1 | import { Resource, SecretValue } from '@aws-cdk/core';
|
2 | import { Construct } from 'constructs';
|
3 | import { IGroup } from './group';
|
4 | import { IIdentity } from './identity-base';
|
5 | import { IManagedPolicy } from './managed-policy';
|
6 | import { Policy } from './policy';
|
7 | import { PolicyStatement } from './policy-statement';
|
8 | import { AddToPrincipalPolicyResult, IPrincipal, PrincipalPolicyFragment } from './principals';
|
9 | /**
|
10 | * Represents an IAM user
|
11 | *
|
12 | * @see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html
|
13 | */
|
14 | export interface IUser extends IIdentity {
|
15 | /**
|
16 | * The user's name
|
17 | * @attribute
|
18 | */
|
19 | readonly userName: string;
|
20 | /**
|
21 | * The user's ARN
|
22 | * @attribute
|
23 | */
|
24 | readonly userArn: string;
|
25 | /**
|
26 | * Adds this user to a group.
|
27 | */
|
28 | addToGroup(group: IGroup): void;
|
29 | }
|
30 | /**
|
31 | * Properties for defining an IAM user
|
32 | */
|
33 | export interface UserProps {
|
34 | /**
|
35 | * Groups to add this user to. You can also use `addToGroup` to add this
|
36 | * user to a group.
|
37 | *
|
38 | * @default - No groups.
|
39 | */
|
40 | readonly groups?: IGroup[];
|
41 | /**
|
42 | * A list of managed policies associated with this role.
|
43 | *
|
44 | * You can add managed policies later using
|
45 | * `addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName(policyName))`.
|
46 | *
|
47 | * @default - No managed policies.
|
48 | */
|
49 | readonly managedPolicies?: IManagedPolicy[];
|
50 | /**
|
51 | * The path for the user name. For more information about paths, see IAM
|
52 | * Identifiers in the IAM User Guide.
|
53 | *
|
54 | * @default /
|
55 | */
|
56 | readonly path?: string;
|
57 | /**
|
58 | * AWS supports permissions boundaries for IAM entities (users or roles).
|
59 | * A permissions boundary is an advanced feature for using a managed policy
|
60 | * to set the maximum permissions that an identity-based policy can grant to
|
61 | * an IAM entity. An entity's permissions boundary allows it to perform only
|
62 | * the actions that are allowed by both its identity-based policies and its
|
63 | * permissions boundaries.
|
64 | *
|
65 | * @link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-permissionsboundary
|
66 | * @link https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html
|
67 | *
|
68 | * @default - No permissions boundary.
|
69 | */
|
70 | readonly permissionsBoundary?: IManagedPolicy;
|
71 | /**
|
72 | * A name for the IAM user. For valid values, see the UserName parameter for
|
73 | * the CreateUser action in the IAM API Reference. If you don't specify a
|
74 | * name, AWS CloudFormation generates a unique physical ID and uses that ID
|
75 | * for the user name.
|
76 | *
|
77 | * If you specify a name, you cannot perform updates that require
|
78 | * replacement of this resource. You can perform updates that require no or
|
79 | * some interruption. If you must replace the resource, specify a new name.
|
80 | *
|
81 | * If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to
|
82 | * acknowledge your template's capabilities. For more information, see
|
83 | * Acknowledging IAM Resources in AWS CloudFormation Templates.
|
84 | *
|
85 | * @default - Generated by CloudFormation (recommended)
|
86 | */
|
87 | readonly userName?: string;
|
88 | /**
|
89 | * The password for the user. This is required so the user can access the
|
90 | * AWS Management Console.
|
91 | *
|
92 | * You can use `SecretValue.unsafePlainText` to specify a password in plain text or
|
93 | * use `secretsmanager.Secret.fromSecretAttributes` to reference a secret in
|
94 | * Secrets Manager.
|
95 | *
|
96 | * @default - User won't be able to access the management console without a password.
