Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change policyArns in RoleWithPolicyArgs to accept eventual types #1276

Draft
wants to merge 4 commits into
base: master
Choose a base branch
from
+40 −28
Draft

Change policyArns in RoleWithPolicyArgs to accept eventual types #1276

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c172b48
Change policyArns in RoleWithPolicyArgs to accept eventual types
flostadler Apr 24, 2024
0fd04cb
policyArns schema change from plain to eventual type
flostadler Apr 24, 2024
96d6963
Regenerate SDK
flostadler Apr 24, 2024
2a018c9
linting
flostadler Apr 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 15 additions & 9 deletions awsx/role.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ export function defaultRoleWithPolicies(
): {
roleArn?: pulumi.Output<string>;
role?: aws.iam.Role;
policies?: aws.iam.RolePolicyAttachment[];
policies?: pulumi.Output<aws.iam.RolePolicyAttachment[]>;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought there was some magic way to do this change for the SDKs while still receiving un-wrapped values in the provider but I may be mistaken. If this works it's good.

I slightly worry about provisioning resources under apply inside the component resource, but I might need some platform team help to find references to how this works.

https://www.pulumi.com/docs/concepts/resources/components/#registering-component-outputs

Normally there is a call registerOutputs at the end of the constructor.

We don't seem to be calling it for ec2TaskDefinition:

https://github.com/pulumi/pulumi-awsx/blob/master/awsx/ecs/ec2TaskDefinition.ts#L32

If we're doing apply then children may register out-of-order that is after the component resource is done constructing and I vaguely recall this may cause bugs.

} {
if (inputs?.roleArn !== undefined && inputs?.args !== undefined) {
throw new Error("Can't define role args if specified an existing role ARN");
Expand All @@ -90,13 +90,19 @@ export function defaultRoleWithPolicies(
delete roleArgs.policyArns;

const role = new aws.iam.Role(name, roleArgs, opts);
const policies = args.policyArns?.map(
(policyArn) =>
new aws.iam.RolePolicyAttachment(
`${name}-${utils.sha1hash(policyArn)}`,
{ role: role.name, policyArn },
opts,
),
);

const policies = args.policyArns
? pulumi.Output.create(args.policyArns).apply((unwrapped) =>
unwrapped.map(
(policyArn) =>
new aws.iam.RolePolicyAttachment(
`${name}-${utils.sha1hash(policyArn)}`,
{ role: role.name, policyArn },
opts,
),
),
)
: undefined;

return { role, policies, roleArn: role.arn };
}
4 changes: 2 additions & 2 deletions awsx/schema-types.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -525,7 +525,7 @@ export interface RoleWithPolicyInputs {
readonly namePrefix?: pulumi.Input<string>;
readonly path?: pulumi.Input<string>;
readonly permissionsBoundary?: pulumi.Input<string>;
readonly policyArns?: string[];
readonly policyArns?: pulumi.Input<pulumi.Input<string>[]>;
readonly tags?: pulumi.Input<Record<string, pulumi.Input<string>>>;
}
export interface RoleWithPolicyOutputs {
Expand All @@ -538,7 +538,7 @@ export interface RoleWithPolicyOutputs {
readonly namePrefix?: pulumi.Output<string>;
readonly path?: pulumi.Output<string>;
readonly permissionsBoundary?: pulumi.Output<string>;
readonly policyArns?: string[];
readonly policyArns?: pulumi.Output<string[]>;
readonly tags?: pulumi.Output<Record<string, string>>;
}
export interface SecurityGroupInputs {
Expand Down
4 changes: 1 addition & 3 deletions schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -438,10 +438,8 @@
"policyArns": {
"type": "array",
"items": {
"type": "string",
"plain": true
"type": "string"
},
"plain": true,
"description": "ARNs of the policies to attach to the created role."
},
"tags": {
Expand Down
2 changes: 0 additions & 2 deletions schemagen/pkg/gen/iam.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,7 @@ func roleWithPolicyArgs(awsSpec schema.PackageSpec) schema.ComplexTypeSpec {
Type: "array",
Items: &schema.TypeSpec{
Type: "string",
Plain: true,
},
Plain: true,
},
}

Expand Down
6 changes: 3 additions & 3 deletions sdk/dotnet/Awsx/Inputs/RoleWithPolicyArgs.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,14 +78,14 @@ public InputList<string> ManagedPolicyArns
public Input<string>? PermissionsBoundary { get; set; }

[Input("policyArns")]
private List<string>? _policyArns;
private InputList<string>? _policyArns;

/// <summary>
/// ARNs of the policies to attach to the created role.
/// </summary>
public List<string> PolicyArns
public InputList<string> PolicyArns
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

public sealed class InputList<T> : Input<ImmutableArray<T>>, IEnumerable, IAsyncEnumerable<Input<T>>

This is breaking I think.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think dotnet has an implict conversion from List<T> to InputList<T>

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will try it out just to be sure. I was also under the impression, but better safe than sorry.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh that's true, I forgot about implicit conversions. That may be nice.

