A Role is a managed resource that represents an AWS IAM Role.
Type
CRD
Group
iam.aws.crossplane.io
Version
v1beta1
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
A RoleSpec defines the desired state of a Role.
RoleParameters define the desired state of an AWS IAM Role.
Tags. For more information about tagging, see Tagging IAM Identities (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the IAM User Guide.
THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. This field is planned to replace the DeletionPolicy field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. If both are custom, the DeletionPolicy field will be ignored. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured.
Policies for referencing.
PublishConnectionDetailsTo specifies the connection secret config which contains a name, metadata and a reference to secret store config to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource.
WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. This field is planned to be replaced in a future release in favor of PublishConnectionDetailsTo. Currently, both could be set independently and connection details would be published to both without affecting each other.
A RoleStatus represents the observed state of a Role.
RoleExternalStatus keeps the state for the external resource
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html#access-advisor_tracking-period) in the IAM User Guide.
Conditions of the resource.
somenoderole
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
name: somenoderole
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
}
tags:
- key: k2
value: v2
providerConfigRef:
name: example
ecs-task-execution-role
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
name: ecs-task-execution-role
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ecs-tasks.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
providerConfigRef:
name: example
sample-environment-role
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
name: sample-environment-role
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"airflow.amazonaws.com",
"airflow-env.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
}
]
}
providerConfigRef:
name: example
spot-fleet-tagging-role
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
name: spot-fleet-tagging-role
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "spotfleet.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
providerConfigRef:
name: example
cognito-role
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
name: cognito-role
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Federated": "cognito-identity.amazonaws.com"
},
"Action": "sts:AssumeRoleWithWebIdentity"
}
]
}
providerConfigRef:
name: example
rds-role
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
name: rds-role
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "rds.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
providerConfigRef:
name: example
batch-role
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
name: batch-role
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "batch.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
providerConfigRef:
name: example
glue-role
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
name: glue-role
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"glue.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
}
tags:
- key: k1
value: v1
providerConfigRef:
name: example
somerole
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
labels:
addToInstanceProfile: "true"
name: somerole
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com",
"eks.amazonaws.com",
"eks-fargate-pods.amazonaws.com",
"lambda.amazonaws.com",
"s3.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
}
tags:
- key: k1
value: v1
somerole
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
name: somerole
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com",
"eks.amazonaws.com",
"eks-fargate-pods.amazonaws.com",
"lambda.amazonaws.com",
"s3.amazonaws.com",
"rds.amazonaws.com",
"dax.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
}
tags:
- key: k1
value: v1
providerConfigRef:
name: example
ecsinstance-role
apiVersion: iam.aws.crossplane.io/v1beta1
kind: Role
metadata:
labels:
addToInstanceProfile: "true"
name: ecsinstance-role
spec:
forProvider:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
providerConfigRef:
name: example