Class: AWSCDK::ResilienceHub::CfnApp::PermissionModelProperty

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
resilience_hub/cfn_app.rb

Overview

Defines the roles and credentials that AWS Resilience Hub would use while creating the application, importing its resources, and running an assessment.

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(type:, cross_account_role_arns: nil, invoker_role_name: nil) ⇒ PermissionModelProperty

Returns a new instance of PermissionModelProperty.

Parameters:

  • type (String) —

    Defines how AWS Resilience Hub scans your resources.

  • cross_account_role_arns (Array<String>, nil) (defaults to: nil) —

    Defines a list of role Amazon Resource Names (ARNs) to be used in other accounts.

  • invoker_role_name (String, nil) (defaults to: nil) —

    Existing AWS IAM role name in the primary AWS account that will be assumed by AWS Resilience Hub Service Principle to obtain a read-only access to your application resources while running an assessment.



694
695
696
697
698
699
700
701
 
# File 'resilience_hub/cfn_app.rb', line 694

def initialize(type:, cross_account_role_arns: nil, invoker_role_name: nil)
  @type = type
  Jsii::Type.check_type(@type, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "type")
  @cross_account_role_arns = 
  Jsii::Type.check_type(@cross_account_role_arns, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7InByaW1pdGl2ZSI6InN0cmluZyJ9LCJraW5kIjoiYXJyYXkifX0=")), "crossAccountRoleArns") unless @cross_account_role_arns.nil?
  @invoker_role_name = invoker_role_name
  Jsii::Type.check_type(@invoker_role_name, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "invokerRoleName") unless @invoker_role_name.nil?
end

Instance Attribute Details

#cross_account_role_arns ⇒ Array<String>? (readonly)

Defines a list of role Amazon Resource Names (ARNs) to be used in other accounts.

These ARNs are used for querying purposes while importing resources and assessing your application.

  • These ARNs are required only when your resources are in other accounts and you have different role name in these accounts. Else, the invoker role name will be used in the other accounts.
  • These roles must have a trust policy with iam:AssumeRole permission to the invoker role in the primary account.

Returns:

  • (Array<String>, nil)

See Also:



719
720
721
 
# File 'resilience_hub/cfn_app.rb', line 719

def 
  @cross_account_role_arns
end

#invoker_role_name ⇒ String? (readonly)

Existing AWS IAM role name in the primary AWS account that will be assumed by AWS Resilience Hub Service Principle to obtain a read-only access to your application resources while running an assessment.

If your IAM role includes a path, you must include the path in the invoker_role_name parameter. For example, if your IAM role's ARN is arn:aws:iam:123456789012:role/my-path/role-name , you should pass my-path/role-name .

  • You must have iam:passRole permission for this role while creating or updating the application.
  • Currently, invoker_role_name accepts only [A-Za-z0-9_+=,.@-] characters.

Returns:

  • (String, nil)

See Also:



729
730
731
 
# File 'resilience_hub/cfn_app.rb', line 729

def invoker_role_name
  @invoker_role_name
end

#type ⇒ String (readonly)

Defines how AWS Resilience Hub scans your resources.

It can scan for the resources by using a pre-existing role in your AWS account, or by using the credentials of the current IAM user.

Returns:

  • (String)

See Also:



709
710
711
 
# File 'resilience_hub/cfn_app.rb', line 709

def type
  @type
end

Class Method Details

.jsii_properties ⇒ Object 



731
732
733
734
735
736
737
 
# File 'resilience_hub/cfn_app.rb', line 731

def self.jsii_properties
  {
    :type => "type",
    :cross_account_role_arns => "crossAccountRoleArns",
    :invoker_role_name => "invokerRoleName",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



739
740
741
742
743
744
745
746
747
 
# File 'resilience_hub/cfn_app.rb', line 739

def to_jsii
  result = {}
  result.merge!({
    "type" => @type,
    "crossAccountRoleArns" => @cross_account_role_arns,
    "invokerRoleName" => @invoker_role_name,
  })
  result.compact
end