aws-cdk-lib.aws_iam.PolicyDocumentProps

interface PolicyDocumentProps

LanguageType name
.NETAmazon.CDK.AWS.IAM.PolicyDocumentProps
Gogithub.com/aws/aws-cdk-go/awscdk/v2/awsiam#PolicyDocumentProps
Javasoftware.amazon.awscdk.services.iam.PolicyDocumentProps
Pythonaws_cdk.aws_iam.PolicyDocumentProps
TypeScript (source)aws-cdk-lib » aws_iam » PolicyDocumentProps

Properties for a new PolicyDocument.

Example

import * as iam from 'aws-cdk-lib/aws-iam';

const myFileSystemPolicy = new iam.PolicyDocument({
  statements: [new iam.PolicyStatement({
    actions: [
      'elasticfilesystem:ClientWrite',
      'elasticfilesystem:ClientMount',
    ],
    principals: [new iam.AccountRootPrincipal()],
    resources: ['*'],
    conditions: {
      Bool: {
        'elasticfilesystem:AccessedViaMountTarget': 'true',
      },
    },
  })],
});

const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
  vpc: new ec2.Vpc(this, 'VPC'),
  fileSystemPolicy: myFileSystemPolicy,
});

Properties

NameTypeDescription
assignSids?booleanAutomatically assign Statement Ids to all statements.
minimize?booleanTry to minimize the policy by merging statements.
statements?PolicyStatement[]Initial statements to add to the policy document.

assignSids?

Type: boolean (optional, default: false)

Automatically assign Statement Ids to all statements.


minimize?

Type: boolean (optional, default: false, unless the feature flag @aws-cdk/aws-iam:minimizePolicies is set)

Try to minimize the policy by merging statements.

To avoid overrunning the maximum policy size, combine statements if they produce the same result. Merging happens according to the following rules:

  • The Effect of both statements is the same
  • Neither of the statements have a 'Sid'
  • Combine Principals if the rest of the statement is exactly the same.
  • Combine Resources if the rest of the statement is exactly the same.
  • Combine Actions if the rest of the statement is exactly the same.
  • We will never combine NotPrincipals, NotResources or NotActions, because doing so would change the meaning of the policy document.

statements?

Type: PolicyStatement[] (optional, default: No statements)

Initial statements to add to the policy document.