IAMRole | Praxis resources

Resource definition

What this resource looks like

This is the CUE shape a Praxis template uses to declare a IAMRole. The resource key is local to the template; metadata.name supplies its stable Praxis identity.

resources: appRole: {
  apiVersion: "praxis.io/alpha"
  kind: "IAMRole"
  metadata: {name: "payments-api", labels: {}}
  spec: {
    path: "/services/"
    assumeRolePolicyDocument: json.Marshal({
      Version: "2012-10-17"
      Statement: [{
        Effect: "Allow"
        Principal: Service: "ec2.amazonaws.com"
        Action: "sts:AssumeRole"
      }]
    })
    inlinePolicies: {}
    tags: environment: "prod"
  }
}

Complete examples in the repository

stacks data source multi stacks end to end stacks saas platform

Desired state

Configuration

The spec block accepts 8 fields. 3 are required by the schema; fields with defaults can be omitted.

pathOptional

Path.

string | *"/"

EnumDefault "/"

assumeRolePolicyDocumentRequired

Assume Role Policy Document.

string

String

descriptionOptional

Description.

string

String

maxSessionDurationOptional

Max Session Duration.

int & >=3600 & <=43200 | *3600

IntegerDefault 3600

permissionsBoundaryOptional

Permissions Boundary.

string

String

inlinePoliciesRequired

Inline Policies.

[string]: string

Map

managedPolicyArnsOptional

Managed Policy Arns.

[...string] | *[]

ListDefault []

tagsRequired

Tags.

[string]: string

Map

Observed values

Outputs

Praxis records these values after observation. A dependent resource can read one with ${resources.<name>.outputs.<field>}.

arnString

roleIdString

roleNameString

Read without ownership

Data-source lookup

A data block reads an existing IAMRole and exposes its outputs without storing lifecycle state. The generic filter surface accepts id, name, and tag; supported combinations depend on the AWS identity used by this resource.

data: existing: {
  kind: "IAMRole"
  filter: {
    name: "replace-with-provider-name"
  }
}

Documented selectorsidnametag

Understand data sources and filters →

Adopt existing infrastructure

Import

Import persists Praxis state for an existing AWS resource. For this kind, supply: Role name or role ARN. The example starts in observed mode so Praxis reports drift without correcting it.

praxis import IAMRole \
  --id <provider-identifier> \
  --account production \
  --observe

Choose managed or observed ownership →

Canonical contract

Complete CUE schema

The field guide above is derived from this definition. The schema remains the source of truth for accepted values, defaults, validation constraints, and outputs in the current alpha revision.

Show the complete schema

package iam

#IAMRole: {
	apiVersion: "praxis.io/alpha"
	kind:       "IAMRole"

	metadata: {
		name: string & =~"^[a-zA-Z0-9+=,.@_-]{1,64}$"
		labels: [string]: string
	}

	spec: {
		path:                     string | *"/"
		assumeRolePolicyDocument: string
		description?:             string
		maxSessionDuration:       int & >=3600 & <=43200 | *3600
		permissionsBoundary?:     string
		inlinePolicies: [string]: string
		managedPolicyArns: [...string] | *[]
		tags: [string]: string
	}

	outputs?: {
		arn:      string
		roleId:   string
		roleName: string
	}
}

View this schema on GitHub →