Class: AWSCDK::IAM::Group

Inherits:
Resource
  • Object
show all
Includes:
IGroup
Defined in:
iam/group.rb

Overview

An IAM Group (collection of IAM users) lets you specify permissions for multiple users, which can make it easier to manage permissions for those users.

See Also:

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(scope, id, props = nil) ⇒ Group

Returns a new instance of Group.

Parameters:



14
15
16
17
18
19
20
 
# File 'iam/group.rb', line 14

def initialize(scope, id, props = nil)
  props = props.is_a?(Hash) ? ::AWSCDK::IAM::GroupProps.new(**props.transform_keys(&:to_sym)) : props
  Jsii::Type.check_type(scope, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLkNvbnN0cnVjdCJ9")), "scope")
  Jsii::Type.check_type(id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "id")
  Jsii::Type.check_type(props, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLkdyb3VwUHJvcHMifQ==")), "props") unless props.nil?
  Jsii::Object.instance_method(:initialize).bind(self).call(scope, id, props)
end

Class Method Details

.from_group_arn(scope, id, group_arn) ⇒ AWSCDK::IAM::IGroup

Import an external group by ARN.

If the imported Group ARN is a Token (such as a CfnParameter.valueAsString or a Fn.importValue()) and the referenced group has a path (like arn:...:group/AdminGroup/NetworkAdmin), the group_name property will not resolve to the correct value. Instead it will resolve to the first path component. We unfortunately cannot express the correct calculation of the full path name as a CloudFormation expression. In this scenario the Group ARN should be supplied without the path in order to resolve the correct group resource.

Parameters:

  • scope (Constructs::Construct) —

    construct scope.

  • id (String) —

    construct id.

  • group_arn (String) —

    the ARN of the group to import (e.g. arn:aws:iam::account-id:group/group-name).

Returns:



65
66
67
68
69
70
 
# File 'iam/group.rb', line 65

def self.from_group_arn(scope, id, group_arn)
  Jsii::Type.check_type(scope, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLkNvbnN0cnVjdCJ9")), "scope")
  Jsii::Type.check_type(id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "id")
  Jsii::Type.check_type(group_arn, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "groupArn")
  Jsii::Kernel.instance.call_static("aws-cdk-lib.aws_iam.Group", "fromGroupArn", [scope, id, group_arn])
end

.from_group_name(scope, id, group_name) ⇒ AWSCDK::IAM::IGroup

Import an existing group by given name (with path).

This method has same caveats of from_group_arn

Parameters:

  • scope (Constructs::Construct) —

    construct scope.

  • id (String) —

    construct id.

  • group_name (String) —

    the groupName (path included) of the existing group to import.

Returns:



80
81
82
83
84
85
 
# File 'iam/group.rb', line 80

def self.from_group_name(scope, id, group_name)
  Jsii::Type.check_type(scope, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLkNvbnN0cnVjdCJ9")), "scope")
  Jsii::Type.check_type(id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "id")
  Jsii::Type.check_type(group_name, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "groupName")
  Jsii::Kernel.instance.call_static("aws-cdk-lib.aws_iam.Group", "fromGroupName", [scope, id, group_name])
end

.jsii_overridable_methods ⇒ Object 



22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
 
# File 'iam/group.rb', line 22

def self.jsii_overridable_methods
  {
    :node => { kind: :property, name: "node", is_optional: false },
    :env => { kind: :property, name: "env", is_optional: false },
    :physical_name => { kind: :property, name: "physicalName", is_optional: false },
    :stack => { kind: :property, name: "stack", is_optional: false },
    :assume_role_action => { kind: :property, name: "assumeRoleAction", is_optional: false },
    :grant_principal => { kind: :property, name: "grantPrincipal", is_optional: false },
    :group_arn => { kind: :property, name: "groupArn", is_optional: false },
    :group_name => { kind: :property, name: "groupName", is_optional: false },
    :group_ref => { kind: :property, name: "groupRef", is_optional: false },
    :policy_fragment => { kind: :property, name: "policyFragment", is_optional: false },
    :principal_account => { kind: :property, name: "principalAccount", is_optional: true },
    :to_string => { kind: :method, name: "toString", is_optional: false },
    :with => { kind: :method, name: "with", is_optional: false },
    :apply_cross_stack_reference_strength => { kind: :method, name: "applyCrossStackReferenceStrength", is_optional: false },
    :apply_removal_policy => { kind: :method, name: "applyRemovalPolicy", is_optional: false },
    :generate_physical_name => { kind: :method, name: "generatePhysicalName", is_optional: false },
    :get_resource_arn_attribute => { kind: :method, name: "getResourceArnAttribute", is_optional: false },
    :get_resource_name_attribute => { kind: :method, name: "getResourceNameAttribute", is_optional: false },
    :add_managed_policy => { kind: :method, name: "addManagedPolicy", is_optional: false },
    :add_to_policy => { kind: :method, name: "addToPolicy", is_optional: false },
    :add_to_principal_policy => { kind: :method, name: "addToPrincipalPolicy", is_optional: false },
    :add_user => { kind: :method, name: "addUser", is_optional: false },
    :attach_inline_policy => { kind: :method, name: "attachInlinePolicy", is_optional: false },
  }
end

.PROPERTY_INJECTION_ID ⇒ String

Uniquely identifies this class.

