aws-cdk-lib.aws_iam.CompositePrincipal

class CompositePrincipal

LanguageType name
.NETAmazon.CDK.AWS.IAM.CompositePrincipal
Gogithub.com/aws/aws-cdk-go/awscdk/v2/awsiam#CompositePrincipal
Javasoftware.amazon.awscdk.services.iam.CompositePrincipal
Pythonaws_cdk.aws_iam.CompositePrincipal
TypeScript (source)aws-cdk-lib » aws_iam » CompositePrincipal

Implements IAssumeRolePrincipal, IGrantable, IPrincipal, IComparablePrincipal

Extends PrincipalBase

Represents a principal that has multiple types of principals.

A composite principal cannot have conditions. i.e. multiple ServicePrincipals that form a composite principal

Example

declare const build: gamelift.Build;
const role = new iam.Role(this, 'Role', {
  assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal('gamelift.amazonaws.com'))
});
role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('CloudWatchAgentServerPolicy'));

const fleet = new gamelift.BuildFleet(this, 'Game server fleet', {
  fleetName: 'test-fleet',
  content: build,
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.C5, ec2.InstanceSize.LARGE),
  runtimeConfiguration: {
    serverProcesses: [{
      launchPath: '/local/game/GameLiftExampleServer.x86_64',
    }]
  },
  role: role
});

// Actions can also be grantted through dedicated method
fleet.grant(role, 'gamelift:ListFleets');

Initializer

new CompositePrincipal(...principals: IPrincipal[])

Parameters

  • principals IPrincipal

Properties

NameTypeDescription
assumeRoleActionstringWhen this Principal is used in an AssumeRole policy, the action to use.
grantPrincipalIPrincipalThe principal to grant permissions to.
policyFragmentPrincipalPolicyFragmentReturn the policy fragment that identifies this principal in a Policy.
principalAccount?stringThe AWS account ID of this principal.

assumeRoleAction

Type: string

When this Principal is used in an AssumeRole policy, the action to use.


grantPrincipal

Type: IPrincipal

The principal to grant permissions to.


policyFragment

Type: PrincipalPolicyFragment

Return the policy fragment that identifies this principal in a Policy.


principalAccount?

Type: string (optional)

The AWS account ID of this principal.

Can be undefined when the account is not known (for example, for service principals). Can be a Token - in that case, it's assumed to be AWS::AccountId.

Methods

NameDescription
addPrincipals(...principals)Adds IAM principals to the composite principal.
addToAssumeRolePolicy(doc)Add the principal to the AssumeRolePolicyDocument.
addToPolicy(statement)Add to the policy of this principal.
addToPrincipalPolicy(_statement)Add to the policy of this principal.
dedupeString()Return whether or not this principal is equal to the given principal.
toJSON()JSON-ify the principal.
toString()Returns a string representation of an object.
withConditions(conditions)Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added.
withSessionTags()Returns a new principal using this principal as the base, with session tags enabled.

addPrincipals(...principals)

public addPrincipals(...principals: IPrincipal[]): CompositePrincipal

Parameters

  • principals IPrincipal — IAM principals that will be added to the composite principal.

Returns

  • CompositePrincipal

Adds IAM principals to the composite principal.

Composite principals cannot have conditions.


addToAssumeRolePolicy(doc)

public addToAssumeRolePolicy(doc: PolicyDocument): void

Parameters

  • doc PolicyDocument

Add the principal to the AssumeRolePolicyDocument.

Add the statements to the AssumeRolePolicyDocument necessary to give this principal permissions to assume the given role.


addToPolicy(statement)

public addToPolicy(statement: PolicyStatement): boolean

Parameters

  • statement PolicyStatement

Returns

  • boolean

Add to the policy of this principal.


addToPrincipalPolicy(_statement)

public addToPrincipalPolicy(_statement: PolicyStatement): AddToPrincipalPolicyResult

Parameters

  • _statement PolicyStatement

Returns

  • AddToPrincipalPolicyResult

Add to the policy of this principal.


dedupeString()

public dedupeString(): string

Returns

  • string

Return whether or not this principal is equal to the given principal.


toJSON()

public toJSON(): { [string]: string[] }

Returns

  • { [string]: string[] }

JSON-ify the principal.

Used when JSON.stringify() is called


toString()

public toString(): string

Returns

  • string

Returns a string representation of an object.


withConditions(conditions)

public withConditions(conditions: { [string]: any }): PrincipalBase

Parameters

  • conditions { [string]: any }

Returns

  • PrincipalBase

Returns a new PrincipalWithConditions using this principal as the base, with the passed conditions added.

When there is a value for the same operator and key in both the principal and the conditions parameter, the value from the conditions parameter will be used.


withSessionTags()

public withSessionTags(): PrincipalBase

Returns

  • PrincipalBase

Returns a new principal using this principal as the base, with session tags enabled.