IAM

16 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

IAMGroup # GA

IAMGroup is the Schema for managing AWS IAM Groups.

kubectl get iamgroups · example on GitHub

Example

# IAMGroup — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamgroup
apiVersion: aws.konfig.io/v1alpha1
kind: IAMGroup
metadata:
  name: example-iamgroup
  namespace: default
spec:
  groupName: example-iamgroup
  path: example
  providerRef:
    name: example-iamgroup
    region: us-east-1

Spec

Field	Type	Required	Description
`groupName`	string	yes	GroupName is the name of the IAM group.
`path`	string	—	Path is the IAM path for the group.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the IAM group.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`groupId`	string	—	GroupID is the stable and unique identifier of the IAM group.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

IAMGroupMembership # GA

IAMGroupMembership is the Schema for adding AWS IAM users to groups.

kubectl get iamgroupmemberships · example on GitHub

Example

# IAMGroupMembership — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamgroupmembership
apiVersion: aws.konfig.io/v1alpha1
kind: IAMGroupMembership
metadata:
  name: example-iamgroupmembership
  namespace: default
spec:
  groupRef:
    groupName: example-iamgroupmembership
    name: example-iamgroupmembership
  providerRef:
    name: example-iamgroupmembership
    region: us-east-1
  userRef:
    name: example-iamgroupmembership
    userName: example-iamgroupmembership

Spec

Field	Type	Required	Description
`groupRef`	object	yes	GroupRef references the IAMGroup CR or a direct AWS group name.
`groupRef.groupName`	string	—	GroupName is a direct AWS IAM group name, bypassing CR lookup.
`groupRef.name`	string	—	Name of an IAMGroup CR in the same namespace.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`userRef`	object	yes	UserRef references the IAMUser CR or a direct AWS user name.
`userRef.name`	string	—	Name of an IAMUser CR in the same namespace.
`userRef.userName`	string	—	UserName is a direct AWS IAM user name, bypassing CR lookup.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`member`	boolean	—	Member indicates whether the user is currently a member of the group.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

IAMGroupPolicy # CLOUD CONTROL · AWS::IAM::GroupPolicy

IAMGroupPolicy manages AWS::IAM::GroupPolicy through the AWS Cloud Control API.

kubectl get iamgrouppolicies · example on GitHub

Example

# IAMGroupPolicy — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamgrouppolicy
apiVersion: aws.konfig.io/v1alpha1
kind: IAMGroupPolicy
metadata:
  name: example-iamgrouppolicy
  namespace: default
spec:
  groupName: example-iamgrouppolicy
  policyName: example-iamgrouppolicy
  providerRef:
    name: example-iamgrouppolicy
    region: us-east-1

Spec

Field	Type	Required	Description
`groupName`	string	yes	The name of the group to associate the policy with.
`policyDocument`	object	—	The policy document.
`policyName`	string	yes	The name of the policy document.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

IAMGroupPolicyAttachment # GA

IAMGroupPolicyAttachment is the Schema for attaching AWS IAM policies to groups.

kubectl get iamgrouppolicyattachments · example on GitHub

Example

# IAMGroupPolicyAttachment — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamgrouppolicyattachment
apiVersion: aws.konfig.io/v1alpha1
kind: IAMGroupPolicyAttachment
metadata:
  name: example-iamgrouppolicyattachment
  namespace: default
spec:
  groupRef:
    groupName: example-iamgrouppolicyattachment
    name: example-iamgrouppolicyattachment
  policyRef:
    name: example-policy
  providerRef:
    name: example-iamgrouppolicyattachment
    region: us-east-1

Spec

Field	Type	Required	Description
`groupRef`	object	yes	GroupRef references the IAMGroup CR or a direct AWS group name.
`groupRef.groupName`	string	—	GroupName is a direct AWS IAM group name, bypassing CR lookup.
`groupRef.name`	string	—	Name of an IAMGroup CR in the same namespace.
`policyRef`	object	yes	PolicyRef references the IAMPolicy CR or a direct AWS policy ARN.
`policyRef.arn`	string	—	ARN is a direct AWS policy ARN (e.g.
`policyRef.name`	string	—	Name of an IAMPolicy CR in the same namespace.
`policyRef.namespace`	string	—	Namespace of the IAMPolicy CR.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attached`	boolean	—	Attached indicates whether the policy is currently attached to the group.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`groupName`	string	—	GroupName is the resolved IAM group name.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`policyArn`	string	—	PolicyARN is the resolved IAM policy ARN.