Returns:

  • (String) 


133
134
135
 
# File 'iam/group.rb', line 133

def self.PROPERTY_INJECTION_ID()
  Jsii::Kernel.instance.get_static("aws-cdk-lib.aws_iam.Group", "PROPERTY_INJECTION_ID")
end

Instance Method Details

#add_managed_policy(policy) ⇒ void

This method returns an undefined value.

Attaches a managed policy to this group.

See IAM and AWS STS quotas, name requirements, and character limits for quota of managed policies attached to an IAM group.

Parameters:



289
290
291
292
 
# File 'iam/group.rb', line 289

def add_managed_policy(policy)
  Jsii::Type.check_type(policy, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklNYW5hZ2VkUG9saWN5In0=")), "policy")
  jsii_call_method("addManagedPolicy", [policy])
end

#add_to_policy(statement) ⇒ Boolean

Add to the policy of this principal.

Parameters:

Returns:

  • (Boolean) 


298
299
300
301
 
# File 'iam/group.rb', line 298

def add_to_policy(statement)
  Jsii::Type.check_type(statement, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLlBvbGljeVN0YXRlbWVudCJ9")), "statement")
  jsii_call_method("addToPolicy", [statement])
end

#add_to_principal_policy(statement) ⇒ AWSCDK::IAM::AddToPrincipalPolicyResult

Adds an IAM statement to the default policy.

Parameters:

Returns:



307
308
309
310
 
# File 'iam/group.rb', line 307

def add_to_principal_policy(statement)
  Jsii::Type.check_type(statement, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLlBvbGljeVN0YXRlbWVudCJ9")), "statement")
  jsii_call_method("addToPrincipalPolicy", [statement])
end

#add_user(user) ⇒ void

This method returns an undefined value.

Adds a user to this group.

Parameters:



316
317
318
319
 
# File 'iam/group.rb', line 316

def add_user(user)
  Jsii::Type.check_type(user, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklVc2VyIn0=")), "user")
  jsii_call_method("addUser", [user])
end

#apply_cross_stack_reference_strength(strength) ⇒ void

This method returns an undefined value.

Override the cross-stack reference strength for this resource.

When set, any cross-stack reference to this resource will use the specified mechanism instead of the global default determined by the @aws-cdk/core:defaultCrossStackReferences context key. This is useful for selectively weakening specific references to avoid the "deadly embrace" problem without changing the app-wide default.

Parameters:



224
225
226
227
 
# File 'iam/group.rb', line 224

def apply_cross_stack_reference_strength(strength)
  Jsii::Type.check_type(strength, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5SZWZlcmVuY2VTdHJlbmd0aCJ9")), "strength")
  jsii_call_method("applyCrossStackReferenceStrength", [strength])
end

#apply_removal_policy(policy) ⇒ void

This method returns an undefined value.

Apply the given removal policy to this resource.

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

Parameters:



241
242
243
244
 
# File 'iam/group.rb', line 241

def apply_removal_policy(policy)
  Jsii::Type.check_type(policy, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5SZW1vdmFsUG9saWN5In0=")), "policy")
  jsii_call_method("applyRemovalPolicy", [policy])
end

#assume_role_action ⇒ String

When this Principal is used in an AssumeRole policy, the action to use.

Returns:

  • (String) 


140
141
142
 
# File 'iam/group.rb', line 140

def assume_role_action()
  jsii_get_property("assumeRoleAction")
end

#attach_inline_policy(policy) ⇒ void

This method returns an undefined value.

Attaches a policy to this group.

Parameters:



325
326
327
328
 
# File 'iam/group.rb', line 325

def attach_inline_policy(policy)
  Jsii::Type.check_type(policy, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLlBvbGljeSJ9")), "policy")
  jsii_call_method("attachInlinePolicy", [policy])
end

#env ⇒ AWSCDK::Interfaces::ResourceEnvironment

The environment this resource belongs to.

For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.

For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.

Returns:



105
106
107
 
# File 'iam/group.rb', line 105

def env()
  jsii_get_property("env")
end

#generate_physical_name ⇒ String

Returns:

  • (String) 


247
248
249
 
# File 'iam/group.rb', line 247

def generate_physical_name()
  jsii_call_method("generatePhysicalName", [])
end

#get_resource_arn_attribute(arn_attr, arn_components) ⇒ String

Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. bucket.bucketArn).

