[stack-deploy} Add assumeRolePolicyDocument

mbj · Apr 21, 2024 · f29f76a · f29f76a
1 parent a9817ad
commit f29f76a
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/stack-deploy/src/StackDeploy/Stratosphere.hs b/stack-deploy/src/StackDeploy/Stratosphere.hs
@@ -1,6 +1,7 @@
 module StackDeploy.Stratosphere
   ( allowResourcePolicy
   , assumeRole
+  , assumeRolePolicyDocument
   , dependencies
   , getAtt
   , getAttArn
@@ -72,6 +73,18 @@ assumeRole service =
     )
   ]
 
+assumeRolePolicyDocument :: CFT.Value Text -> JSON.Object
+assumeRolePolicyDocument service =
+  [ ("Version", JSON.String "2012-10-17")
+  , ("Statement"
+    , JSON.object
+      [ ("Action",   "sts:AssumeRole")
+      , ("Effect",   "Allow")
+      , ("Principal", JSON.object [("Service", JSON.toJSON service)])
+      ]
+    )
+  ]
+
 dependencies :: [CFT.Resource] -> CFT.Resource -> CFT.Resource
 dependencies deps resource =
   resource { CFT.dependsOn = pure (CFT.itemName <$> deps) }