Pulumi IaC IAM Infrastructure Role

index.ts

import * as aws from '@pulumi/aws';

const defaultTags = { Creator: 'pulumi' };

const awsAccountId = pulumi.output(aws.getCallerIdentity()).accountId;

const infrastructureRole = new aws.iam.Role('infrastructure', {
  name: 'infrastructure',
  assumeRolePolicy: {
    Version: '2012-10-17',
    Statement: [{
      Effect: 'Allow',
      Action: 'sts:AssumeRole',
      Principal: {
        AWS: pulumi.interpolate`${awsAccountId}`,
      }
    }],
  },
  tags: defaultTags,
})

new aws.iam.RolePolicyAttachment('infrastructure-admin', {
  role: infrastructureRole.name,
  policyArn: aws.iam.getPolicyOutput({ name: 'SystemAdministrator'}).arn,
});
new aws.iam.RolePolicyAttachment('infrastructure-iam', {
  role: infrastructureRole.name,
  policyArn: aws.iam.getPolicyOutput({ name: 'IAMFullAccess' }).arn,
});