pythonamazon-web-servicespulumipulumi-python

How to get AWS Managed Policy using Python Pulumi


I'm trying to create an AWS Glue Role run the service properly. I want to use the AWS Managed role AWSGlueServiceRole using the following code:

import json
from pulumi_aws import iam
from pulumi_aws.iam import Role

def get_access_bucket_role(role_name: str, bucket_name: str, tags) -> Role:
        assume_role_policy = json.dumps(
            {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {"Service": ["glue.amazonaws.com"]},
                        "Action": "sts:AssumeRole",
                    }
                ],
            }
        )
        iam.get_policy
        return iam.Role(
            role_name,
            assume_role_policy=assume_role_policy,
            inline_policies=iam.get_policy(arn="arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole"),
            path="/my-path/",
            permissions_boundary="arn:aws:iam::XXX:policy/my-boundary",
            tags=tags,
        )

However I'm getting the following error when the code try to get iam.get_policy() function:

AttributeError: 'NoneType' object has no attribute 'Invoke'

Am I missing something? How to create this policy properly?


Solution

  • You can't attach a managed policy as an inline policy. Also inline_policies is expecting only a name and json formatted policy: https://www.pulumi.com/registry/packages/aws/api-docs/iam/role/#supporting-types

    get_policy is returning a pulumi object with a number of other properties: https://www.pulumi.com/registry/packages/aws/api-docs/iam/getpolicy/#result

    The path of least resistance here is to attach AWSGlueServiceRole to your role as a managed policy e.g:

    aws.iam.RolePolicyAttachment("PolicyAttachment",
        role=YourRole.name,
        policy_arn="arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole",
    )