Profile

Source: src/AWS/RolesAnywhere/Profile.ts

An IAM Roles Anywhere profile — the list of IAM roles that the Roles Anywhere service is trusted to assume for authenticated certificate identities, optionally intersected with managed policies and an inline session policy.

Creating a Profile

const role = yield* IAM.Role("WorkloadRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { Service: "rolesanywhere.amazonaws.com" },
        Action: ["sts:AssumeRole", "sts:TagSession", "sts:SetSourceIdentity"],
      },
    ],
  },
});
const profile = yield* RolesAnywhere.Profile("Profile", {
  roleArns: [role.roleArn],
});

Restricting the Session

const profile = yield* RolesAnywhere.Profile("Profile", {
  roleArns: [role.roleArn],
  duration: "15 minutes",
  sessionPolicy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [
      { Effect: "Allow", Action: "s3:GetObject", Resource: "*" },
    ],
  }),
});

Mapping Certificate Attributes

const profile = yield* RolesAnywhere.Profile("Profile", {
  roleArns: [role.roleArn],
  attributeMappings: [
    {
      certificateField: "x509Subject",
      mappingRules: [{ specifier: "CN" }],
    },
  ],
});