[Sequence[str]]) – NotResource ARNs to add to the statement. Default: - no not-resources

  • principals (Optional[Sequence[IPrincipal]]) – List of principals to add to the statement. Default: - no principals

  • resources (Optional[Sequence[str]]) – Resource ARNs to add to the statement. Default: - no resources

  • sid (Optional[str]) – The Sid (statement ID) is an optional identifier that you provide for the policy statement. You can assign a Sid value to each statement in a statement array. In services that let you specify an ID element, such as SQS and SNS, the Sid value is just a sub-ID of the policy document’s ID. In IAM, the Sid value must be unique within a JSON policy. Default: - no sid

Methods

add_account_condition(account_id)

Add a condition that limits to a given account.

This method can only be called once: subsequent calls will overwrite earlier calls.

Parameters

account_id (str) –

Return type

None

add_account_root_principal()

Adds an AWS account root user principal to this policy statement.

Return type

None

add_actions(*actions)

Specify allowed actions into the “Action” section of the policy statement.

Parameters

actions (str) – actions that will be allowed.

See

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_action.html

Return type

None

add_all_resources()

Adds a "*" resource to this statement.

Return type

None

add_any_principal()

Adds all identities in all accounts (“*”) to this policy statement.

Return type

None

add_arn_principal(arn)

Specify a principal using the ARN identifier of the principal.

You cannot specify IAM groups and instance profiles as principals.

Parameters

arn (str) – ARN identifier of AWS account, IAM user, or IAM role (i.e. arn:aws:iam::123456789012:user/user-name).

Return type

None

add_aws_account_principal(account_id)

Specify AWS account ID as the principal entity to the “Principal” section of a policy statement.

Parameters

account_id (str) –

Return type

None

add_canonical_user_principal(canonical_user_id)

Adds a canonical user ID principal to this policy document.

Parameters

canonical_user_id (str) – unique identifier assigned by AWS for every account.

Return type

None

add_condition(key, value)

Add a condition to the Policy.

If multiple calls are made to add a condition with the same operator and field, only the last one wins. For example:

# stmt: iam.PolicyStatement


stmt.add_condition("StringEquals", {"aws:SomeField": "1"})
stmt.add_condition("StringEquals", {"aws:SomeField": "2"})

Will end up with the single condition StringEquals: { 'aws:SomeField': '2' }.

If you meant to add a condition to say that the field can be either 1 or 2, write this:

# stmt: iam.PolicyStatement


stmt.add_condition("StringEquals", {"aws:SomeField": ["1", "2"]})
Parameters
  • key (str) –

  • value (Any) –

Return type

None

add_conditions(conditions)

Add multiple conditions to the Policy.

See the addCondition function for a caveat on calling this method multiple times.

Parameters

conditions (Mapping[str, Any]) –

Return type

None

add_federated_principal(federated, conditions)

Adds a federated identity provider such as Amazon Cognito to this policy statement.

Parameters
  • federated (Any) – federated identity provider (i.e. ‘cognito-identity.amazonaws.com’).

  • conditions (Mapping[str, Any]) – The conditions under which the policy is in effect. See the IAM documentation.

Return type

None

add_not_actions(*not_actions)

Explicitly allow all actions except the specified list of actions into the “NotAction” section of the policy document.

Parameters

not_actions (str) – actions that will be denied. All other actions will be permitted.

See

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html

Return type

None

add_not_principals(*not_principals)

Specify principals that is not allowed or denied access to the “NotPrincipal” section of a policy statement.

Parameters

not_principals (IPrincipal) – IAM principals that will be denied access.

See

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notprincipal.html

Return type

None

add_not_resources(*arns)

Specify resources that this policy statement will not apply to in the “NotResource” section of this policy statement.

All resources except the specified list will be matched.

Parameters

arns (str) – Amazon Resource Names (ARNs) of the resources that this policy statement does not apply to.

See

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notresource.html

Return type

None

add_principals(*principals)

Adds principals to the “Principal” section of a policy statement.

Parameters

principals (IPrincipal) – IAM principals that will be added.

See

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html

Return type

None

add_resources(*arns)

Specify resources that this policy statement applies into the “Resource” section of this policy statement.

Parameters

arns (str) – Amazon Resource Names (ARNs) of the resources that this policy statement applies to.

See

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html

Return type

None

add_service_principal(service, *, conditions=None, region=None)

Adds a service principal to this policy statement.

Parameters
  • service (str) – the service name for which a service principal is requested (e.g: s3.amazonaws.com).

