Documentation
¶
Overview ¶
Package aws renders the install-stacks/aws Terraform module's tfvars file for an AWS install.
Index ¶
- func ExtractAWSStandardInlinePoliciesRaw(appCfg *app.AppConfig) (provision, maintenance, deprovision string, err error)
- func ExtractAWSStandardPermissionsRaw(appCfg *app.AppConfig) (provision, maintenance, deprovision []string)
- func Render(inputs *stacks.TemplateInput, supportIAMRoleARN string) ([]byte, string, error)
- type AWSRoleRaw
- type AWSRoleTemplateInput
- type AWSSecretTemplateInput
- type AWSTemplateInput
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ExtractAWSStandardInlinePoliciesRaw ¶ added in v0.19.1049
func ExtractAWSStandardInlinePoliciesRaw(appCfg *app.AppConfig) (provision, maintenance, deprovision string, err error)
ExtractAWSStandardInlinePoliciesRaw returns the merged inline policy document for each standard operation role.
func ExtractAWSStandardPermissionsRaw ¶ added in v0.19.1049
func ExtractAWSStandardPermissionsRaw(appCfg *app.AppConfig) (provision, maintenance, deprovision []string)
ExtractAWSStandardPermissionsRaw returns the managed policy ARNs for the standard provision/maintenance/deprovision operation roles.
func Render ¶
Render emits a JSON-wrapped tfvars envelope for the install-stacks/aws module.
`supportIAMRoleARN` is the Nuon control-plane IAM role ARN that the operation roles (provision/maintenance/deprovision/break-glass/custom) must trust. Sourced from the ctl-api `runner_default_support_iam_role_arn` config — same value the CFN role-builder uses
Custom nested stacks (CloudFormation customer extensions) are intentionally not translated. Vendors who extend their CFN stack with custom resources are expected to fork install-stacks and make equivalent Terraform changes there.
Types ¶
type AWSRoleRaw ¶ added in v0.19.1049
AWSRoleRaw is the un-rendered per-role payload the stack SDK consumes: an operation/break-glass/custom role's merged inline policy and managed policy ARNs, without the CloudFormation-specific wrapping.
func ExtractAWSRolesFromListRaw ¶ added in v0.19.1049
func ExtractAWSRolesFromListRaw(roles []app.AppAWSIAMRoleConfig) ([]AWSRoleRaw, error)
ExtractAWSRolesFromListRaw returns the raw payload for a list of break-glass or custom AWS roles, skipping non-AWS and empty roles.
type AWSRoleTemplateInput ¶
type AWSRoleTemplateInput struct {
Name string
Permissions string
InlinePolicyDocument string
ManagedPolicyArns string
}
AWSRoleTemplateInput holds the per-role data rendered into the template.
type AWSSecretTemplateInput ¶
AWSSecretTemplateInput holds a non-auto-gen secret definition for the template.
type AWSTemplateInput ¶
type AWSTemplateInput struct {
*stacks.TemplateInput
ControlPlaneAccountIDs string
ProvisionPermissions string
MaintenancePermissions string
DeprovisionPermissions string
ProvisionInlinePolicyDocument string
MaintenanceInlinePolicyDocument string
DeprovisionInlinePolicyDocument string
ProvisionManagedPolicyArns string
MaintenanceManagedPolicyArns string
DeprovisionManagedPolicyArns string
BreakGlassRoles []AWSRoleTemplateInput
CustomRoles []AWSRoleTemplateInput
InstallInputs []string
AutoGenerateSecrets []string
Secrets []AWSSecretTemplateInput
}
AWSTemplateInput extends TemplateInput with pre-marshaled AWS IAM data.
Source Files