Normally, this token will resolve to arn_attr, but if the resource is referenced across environments, arn_components will be used to synthesize a concrete ARN with the resource's physical name. Make sure to reference this.physicalName in arn_components.

Parameters:

  • arn_attr (String) —

    The CFN attribute which resolves to the ARN of the resource.

  • arn_components (AWSCDK::ARNComponents) —

    The format of the ARN of this resource.

Returns:

  • (String) 


261
262
263
264
265
266
 
# File 'iam/group.rb', line 261

def get_resource_arn_attribute(arn_attr, arn_components)
  Jsii::Type.check_type(arn_attr, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "arnAttr")
  arn_components = arn_components.is_a?(Hash) ? ::AWSCDK::ARNComponents.new(**arn_components.transform_keys(&:to_sym)) : arn_components
  Jsii::Type.check_type(arn_components, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5Bcm5Db21wb25lbnRzIn0=")), "arnComponents")
  jsii_call_method("getResourceArnAttribute", [arn_attr, arn_components])
end

#get_resource_name_attribute(name_attr) ⇒ String

Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. bucket.bucketName).

Normally, this token will resolve to name_attr, but if the resource is referenced across environments, it will be resolved to this.physicalName, which will be a concrete name.

Parameters:

  • name_attr (String) —

    The CFN attribute which resolves to the resource's name.

Returns:

  • (String) 


276
277
278
279
 
# File 'iam/group.rb', line 276

def get_resource_name_attribute(name_attr)
  Jsii::Type.check_type(name_attr, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "nameAttr")
  jsii_call_method("getResourceNameAttribute", [name_attr])
end

#grant_principal ⇒ AWSCDK::IAM::IPrincipal

The principal to grant permissions to.

Returns:



147
148
149
 
# File 'iam/group.rb', line 147

def grant_principal()
  jsii_get_property("grantPrincipal")
end

#group_arn ⇒ String

Returns the IAM Group ARN.

Returns:

  • (String) 


154
155
156
 
# File 'iam/group.rb', line 154

def group_arn()
  jsii_get_property("groupArn")
end

#group_name ⇒ String

Returns the IAM Group Name.

Returns:

  • (String) 


161
162
163
 
# File 'iam/group.rb', line 161

def group_name()
  jsii_get_property("groupName")
end

#group_ref ⇒ AWSCDK::Interfaces::AWSIAM::GroupReference

A reference to a Group resource.

Returns:



168
169
170
 
# File 'iam/group.rb', line 168

def group_ref()
  jsii_get_property("groupRef")
end

#node ⇒ Constructs::Node

The tree node.

Returns:

  • (Constructs::Node) 


90
91
92
 
# File 'iam/group.rb', line 90

def node()
  jsii_get_property("node")
end

#physical_name ⇒ String

Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.

This value will resolve to one of the following:

  • a concrete value (e.g. "my-awesome-bucket")
  • undefined, when a name should be generated by CloudFormation
  • a concrete name generated automatically during synthesis, in cross-environment scenarios.

Returns:

  • (String) 


119
120
121
 
# File 'iam/group.rb', line 119

def physical_name()
  jsii_get_property("physicalName")
end

#policy_fragment ⇒ AWSCDK::IAM::PrincipalPolicyFragment

Return the policy fragment that identifies this principal in a Policy.

Returns:



175
176
177
 
# File 'iam/group.rb', line 175

def policy_fragment()
  jsii_get_property("policyFragment")
end

#principal_account ⇒ String?

The AWS account ID of this principal.

Can be undefined when the account is not known (for example, for service principals). Can be a Token - in that case, it's assumed to be AWS::AccountId.

Returns:

  • (String, nil) 


187
188
189
 
# File 'iam/group.rb', line 187

def ()
  jsii_get_property("principalAccount")
end

#stack ⇒ AWSCDK::Stack

The stack in which this resource is defined.

Returns:



126
127
128
 
# File 'iam/group.rb', line 126

def stack()
  jsii_get_property("stack")
end

#to_string ⇒ String

Returns a string representation of this construct.

Returns:

  • (String) 


194
195
196
 
# File 'iam/group.rb', line 194

def to_string()
  jsii_call_method("toString", [])
end

#with(*mixins) ⇒ Constructs::IConstruct

Applies one or more mixins to this construct.

Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.

Parameters:

  • mixins (Array<Constructs::IMixin>)

Returns:

  • (Constructs::IConstruct) 


207
208
209
210
211
212
 
# File 'iam/group.rb', line 207

def with(*mixins)
  mixins.each_with_index do |item, index|
    Jsii::Type.check_type(item, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLklNaXhpbiJ9")), "mixins[#{index}]")
  end
  jsii_call_method("with", [*mixins])
end