What is @aws-cdk/aws-iam?
@aws-cdk/aws-iam is an AWS Cloud Development Kit (CDK) library that allows you to define AWS Identity and Access Management (IAM) resources in your CDK applications. This package provides constructs for creating and managing IAM roles, users, policies, and groups, enabling you to manage permissions and access control in your AWS environment programmatically.
What are @aws-cdk/aws-iam's main functionalities?
Create IAM Role
This code sample demonstrates how to create an IAM role that can be assumed by EC2 instances and has read-only access to Amazon S3.
const iam = require('@aws-cdk/aws-iam');
const cdk = require('@aws-cdk/core');
class MyStack extends cdk.Stack {
constructor(scope, id, props) {
super(scope, id, props);
new iam.Role(this, 'MyRole', {
assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonS3ReadOnlyAccess')
]
});
}
}
const app = new cdk.App();
new MyStack(app, 'MyStack');
Create IAM User
This code sample demonstrates how to create an IAM user with administrator access.
const iam = require('@aws-cdk/aws-iam');
const cdk = require('@aws-cdk/core');
class MyStack extends cdk.Stack {
constructor(scope, id, props) {
super(scope, id, props);
new iam.User(this, 'MyUser', {
userName: 'my-user',
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess')
]
});
}
}
const app = new cdk.App();
new MyStack(app, 'MyStack');
Attach Inline Policy to Role
This code sample demonstrates how to create an IAM role and attach an inline policy that allows listing objects in a specific S3 bucket.
const iam = require('@aws-cdk/aws-iam');
const cdk = require('@aws-cdk/core');
class MyStack extends cdk.Stack {
constructor(scope, id, props) {
super(scope, id, props);
const role = new iam.Role(this, 'MyRole', {
assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com')
});
role.addToPolicy(new iam.PolicyStatement({
actions: ['s3:ListBucket'],
resources: ['arn:aws:s3:::my-bucket']
}));
}
}
const app = new cdk.App();
new MyStack(app, 'MyStack');
Other packages similar to @aws-cdk/aws-iam
aws-sdk
The aws-sdk package is the official AWS SDK for JavaScript, which allows you to interact with AWS services, including IAM, using JavaScript. Unlike @aws-cdk/aws-iam, which is used for defining and deploying AWS infrastructure, aws-sdk is used for making API calls to AWS services.
serverless
The serverless framework is a toolkit for deploying and operating serverless architectures, including AWS Lambda functions and associated IAM roles and policies. It provides a higher-level abstraction compared to @aws-cdk/aws-iam and is focused on serverless applications.
terraform
Terraform is an open-source infrastructure as code software tool that provides a consistent CLI workflow to manage hundreds of cloud services, including AWS IAM. It is similar to @aws-cdk/aws-iam in that it allows you to define and manage AWS infrastructure, but it is not limited to AWS and supports multiple cloud providers.
AWS IAM Construct Library
Define a role and add permissions to it. This will automatically create and
attach an IAM policy to the role:
const role = new Role(this, 'MyRole', {
assumedBy: new ServicePrincipal('sns.amazonaws.com')
});
role.addPermission(new Permission('*', 'lambda:InvokeFunction'));
Define a policy and attach it to groups, users and roles. Note that it is possible to attach
the policy either by calling xxx.attachPolicy(policy)
or policy.attachToXxx(xxx)
.
const user = new User(this, 'MyUser', { password: '1234' });
const group = new Group(this, 'MyGroup');
const policy = new Policy(this, 'MyPolicy');
policy.attachToUser(user);
group.attachPolicy(policy);
Managed policies can be attached using xxx.attachManagedPolicy(arn)
:
const group = new Group(this, 'MyGroup');
group.attachManagedPolicy('arn:aws:iam::aws:policy/AdministratorAccess');
Features
- Policy name uniqueness is enforced. If two policies by the same name are attached to the same
principal, the attachment will fail.
- Policy names are not required - the CDK logical ID will be used and ensured to be unique.
0.9.2 (2018-09-20)
NOTICE: This release includes a framework-wide breaking change which changes the type of all the string resource attributes across the framework. Instead of using strong-types that extend cdk.Token
(such as QueueArn
, TopicName
, etc), we now represent all these attributes as normal string
s, and codify the tokens into the string (using the feature introduced in #168).
Furthermore, the cdk.Arn
type has been removed. In order to format/parse ARNs, use the static methods on cdk.ArnUtils
.
See motivation and discussion in #695.
Breaking Changes
- cfn2ts: use stringified tokens for resource attributes instead of strong types (#712) (6508f78), closes #518 #695 #744
- aws-dynamodb: Attribute type for keys, changes the signature of the
addPartitionKey
and addSortKey
methods to be consistent across the board. (#720) (e6cc189) - aws-codebuild: fix typo "priviledged" -> "privileged
Bug Fixes
Features
- aws-apigateway: new API Gateway Construct Library (#665) (b0f3857)
- aws-cdk: detect presence of EC2 credentials (#724) (8e8c295), closes #702 #130
- aws-codepipeline: make the Stage insertion API in CodePipeline more flexible (#460) (d182818)
- aws-codepipeline: new "Pipeline#addStage" convenience method (#647) (25c9fa0)
- aws-rds: add support for parameter groups (#729) (2541508), closes #719
- docs: add documentation for CDK toolkit plugings (#733) (965b918)
- dependencies: upgrade to jsii 0.7.6