34 lines
696 B
Python
34 lines
696 B
Python
import json
|
|
|
|
import pulumi_aws as aws
|
|
|
|
from dch_cloud.config import config
|
|
|
|
|
|
admin_role_trust_policy = {
|
|
'Version': '2012-10-17',
|
|
'Statement': [
|
|
{
|
|
'Effect': 'Allow',
|
|
'Principal': {
|
|
'AWS': 'arn:aws:iam::566967686773:root',
|
|
},
|
|
'Action': 'sts:AssumeRole',
|
|
'Condition': {},
|
|
}
|
|
],
|
|
}
|
|
|
|
if source_ip := config.get('source_ip'):
|
|
admin_role_trust_policy['Statement'][0]['Condition'] = {
|
|
'IpAddress': {
|
|
'aws:SourceIp': f'{source_ip}/32',
|
|
}
|
|
}
|
|
|
|
admin_role = aws.iam.Role(
|
|
'admin_role',
|
|
name='admin',
|
|
assume_role_policy=json.dumps(admin_role_trust_policy),
|
|
)
|