Module: AWSCDK::BedrockAgentCore::IWorkloadIdentity

Includes:
IAM::IGrantable, IResource, Interfaces::AWSBedrockagentcore::IWorkloadIdentityRef
Included in:
WorkloadIdentity
Defined in:
bedrock_agent_core/i_workload_identity.rb

Overview

A workload identity for Amazon Bedrock AgentCore.

Represents the stable identity of an agent within an account's agent identity directory. It ties together IAM roles, OAuth2 flows, API keys, and workload access tokens for consistent authentication across environments.

See Also:

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.jsii_overridable_methods ⇒ Object 



167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 167

def self.jsii_overridable_methods
  {
    :node => { kind: :property, name: "node", is_optional: false },
    :env => { kind: :property, name: "env", is_optional: false },
    :stack => { kind: :property, name: "stack", is_optional: false },
    :grant_principal => { kind: :property, name: "grantPrincipal", is_optional: false },
    :workload_identity_ref => { kind: :property, name: "workloadIdentityRef", is_optional: false },
    :workload_identity_arn => { kind: :property, name: "workloadIdentityArn", is_optional: false },
    :workload_identity_name => { kind: :property, name: "workloadIdentityName", is_optional: false },
    :created_time => { kind: :property, name: "createdTime", is_optional: true },
    :last_updated_time => { kind: :property, name: "lastUpdatedTime", is_optional: true },
    :with => { kind: :method, name: "with", is_optional: false },
    :apply_removal_policy => { kind: :method, name: "applyRemovalPolicy", is_optional: false },
    :grant => { kind: :method, name: "grant", is_optional: false },
    :grant_admin => { kind: :method, name: "grantAdmin", is_optional: false },
    :grant_full_access => { kind: :method, name: "grantFullAccess", is_optional: false },
    :grant_read => { kind: :method, name: "grantRead", is_optional: false },
    :grant_use => { kind: :method, name: "grantUse", is_optional: false },
  }
end

Instance Method Details

#apply_removal_policy(policy) ⇒ void

This method returns an undefined value.

Apply the given removal policy to this resource.

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

Parameters:



113
114
115
116
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 113

def apply_removal_policy(policy)
  Jsii::Type.check_type(policy, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5SZW1vdmFsUG9saWN5In0=")), "policy")
  jsii_call_method("applyRemovalPolicy", [policy])
end

#created_time ⇒ String?

Timestamp when the workload identity was created.

Returns:

  • (String, nil) 


76
77
78
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 76

def created_time()
  jsii_get_property("createdTime")
end

#env ⇒ AWSCDK::Interfaces::ResourceEnvironment

The environment this resource belongs to.

For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.

For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.

Returns:



34
35
36
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 34

def env()
  jsii_get_property("env")
end

#grant(grantee, *actions) ⇒ AWSCDK::IAM::Grant

Grants IAM actions on this workload identity, scoped to its ARN and the parent resources required by the Bedrock AgentCore authorization model.

Parameters:

Returns:



123
124
125
126
127
128
129
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 123

def grant(grantee, *actions)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  actions.each_with_index do |item, index|
    Jsii::Type.check_type(item, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "actions[#{index}]")
  end
  jsii_call_method("grant", [grantee, *actions])
end

#grant_admin(grantee) ⇒ AWSCDK::IAM::Grant

Grant control plane permissions to manage this workload identity.

Parameters:

Returns:



135
136
137
138
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 135

def grant_admin(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantAdmin", [grantee])
end

#grant_full_access(grantee) ⇒ AWSCDK::IAM::Grant

Grant read, list, admin, and use permissions.

Parameters:

Returns:



144
145
146
147
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 144

def grant_full_access(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantFullAccess", [grantee])
end

#grant_principal ⇒ AWSCDK::IAM::IPrincipal

The principal to grant permissions to.

Returns:



48
49
50
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 48

def grant_principal()
  jsii_get_property("grantPrincipal")
end

#grant_read(grantee) ⇒ AWSCDK::IAM::Grant

Grant GetWorkloadIdentity and ListWorkloadIdentities, scoped to this identity and parent resources required by the Bedrock AgentCore authorization model.

Parameters:

Returns:



153
154
155
156
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 153

def grant_read(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantRead", [grantee])
end

#grant_use(grantee) ⇒ AWSCDK::IAM::Grant

Grant data plane permissions to mint workload access tokens (GetWorkloadAccessToken, GetWorkloadAccessTokenForJWT, GetWorkloadAccessTokenForUserId).

Parameters:

Returns:



162
163
164
165
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 162

def grant_use(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantUse", [grantee])
end

#last_updated_time ⇒ String?

Timestamp when the workload identity was last updated.

Returns:

  • (String, nil) 


83
84
85
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 83

def last_updated_time()
  jsii_get_property("lastUpdatedTime")
end

#node ⇒ Constructs::Node

The tree node.

Returns:

  • (Constructs::Node) 


19
20
21
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 19

def node()
  jsii_get_property("node")
end

#stack ⇒ AWSCDK::Stack

The stack in which this resource is defined.

Returns:



41
42
43
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 41

def stack()
  jsii_get_property("stack")
end

#with(*mixins) ⇒ Constructs::IConstruct

Applies one or more mixins to this construct.

Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited.

Parameters:

  • mixins (Array<Constructs::IMixin>) —

    The mixins to apply.

Returns:

  • (Constructs::IConstruct) —

    This construct for chaining



94
95
96
97
98
99
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 94

def with(*mixins)
  mixins.each_with_index do |item, index|
    Jsii::Type.check_type(item, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLklNaXhpbiJ9")), "mixins[#{index}]")
  end
  jsii_call_method("with", [*mixins])
end

#workload_identity_arn ⇒ String

The ARN of this workload identity.

Returns:

  • (String) 


62
63
64
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 62

def workload_identity_arn()
  jsii_get_property("workloadIdentityArn")
end

#workload_identity_name ⇒ String

The name of this workload identity.

Returns:

  • (String) 


69
70
71
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 69

def workload_identity_name()
  jsii_get_property("workloadIdentityName")
end

#workload_identity_ref ⇒ AWSCDK::Interfaces::AWSBedrockagentcore::WorkloadIdentityReference

A reference to a WorkloadIdentity resource.

Returns:



55
56
57
 
# File 'bedrock_agent_core/i_workload_identity.rb', line 55

def workload_identity_ref()
  jsii_get_property("workloadIdentityRef")
end