  • conditions (Optional[Mapping[str, Any]]) – Additional conditions to add to the Service Principal. Default: - No conditions

  • region (Optional[str]) – The region in which you want to reference the service. This is only necessary for cross-region references to opt-in regions. In those cases, the region name needs to be included to reference the correct service principal. In all other cases, the global service principal name is sufficient. This field behaves differently depending on whether the @aws-cdk/aws-iam:standardizedServicePrincipals flag is set or not: - If the flag is set, the input service principal is assumed to be of the form SERVICE.amazonaws.com. That value will always be returned, unless the given region is an opt-in region and the service principal is rendered in a stack in a different region, in which case SERVICE.REGION.amazonaws.com will be rendered. Under this regime, there is no downside to always specifying the region property: it will be rendered only if necessary. - If the flag is not set, the service principal will resolve to a single principal whose name comes from the @aws-cdk/region-info package, using the region to override the stack region. If there is no entry for this service principal in the database,, the input service name is returned literally. This is legacy behavior and is not recommended. Default: - the resolving Stack’s region.

Return type

None

copy(*, actions=None, conditions=None, effect=None, not_actions=None, not_principals=None, not_resources=None, principals=None, resources=None, sid=None)

Create a new PolicyStatement with the same exact properties as this one, except for the overrides.

Parameters
  • actions (Optional[Sequence[str]]) – List of actions to add to the statement. Default: - no actions

  • conditions (Optional[Mapping[str, Any]]) – Conditions to add to the statement. Default: - no condition

  • effect (Optional[Effect]) – Whether to allow or deny the actions in this statement. Default: Effect.ALLOW

  • not_actions (Optional[Sequence[str]]) – List of not actions to add to the statement. Default: - no not-actions

  • not_principals (Optional[Sequence[IPrincipal]]) – List of not principals to add to the statement. Default: - no not principals

  • not_resources (Optional[Sequence[str]]) – NotResource ARNs to add to the statement. Default: - no not-resources

  • principals (Optional[Sequence[IPrincipal]]) – List of principals to add to the statement. Default: - no principals

  • resources (Optional[Sequence[str]]) – Resource ARNs to add to the statement. Default: - no resources

  • sid (Optional[str]) – The Sid (statement ID) is an optional identifier that you provide for the policy statement. You can assign a Sid value to each statement in a statement array. In services that let you specify an ID element, such as SQS and SNS, the Sid value is just a sub-ID of the policy document’s ID. In IAM, the Sid value must be unique within a JSON policy. Default: - no sid

Return type

PolicyStatement

freeze()

Make the PolicyStatement immutable.

After calling this, any of the addXxx() methods will throw an exception.

Libraries that lazily generate statement bodies can override this method to fill the actual PolicyStatement fields. Be aware that this method may be called multiple times.

Return type

PolicyStatement

to_json()

JSON-ify the statement.

Used when JSON.stringify() is called

Return type

Any

to_statement_json()

JSON-ify the policy statement.

Used when JSON.stringify() is called

Return type

Any

to_string()

String representation of this policy statement.

Return type

str

validate_for_any_policy()

Validate that the policy statement satisfies base requirements for a policy.

Return type

List[str]

Returns

An array of validation error messages, or an empty array if the statement is valid.

validate_for_identity_policy()

Validate that the policy statement satisfies all requirements for an identity-based policy.

Return type

List[str]

Returns

An array of validation error messages, or an empty array if the statement is valid.

validate_for_resource_policy()

Validate that the policy statement satisfies all requirements for a resource-based policy.

Return type

List[str]

Returns

An array of validation error messages, or an empty array if the statement is valid.

Attributes

actions

The Actions added to this statement.

conditions

The conditions added to this statement.

effect

Whether to allow or deny the actions in this statement Set effect for this statement.

frozen

Whether the PolicyStatement has been frozen.

The statement object is frozen when freeze() is called.

has_principal

Indicates if this permission has a “Principal” section.

has_resource

Indicates if this permission has at least one resource associated with it.

not_actions

The NotActions added to this statement.

not_principals

The NotPrincipals added to this statement.

not_resources

The NotResources added to this statement.

principals

The Principals added to this statement.

resources

The Resources added to this statement.

sid

Statement ID for this statement Set Statement ID for this statement.

Static Methods

classmethod from_json(obj)

Creates a new PolicyStatement based on the object provided.

This will accept an object created from the .toJSON() call

Parameters

obj (Any) – the PolicyStatement in object form.

Return type

PolicyStatement