ResourcePolicy

Source: src/AWS/AMP/ResourcePolicy.ts

The resource-based policy of an Amazon Managed Service for Prometheus workspace — grants cross-account or fine-grained same-account access to the workspace’s data plane (remote-write, query). A workspace has at most one.

Creating a Resource Policy

const workspace = yield* AMP.Workspace("Metrics", {});
const policy = yield* AMP.ResourcePolicy("Sharing", {
  workspaceId: workspace.workspaceId,
  policyDocument: JSON.stringify({
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: "arn:aws:iam::123456789012:root" },
        Action: ["aps:QueryMetrics"],
        Resource: workspace.workspaceArn,
      },
    ],
  }),
});