IAMInstanceProfile # GA

IAMInstanceProfile is the Schema for managing IAM instance profiles.

kubectl get iaminstanceprofiles · example on GitHub

Example

# IAMInstanceProfile — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iaminstanceprofile
apiVersion: aws.konfig.io/v1alpha1
kind: IAMInstanceProfile
metadata:
  name: example-iaminstanceprofile
  namespace: default
spec:
  instanceProfileName: example-iaminstanceprofile
  path: example
  providerRef:
    name: example-iaminstanceprofile
    region: us-east-1
  roleRef:
    name: example-role
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`instanceProfileName`	string	yes	InstanceProfileName is the name of the instance profile.
`path`	string	—	Path for the instance profile.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleRef`	object	—	RoleRef references the IAM role to add to the profile (by IAMRole CR name or direct ARN).
`roleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`roleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`roleRef.namespace`	string	—	Namespace of the IAMRole CR.
`tags`	map<string>	—	Tags are AWS resource tags to apply on creation.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the instance profile.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`roleName`	string	—	RoleName is the name of the role currently attached to the profile.

IAMOIDCProvider # GA

IAMOIDCProvider is the Schema for managing AWS IAM OIDC Providers.

kubectl get iamoidcproviders · example on GitHub

Example

# IAMOIDCProvider — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamoidcprovider
apiVersion: aws.konfig.io/v1alpha1
kind: IAMOIDCProvider
metadata:
  name: example-iamoidcprovider
  namespace: default
spec:
  clientIDList:
  - example
  providerRef:
    name: example-iamoidcprovider
    region: us-east-1
  tags:
    environment: dev
    team: platform
  thumbprintList:
  - example
  url: example

Spec

Field	Type	Required	Description
`clientIDList`	array<string>	yes	ClientIDList is the list of client IDs (audiences) registered for the provider.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the OIDC provider.
`thumbprintList`	array<string>	yes	ThumbprintList is the list of SHA-1 thumbprints of the IdP certificate chain.
`url`	string	yes	URL is the OIDC issuer URL.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the OIDC provider.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

IAMPolicy # GA

IAMPolicy is the Schema for managing AWS IAM managed policies.

kubectl get iampolicies · example on GitHub

Example

# IAMPolicy — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iampolicy
apiVersion: aws.konfig.io/v1alpha1
kind: IAMPolicy
metadata:
  name: example-iampolicy
  namespace: default
spec:
  description: Managed by konfig-konector
  path: example
  policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  policyName: example-iampolicy
  providerRef:
    name: example-iampolicy
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—	Description is a description of the policy.
`path`	string	—	Path is the IAM path for the policy.
`policyDocument`	string	yes	PolicyDocument is the JSON IAM policy document.
`policyName`	string	yes	PolicyName is the name of the IAM policy.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the policy.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the IAM policy.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`defaultVersionId`	string	—	DefaultVersionID is the current default version of the policy document.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`policyId`	string	—	PolicyID is the stable and unique identifier of the IAM policy.

IAMPolicyAttachment # GA

IAMPolicyAttachment is the Schema for attaching AWS IAM policies to roles.

kubectl get iampolicyattachments · example on GitHub

Example

# IAMPolicyAttachment — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iampolicyattachment
apiVersion: aws.konfig.io/v1alpha1
kind: IAMPolicyAttachment
metadata:
  name: example-iampolicyattachment
  namespace: default
spec:
  policyRef:
    name: example-policy
  providerRef:
    name: example-iampolicyattachment
    region: us-east-1
  roleRef:
    name: example-role

Spec

Field	Type	Required	Description
`policyRef`	object	yes	PolicyRef references the IAMPolicy CR or a direct AWS policy ARN.
`policyRef.arn`	string	—	ARN is a direct AWS policy ARN (e.g.
`policyRef.name`	string	—	Name of an IAMPolicy CR in the same namespace.
`policyRef.namespace`	string	—	Namespace of the IAMPolicy CR.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleRef`	object	yes	RoleRef references the IAMRole CR to attach the policy to.
`roleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`roleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`roleRef.namespace`	string	—	Namespace of the IAMRole CR.