|
97 | */
|
98 | readonly password?: SecretValue;
|
99 | /**
|
100 | * Specifies whether the user is required to set a new password the next
|
101 | * time the user logs in to the AWS Management Console.
|
102 | *
|
103 | * If this is set to 'true', you must also specify "initialPassword".
|
104 | *
|
105 | * @default false
|
106 | */
|
107 | readonly passwordResetRequired?: boolean;
|
108 | }
|
109 | /**
|
110 | * Represents a user defined outside of this stack.
|
111 | */
|
112 | export interface UserAttributes {
|
113 | /**
|
114 | * The ARN of the user.
|
115 | *
|
116 | * Format: arn:<partition>:iam::<account-id>:user/<user-name-with-path>
|
117 | */
|
118 | readonly userArn: string;
|
119 | }
|
120 | /**
|
121 | * Define a new IAM user
|
122 | */
|
123 | export declare class User extends Resource implements IIdentity, IUser {
|
124 | /**
|
125 | * Import an existing user given a username.
|
126 | *
|
127 | * @param scope construct scope
|
128 | * @param id construct id
|
129 | * @param userName the username of the existing user to import
|
130 | */
|
131 | static fromUserName(scope: Construct, id: string, userName: string): IUser;
|
132 | /**
|
133 | * Import an existing user given a user ARN.
|
134 | *
|
135 | * If the ARN comes from a Token, the User cannot have a path; if so, any attempt
|
136 | * to reference its username will fail.
|
137 | *
|
138 | * @param scope construct scope
|
139 | * @param id construct id
|
140 | * @param userArn the ARN of an existing user to import
|
141 | */
|
142 | static fromUserArn(scope: Construct, id: string, userArn: string): IUser;
|
143 | /**
|
144 | * Import an existing user given user attributes.
|
145 | *
|
146 | * If the ARN comes from a Token, the User cannot have a path; if so, any attempt
|
147 | * to reference its username will fail.
|
148 | *
|
149 | * @param scope construct scope
|
150 | * @param id construct id
|
151 | * @param attrs the attributes of the user to import
|
152 | */
|
153 | static fromUserAttributes(scope: Construct, id: string, attrs: UserAttributes): IUser;
|
154 | readonly grantPrincipal: IPrincipal;
|
155 | readonly principalAccount: string | undefined;
|
156 | readonly assumeRoleAction: string;
|
157 | /**
|
158 | * An attribute that represents the user name.
|
159 | * @attribute
|
160 | */
|
161 | readonly userName: string;
|
162 | /**
|
163 | * An attribute that represents the user's ARN.
|
164 | * @attribute
|
165 | */
|
166 | readonly userArn: string;
|
167 | /**
|
168 | * Returns the permissions boundary attached to this user
|
169 | */
|
170 | readonly permissionsBoundary?: IManagedPolicy;
|
171 | readonly policyFragment: PrincipalPolicyFragment;
|
172 | private readonly groups;
|
173 | private readonly managedPolicies;
|
174 | private readonly attachedPolicies;
|
175 | private defaultPolicy?;
|
176 | constructor(scope: Construct, id: string, props?: UserProps);
|
177 | /**
|
178 | * Adds this user to a group.
|
179 | */
|
180 | addToGroup(group: IGroup): void;
|
181 | /**
|
182 | * Attaches a managed policy to the user.
|
183 | * @param policy The managed policy to attach.
|
184 | */
|
185 | addManagedPolicy(policy: IManagedPolicy): void;
|
186 | /**
|
187 | * Attaches a policy to this user.
|
188 | */
|
189 | attachInlinePolicy(policy: Policy): void;
|
190 | /**
|
191 | * Adds an IAM statement to the default policy.
|
192 | *
|
193 | * @returns true
|
194 | */
|
195 | addToPrincipalPolicy(statement: PolicyStatement): AddToPrincipalPolicyResult;
|
196 | addToPolicy(statement: PolicyStatement): boolean;
|
197 | private parseLoginProfile;
|
198 | }
|