Class GuInstanceRole

Creates an IAM role with common policies that are needed by most Guardian applications.

More specifically:

  1. Allows for ssh access to an EC2 instance via ssm-scala (instead of standard ssh).
  2. Allows EC2 instances to communicate with Wazuh, for security monitoring.
  3. Allows EC2 instances to download an artifact from AWS S3, for application deployment.
  4. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[GuParameterStoreReadPolicy]] for specific details.
  5. Allows EC2 instances to write logs into our central ELK stack via Kinesis.

If additional IAM permissions are required, create custom policies and pass them in via the additionalPolicies prop.

If log shipping is not required, opt out by setting the withoutLogShipping prop to true.

Hierarchy

Constructors

constructor

Properties

assumeRoleAction assumeRolePolicy? env grantPrincipal idWithApp node permissionsBoundary? physicalName policyFragment principalAccount roleArn roleName stack

Accessors

roleId

Methods

_enableCrossEnvironment addManagedPolicy addToPolicy addToPrincipalPolicy applyRemovalPolicy attachInlinePolicy generatePhysicalName getResourceArnAttribute getResourceNameAttribute grant grantAssumeRole grantPassRole toString withoutPolicyUpdates customizeRoles fromRoleArn fromRoleName isConstruct isOwnedResource isResource isRole

Constructors

constructor

Properties

ReadonlyassumeRoleAction

assumeRoleAction: string

When this Principal is used in an AssumeRole policy, the action to use.

Optional ReadonlyassumeRolePolicy

assumeRolePolicy?: PolicyDocument

The assume role policy document associated with this role.

Readonlyenv

env: ResourceEnvironment

The environment this resource belongs to. For resources that are created and managed by the CDK (generally, those created by creating new class instances like Role, Bucket, etc.), this is always the same as the environment of the stack they belong to; however, for imported resources (those obtained from static methods like fromRoleArn, fromBucketName, etc.), that might be different than the stack they were imported into.

ReadonlygrantPrincipal

grantPrincipal: IPrincipal

The principal to grant permissions to

ReadonlyidWithApp

idWithApp: string

The ID of the construct with the App suffix. This should be used in place of id when trying to reference the construct.

Readonlynode

node: Node

The tree node.

Optional ReadonlypermissionsBoundary

permissionsBoundary?: IManagedPolicy

Returns the permissions boundary attached to this role

Protected ReadonlyphysicalName

physicalName: string

Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.

This value will resolve to one of the following:

  • a concrete value (e.g. "my-awesome-bucket")
  • undefined, when a name should be generated by CloudFormation
  • a concrete name generated automatically during synthesis, in cross-environment scenarios.

ReadonlypolicyFragment

policyFragment: PrincipalPolicyFragment

Returns the role.

ReadonlyprincipalAccount

principalAccount: undefined | string

The AWS account ID of this principal. Can be undefined when the account is not known (for example, for service principals). Can be a Token - in that case, it's assumed to be AWS::AccountId.

ReadonlyroleArn

roleArn: string

Returns the ARN of this role.

ReadonlyroleName

roleName: string

Returns the name of the role.

Readonlystack

stack: Stack

The stack in which this resource is defined.

Accessors

roleId

  • get roleId(): string

  • Returns the stable and unique string identifying the role. For example, AIDAJQABLZS4A3QDU576Q.

    Returns string

    Attribute

Methods

_enableCrossEnvironment

  • _enableCrossEnvironment(): void
  • Internal

    Called when this resource is referenced across environments (account/region) to order to request that a physical name will be generated for this resource during synthesis, so the resource can be referenced through its absolute name/arn.

    Returns void

addManagedPolicy

  • addManagedPolicy(policy: IManagedPolicy): void

  • Attaches a managed policy to this role.

    Parameters

    • policy: IManagedPolicy

      The the managed policy to attach.

    Returns void

addToPolicy

  • addToPolicy(statement: PolicyStatement): boolean

  • Parameters

    • statement: PolicyStatement

    Returns boolean

addToPrincipalPolicy

  • addToPrincipalPolicy(statement: PolicyStatement): AddToPrincipalPolicyResult

  • Adds a permission to the role's default policy document. If there is no default policy attached to this role, it will be created.

    Parameters

    • statement: PolicyStatement

      The permission statement to add to the policy document

    Returns AddToPrincipalPolicyResult

applyRemovalPolicy

  • applyRemovalPolicy(policy: RemovalPolicy): void

  • Skip applyRemovalPolicy if role synthesis is prevented by customizeRoles. Because in this case, this construct does not have a CfnResource in the tree.

    Parameters

    • policy: RemovalPolicy

      RemovalPolicy

    Returns void

attachInlinePolicy

  • attachInlinePolicy(policy: Policy): void

  • Attaches a policy to this role.

    Parameters

    • policy: Policy

      The policy to attach

    Returns void

ProtectedgeneratePhysicalName

  • generatePhysicalName(): string

  • Returns string

ProtectedgetResourceArnAttribute

  • getResourceArnAttribute(arnAttr: string, arnComponents: ArnComponents): string

  • Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. bucket.bucketArn).

    Normally, this token will resolve to arnAttr, but if the resource is referenced across environments, arnComponents will be used to synthesize a concrete ARN with the resource's physical name. Make sure to reference this.physicalName in arnComponents.