Status

Field	Type	Required	Description
`attached`	boolean	—	Attached indicates whether the policy is currently attached.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`policyArn`	string	—	PolicyARN is the resolved IAM policy ARN.
`roleArn`	string	—	RoleARN is the resolved IAM role ARN.

IAMRole # GA

IAMRole is the Schema for managing AWS IAM Roles.

kubectl get iamroles · example on GitHub

Example

# IAMRole — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamrole
apiVersion: aws.konfig.io/v1alpha1
kind: IAMRole
metadata:
  name: example-iamrole
  namespace: default
spec:
  assumeRolePolicyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  description: Managed by konfig-konector
  maxSessionDuration: 3600
  path: example
  permissionsBoundary: example
  providerRef:
    name: example-iamrole
    region: us-east-1
  roleName: example-iamrole
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`assumeRolePolicyDocument`	string	yes	AssumeRolePolicyDocument is the trust policy JSON document.
`description`	string	—	Description is a description of the role.
`maxSessionDuration`	integer	—	MaxSessionDuration is the maximum session duration in seconds (3600–43200).
`path`	string	—	Path is the IAM path for the role.
`permissionsBoundary`	string	—	PermissionsBoundary is the ARN of a managed policy to use as a permissions boundary.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleName`	string	yes	RoleName is the name of the IAM role.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the role.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the IAM role.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`roleId`	string	—	RoleID is the stable and unique identifier of the IAM role.

IAMRolePolicy # GA

IAMRolePolicy is the Schema for managing inline AWS IAM policies on roles.

kubectl get iamrolepolicies · example on GitHub

Example

# IAMRolePolicy — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamrolepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: IAMRolePolicy
metadata:
  name: example-iamrolepolicy
  namespace: default
spec:
  policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  policyName: example-iamrolepolicy
  providerRef:
    name: example-iamrolepolicy
    region: us-east-1
  roleRef:
    name: example-role

Spec

Field	Type	Required	Description
`policyDocument`	string	yes	PolicyDocument is the JSON IAM policy document.
`policyName`	string	yes	PolicyName is the name of the inline policy within the role.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleRef`	object	yes	RoleRef references the IAMRole CR that owns this inline policy.
`roleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`roleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`roleRef.namespace`	string	—	Namespace of the IAMRole CR.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`roleArn`	string	—	RoleARN is the resolved IAM role ARN.

IAMSAMLProvider # GA

IAMSAMLProvider is the Schema for managing AWS IAM SAML Providers.

kubectl get iamsamlproviders · example on GitHub

Example

# IAMSAMLProvider — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamsamlprovider
apiVersion: aws.konfig.io/v1alpha1
kind: IAMSAMLProvider
metadata:
  name: example-iamsamlprovider
  namespace: default
spec:
  name: example-iamsamlprovider
  providerRef:
    name: example-iamsamlprovider
    region: us-east-1
  samlMetadataDocument: example
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`name`	string	yes	Name is the name of the SAML provider.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`samlMetadataDocument`	string	yes	SAMLMetadataDocument is the XML metadata document from the IdP.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the SAML provider.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the SAML provider.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`validUntil`	string	—	ValidUntil is the expiry date/time of the SAML metadata document.