{
get => _policyArns ?? (_policyArns = new List<string>());
get => _policyArns ?? (_policyArns = new InputList<string>());
set => _policyArns = value;
}

Expand Down
2 changes: 1 addition & 1 deletion sdk/go/awsx/awsx/pulumiTypes.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 13 additions & 3 deletions sdk/java/src/main/java/com/pulumi/awsx/awsx/inputs/RoleWithPolicyArgs.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,13 +156,13 @@ public Optional<Output<String>> permissionsBoundary() {
*
*/
@Import(name="policyArns")
private @Nullable List<String> policyArns;
private @Nullable Output<List<String>> policyArns;

/**
* @return ARNs of the policies to attach to the created role.
*
*/
public Optional<List<String>> policyArns() {
public Optional<Output<List<String>>> policyArns() {
return Optional.ofNullable(this.policyArns);
}

Expand Down Expand Up @@ -412,11 +412,21 @@ public Builder permissionsBoundary(String permissionsBoundary) {
* @return builder
*
*/
public Builder policyArns(@Nullable List<String> policyArns) {
public Builder policyArns(@Nullable Output<List<String>> policyArns) {
$.policyArns = policyArns;
return this;
}

/**
* @param policyArns ARNs of the policies to attach to the created role.
*
* @return builder
*
*/
public Builder policyArns(List<String> policyArns) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not breaking because a new overload is generated with the same sig.

return policyArns(Output.of(policyArns));
}

/**
* @param policyArns ARNs of the policies to attach to the created role.
*
Expand Down
2 changes: 1 addition & 1 deletion sdk/nodejs/types/input.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,7 +310,7 @@ export namespace awsx {
/**
* ARNs of the policies to attach to the created role.
*/
policyArns?: string[];
policyArns?: pulumi.Input<pulumi.Input<string>[]>;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suspect TypeScript has enough magic this is not breaking.

Copy link
Contributor Author

@flostadler flostadler Apr 24, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah in typescript it is fine because Input is a type alias for T | Promise<T> | OutputInstance<T>

/**
* Key-value mapping of tags for the IAM role. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
*/
Expand Down
8 changes: 4 additions & 4 deletions sdk/python/pulumi_awsx/awsx/_inputs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -878,7 +878,7 @@ def __init__(__self__, *,
name_prefix: Optional[pulumi.Input[str]] = None,
path: Optional[pulumi.Input[str]] = None,
permissions_boundary: Optional[pulumi.Input[str]] = None,
policy_arns: Optional[Sequence[str]] = None,
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None):
"""
The set of arguments for constructing a Role resource and Policy attachments.
Expand All @@ -890,7 +890,7 @@ def __init__(__self__, *,
:param pulumi.Input[str] name_prefix: Creates a unique friendly name beginning with the specified prefix. Conflicts with `name`.
:param pulumi.Input[str] path: Path to the role. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) for more information.
:param pulumi.Input[str] permissions_boundary: ARN of the policy that is used to set the permissions boundary for the role.
:param Sequence[str] policy_arns: ARNs of the policies to attach to the created role.
:param pulumi.Input[Sequence[pulumi.Input[str]]] policy_arns: ARNs of the policies to attach to the created role.
:param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: Key-value mapping of tags for the IAM role. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
"""
if description is not None:
Expand Down Expand Up @@ -1023,14 +1023,14 @@ def permissions_boundary(self, value: Optional[pulumi.Input[str]]):

@property
@pulumi.getter(name="policyArns")
def policy_arns(self) -> Optional[Sequence[str]]:
def policy_arns(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
"""
ARNs of the policies to attach to the created role.
"""
return pulumi.get(self, "policy_arns")

@policy_arns.setter
def policy_arns(self, value: Optional[Sequence[str]]):
def policy_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
pulumi.set(self, "policy_arns", value)

@property
Expand Down
Loading