Skip to content

Commit 08656c7

Browse files
rehanvdmrehanvdm
committed
feat: pass policy document to sso permission set
1 parent 5dd4979 commit 08656c7

File tree

7 files changed

+61
-33
lines changed

7 files changed

+61
-33
lines changed

‎API.md

+4-4
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/src/content/docs/components/identity/iam-identity-center.mdx

+21-11
Original file line numberDiff line numberDiff line change
@@ -60,10 +60,14 @@ The example below assigns the `AdministratorAccess` permission set (created by
6060
// Create a custom permission sets from inline policies
6161
{
6262
name: 's3-only-access',
63-
inlinePolicyStatement: new iam.PolicyStatement({
64-
actions: ['s3:*'],
65-
resources: ['*'],
66-
})
63+
inlinePolicyDocument: new iam.PolicyDocument({
64+
statements: [
65+
new iam.PolicyStatement({
66+
actions: ['s3:GetObject'],
67+
resources: ['arn:aws:s3:::mybucket/*'],
68+
})
69+
]
70+
}),
6771
}
6872
],
6973
accessGroups: [
@@ -87,6 +91,7 @@ The example below assigns the `AdministratorAccess` permission set (created by
8791
```python
8892
import aws_cdk as cdk
8993
import aws_data_landing_zone as dlz
94+
from aws_cdk.aws_iam import (PolicyDocument, Effect, PolicyStatement)
9095
9196
app = cdk.App()
9297
dlz.DataLandingZone(app,
@@ -108,16 +113,21 @@ The example below assigns the `AdministratorAccess` permission set (created by
108113
*Defaults.iam_identity_center_permission_sets(),
109114
# Create custom permission sets from managed policies
110115
{
111-
name: 'power-user-permission-set',
112-
managed_policy_arns: ['arn:aws:iam::aws:policy/PowerUserAccess']
116+
name: 'power-user-permission-set',
117+
managed_policy_arns: ['arn:aws:iam::aws:policy/PowerUserAccess']
113118
},
114119
# Create a custom permission sets from inline policies
115120
{
116-
name: 's3-only-access',
117-
inline_policy_statement: {
118-
actions: ['s3:*'],
119-
resources: ['*'],
120-
}
121+
name: 's3-only-access',
122+
inline_policy_document: PolicyDocument(
123+
statements=[
124+
PolicyStatement(
125+
effect=Effect.ALLOW,
126+
actions=["s3:*"],
127+
resources=["*"]
128+
)
129+
]
130+
)
121131
}
122132
],
123133
"access_groups": [

‎docs/src/content/docs/reference/api.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -18254,7 +18254,7 @@ const iamIdentityCenterPermissionSetProps: IamIdentityCenterPermissionSetProps =
1825418254
| --- | --- | --- |
1825518255
| <code><a href="#aws-data-landing-zone.IamIdentityCenterPermissionSetProps.property.name">name</a></code> | <code>string</code> | *No description.* |
1825618256
| <code><a href="#aws-data-landing-zone.IamIdentityCenterPermissionSetProps.property.description">description</a></code> | <code>string</code> | *No description.* |
18257-
| <code><a href="#aws-data-landing-zone.IamIdentityCenterPermissionSetProps.property.inlinePolicyStatement">inlinePolicyStatement</a></code> | <code>aws-cdk-lib.aws_iam.PolicyStatement</code> | *No description.* |
18257+
| <code><a href="#aws-data-landing-zone.IamIdentityCenterPermissionSetProps.property.inlinePolicyDocument">inlinePolicyDocument</a></code> | <code>aws-cdk-lib.aws_iam.PolicyDocument</code> | *No description.* |
1825818258
| <code><a href="#aws-data-landing-zone.IamIdentityCenterPermissionSetProps.property.managedPolicyArns">managedPolicyArns</a></code> | <code>string[]</code> | *No description.* |
1825918259
| <code><a href="#aws-data-landing-zone.IamIdentityCenterPermissionSetProps.property.permissionsBoundary">permissionsBoundary</a></code> | <code>aws-cdk-lib.IResolvable \| aws-cdk-lib.aws_sso.CfnPermissionSet.PermissionsBoundaryProperty</code> | *No description.* |
1826018260
| <code><a href="#aws-data-landing-zone.IamIdentityCenterPermissionSetProps.property.sessionDuration">sessionDuration</a></code> | <code>aws-cdk-lib.Duration</code> | *No description.* |
@@ -18281,13 +18281,13 @@ public readonly description: string;