IAMServerCertificate # CLOUD CONTROL · AWS::IAM::ServerCertificate ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: spec must contain the private key in plain text; prefer ACM. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. IAMServerCertificate manages AWS::IAM::ServerCertificate through the AWS Cloud Control API.

kubectl get iamservercertificates · example on GitHub

Example

# IAMServerCertificate — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamservercertificate
apiVersion: aws.konfig.io/v1alpha1
kind: IAMServerCertificate
metadata:
  name: example-iamservercertificate
  namespace: default
spec:
  certificateBody: example
  certificateChain: example
  path: example
  privateKey: example
  providerRef:
    name: example-iamservercertificate
    region: us-east-1
  serverCertificateName: example-iamservercertificate
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`certificateBody`	string	—	Create-only in AWS: changing it requires replacing the resource.
`certificateChain`	string	—	Create-only in AWS: changing it requires replacing the resource.
`path`	string	—
`privateKey`	string	—	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`serverCertificateName`	string	—	Create-only in AWS: changing it requires replacing the resource.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Amazon Resource Name (ARN) of the server certificate Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

IAMServiceLinkedRole # CLOUD CONTROL · AWS::IAM::ServiceLinkedRole

IAMServiceLinkedRole manages AWS::IAM::ServiceLinkedRole through the AWS Cloud Control API.

kubectl get iamservicelinkedroles · example on GitHub

Example

# IAMServiceLinkedRole — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamservicelinkedrole
apiVersion: aws.konfig.io/v1alpha1
kind: IAMServiceLinkedRole
metadata:
  name: example-iamservicelinkedrole
  namespace: default
spec:
  awsServiceName: example-iamservicelinkedrole
  customSuffix: example
  description: Managed by konfig-konector
  providerRef:
    name: example-iamservicelinkedrole
    region: us-east-1

Spec

Field	Type	Required	Description
`awsServiceName`	string	—	The service principal for the AWS service to which this role is attached.
`customSuffix`	string	—	A string that you provide, which is combined with the service-provided prefix to form the complete role name.
`description`	string	—	The description of the role.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`roleName`	string	—	The name of the role.

IAMUser # GA

IAMUser is the Schema for managing AWS IAM Users.

kubectl get iamusers · example on GitHub

Example

# IAMUser — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamuser
apiVersion: aws.konfig.io/v1alpha1
kind: IAMUser
metadata:
  name: example-iamuser
  namespace: default
spec:
  path: example
  permissionsBoundary: example
  providerRef:
    name: example-iamuser
    region: us-east-1
  tags:
    environment: dev
    team: platform
  userName: example-iamuser

Spec

Field	Type	Required	Description
`path`	string	—	Path is the IAM path for the user.
`permissionsBoundary`	string	—	PermissionsBoundary is the ARN of a managed policy to use as a permissions boundary.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the user.
`userName`	string	yes	UserName is the name of the IAM user.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the IAM user.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`userId`	string	—	UserID is the stable and unique identifier of the IAM user.

IAMUserPolicy # CLOUD CONTROL · AWS::IAM::UserPolicy

IAMUserPolicy manages AWS::IAM::UserPolicy through the AWS Cloud Control API.

kubectl get iamuserpolicies · example on GitHub

Example

# IAMUserPolicy — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamuserpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: IAMUserPolicy
metadata:
  name: example-iamuserpolicy
  namespace: default
spec:
  policyName: example-iamuserpolicy
  providerRef:
    name: example-iamuserpolicy
    region: us-east-1
  userName: example-iamuserpolicy

Spec

Field	Type	Required	Description
`policyDocument`	object	—	The policy document.
`policyName`	string	yes	The name of the policy document.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`userName`	string	yes	The name of the user to associate the policy with.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

IAMVirtualMFADevice # CLOUD CONTROL · AWS::IAM::VirtualMFADevice

IAMVirtualMFADevice manages AWS::IAM::VirtualMFADevice through the AWS Cloud Control API.

kubectl get iamvirtualmfadevices · example on GitHub

Example

# IAMVirtualMFADevice — IAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/iam.html#iamvirtualmfadevice
apiVersion: aws.konfig.io/v1alpha1
kind: IAMVirtualMFADevice
metadata:
  name: example-iamvirtualmfadevice
  namespace: default
spec:
  path: example
  providerRef:
    name: example-iamvirtualmfadevice
    region: us-east-1
  tags:
  - key: example
    value: example
  users:
  - example
  virtualMfaDeviceName: example-iamvirtualmfadevice

Spec

Field	Type	Required	Description
`path`	string	—	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`users`	array<string>	yes
`virtualMfaDeviceName`	string	—	Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`serialNumber`	string	—	Read-only: reported by AWS after creation.