    Parameters

    • arnAttr: string

      The CFN attribute which resolves to the ARN of the resource. Commonly it will be called "Arn" (e.g. resource.attrArn), but sometimes it's the CFN resource's ref.

    • arnComponents: ArnComponents

      The format of the ARN of this resource. You must reference this.physicalName somewhere within the ARN in order for cross-environment references to work.

    Returns string

ProtectedgetResourceNameAttribute

  • getResourceNameAttribute(nameAttr: string): string

  • Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. bucket.bucketName).

    Normally, this token will resolve to nameAttr, but if the resource is referenced across environments, it will be resolved to this.physicalName, which will be a concrete name.

    Parameters

    • nameAttr: string

      The CFN attribute which resolves to the resource's name. Commonly this is the resource's ref.

    Returns string

grant

  • grant(grantee: IPrincipal, ...actions: string[]): Grant

  • Grant the actions defined in actions to the identity Principal on this resource.

    Parameters

    • grantee: IPrincipal
    • ...actions: string[]

    Returns Grant

grantAssumeRole

  • grantAssumeRole(identity: IPrincipal): Grant

  • Grant permissions to the given principal to assume this role.

    Parameters

    • identity: IPrincipal

    Returns Grant

grantPassRole

  • grantPassRole(identity: IPrincipal): Grant

  • Grant permissions to the given principal to pass this role.

    Parameters

    • identity: IPrincipal

    Returns Grant

toString

  • toString(): string

  • Returns a string representation of an object.

    Returns string

withoutPolicyUpdates

  • withoutPolicyUpdates(options?: WithoutPolicyUpdatesOptions): IRole

  • Return a copy of this Role object whose Policies will not be updated

    Use the object returned by this method if you want this Role to be used by a construct without it automatically updating the Role's Policies.

    If you do, you are responsible for adding the correct statements to the Role's policies yourself.

    Parameters

    • Optionaloptions: WithoutPolicyUpdatesOptions

    Returns IRole

StaticcustomizeRoles

  • customizeRoles(scope: Construct, options?: CustomizeRolesOptions): void

  • Customize the creation of IAM roles within the given scope

    It is recommended that you do not use this method and instead allow CDK to manage role creation. This should only be used in environments where CDK applications are not allowed to created IAM roles.

    This can be used to prevent the CDK application from creating roles within the given scope and instead replace the references to the roles with precreated role names. A report will be synthesized in the cloud assembly (i.e. cdk.out) that will contain the list of IAM roles that would have been created along with the IAM policy statements that the role should contain. This report can then be used to create the IAM roles outside of CDK and then the created role names can be provided in usePrecreatedRoles.

    Parameters

    • scope: Construct

      construct scope to customize role creation

    • Optionaloptions: CustomizeRolesOptions

      options for configuring role creation

    Returns void

    Example

    declare const app: App;
    iam.Role.customizeRoles(app, {
      usePrecreatedRoles: {
        'ConstructPath/To/Role': 'my-precreated-role-name',
      },
    });

StaticfromRoleArn

  • fromRoleArn(
        scope: Construct,
        id: string,
        roleArn: string,
        options?: FromRoleArnOptions,
    ): IRole

  • Import an external role by ARN.

    If the imported Role ARN is a Token (such as a CfnParameter.valueAsString or a Fn.importValue()) and the referenced role has a path (like arn:...:role/AdminRoles/Alice), the roleName property will not resolve to the correct value. Instead it will resolve to the first path component. We unfortunately cannot express the correct calculation of the full path name as a CloudFormation expression. In this scenario the Role ARN should be supplied without the path in order to resolve the correct role resource.

    Parameters

    • scope: Construct

      construct scope

    • id: string

      construct id

    • roleArn: string

      the ARN of the role to import

    • Optionaloptions: FromRoleArnOptions

      allow customizing the behavior of the returned role

    Returns IRole

StaticfromRoleName

  • fromRoleName(
        scope: Construct,
        id: string,
        roleName: string,
        options?: FromRoleNameOptions,
    ): IRole

  • Import an external role by name.

    The imported role is assumed to exist in the same account as the account the scope's containing Stack is being deployed to.

    Parameters

    • scope: Construct

      construct scope

    • id: string

      construct id

    • roleName: string

      the name of the role to import

    • Optionaloptions: FromRoleNameOptions

      allow customizing the behavior of the returned role

    Returns IRole

StaticisConstruct

  • isConstruct(x: any): x is Construct

  • Checks if x is a construct.

    Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.

    Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.

    Parameters

    • x: any

      Any object

    Returns x is Construct

    true if x is an object created from a class which extends Construct.

StaticisOwnedResource

  • isOwnedResource(construct: IConstruct): boolean

  • Returns true if the construct was created by CDK, and false otherwise

    Parameters

    • construct: IConstruct

    Returns boolean

StaticisResource

  • isResource(construct: IConstruct): construct is Resource

  • Check whether the given construct is a Resource

    Parameters

    • construct: IConstruct

    Returns construct is Resource

StaticisRole

  • isRole(x: any): x is Role

  • Return whether the given object is a Role

    Parameters

    • x: any

    Returns x is Role

Settings

Member Visibility

On This Page

Constructors
Properties
Accessors
Methods