1828118281

1828218282
---
1828318283

18284-
##### `inlinePolicyStatement`<sup>Optional</sup> <a name="inlinePolicyStatement" id="aws-data-landing-zone.IamIdentityCenterPermissionSetProps.property.inlinePolicyStatement"></a>
18284+
##### `inlinePolicyDocument`<sup>Optional</sup> <a name="inlinePolicyDocument" id="aws-data-landing-zone.IamIdentityCenterPermissionSetProps.property.inlinePolicyDocument"></a>
1828518285

1828618286
```typescript
18287-
public readonly inlinePolicyStatement: PolicyStatement;
18287+
public readonly inlinePolicyDocument: PolicyDocument;
1828818288
```
1828918289

18290-
- *Type:* aws-cdk-lib.aws_iam.PolicyStatement
18290+
- *Type:* aws-cdk-lib.aws_iam.PolicyDocument
1829118291

1829218292
---
1829318293

‎src/constructs/iam-identity-center/iam-identity-center.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import { DlzStack } from '../dlz-stack/index';
1515
export interface IamIdentityCenterPermissionSetProps {
1616
readonly name: string;
1717
readonly description?: string;
18-
readonly inlinePolicyStatement?: iam.PolicyStatement;
18+
readonly inlinePolicyDocument?: iam.PolicyDocument;
1919
readonly managedPolicyArns?: string[];
2020
readonly permissionsBoundary?: cdk.IResolvable | CfnPermissionSet.PermissionsBoundaryProperty;
2121
readonly sessionDuration?: cdk.Duration;
@@ -95,7 +95,7 @@ export class IamIdentityCenter {
9595
instanceArn: iamIdentityCenter.arn,
9696
name: permissionSetConf.name,
9797
description: permissionSetConf.description,
98-
inlinePolicy: permissionSetConf.inlinePolicyStatement ? permissionSetConf.inlinePolicyStatement?.toJSON() : undefined,
98+
inlinePolicy: permissionSetConf.inlinePolicyDocument ? permissionSetConf.inlinePolicyDocument.toJSON() : undefined,
9999
managedPolicies: permissionSetConf.managedPolicyArns,
100100
permissionsBoundary: permissionSetConf.permissionsBoundary,
101101
sessionDuration: permissionSetConf.sessionDuration ? durationToIso8601(permissionSetConf.sessionDuration) : undefined,

‎test/__snapshots__/build.test.ts.snap

+8-3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎test/build.test.ts

+7-3
Original file line numberDiff line numberDiff line change
@@ -652,9 +652,13 @@ const configBase: DataLandingZoneProps = {
652652
{
653653
name: 'inline-permission-set-read-only-s3',
654654
description: 'Limited get object permission',
655-
inlinePolicyStatement: new iam.PolicyStatement({
656-
actions: ['s3:GetObject'],
657-
resources: ['arn:aws:s3:::mybucket/*'],
655+
inlinePolicyDocument: new iam.PolicyDocument({
656+
statements: [
657+
new iam.PolicyStatement({
658+
actions: ['s3:GetObject'],
659+
resources: ['arn:aws:s3:::mybucket/*'],
660+
}),
661+
],
658662
}),
659663
},
660664
],

‎test/iam-identity-center.test.ts

+15-6
Original file line numberDiff line numberDiff line change
@@ -119,9 +119,13 @@ describe('Permission sets', () => {
119119
{
120120
name: 'inline-permission-set-read-only-s3',
121121
description: 'Limited get object permission',
122-
inlinePolicyStatement: new iam.PolicyStatement({
123-
actions: ['s3:GetObject'],
124-
resources: ['arn:aws:s3:::mybucket/*'],
122+
inlinePolicyDocument: new iam.PolicyDocument({
123+
statements: [
124+
new iam.PolicyStatement({
125+
actions: ['s3:GetObject'],
126+
resources: ['arn:aws:s3:::mybucket/*'],
127+
}),
128+
],
125129
}),
126130
},
127131
],
@@ -139,9 +143,14 @@ describe('Permission sets', () => {
139143
Description: 'Limited get object permission',
140144
InstanceArn: 'arn:aws:sso:::instance/sso-instance-id',
141145
InlinePolicy: {
142-
Action: 's3:GetObject',
143-
Effect: 'Allow',
144-
Resource: 'arn:aws:s3:::mybucket/*',
146+
Statement: [
147+
{
148+
Action: 's3:GetObject',
149+
Effect: 'Allow',
150+
Resource: 'arn:aws:s3:::mybucket/*',
151+
},
152+
],
153+
Version: '2012-10-17',
145154
},
146155
});
147156
});

0 commit comments

Comments
 (0)