RAM

3 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

RAMPermission # CLOUD CONTROL · AWS::RAM::Permission

RAMPermission manages AWS::RAM::Permission through the AWS Cloud Control API.

kubectl get rampermissions · example on GitHub

Example

# RAMPermission — RAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ram.html#rampermission
apiVersion: aws.konfig.io/v1alpha1
kind: RAMPermission
metadata:
  name: example-rampermission
  namespace: default
spec:
  name: example-rampermission
  providerRef:
    name: example-rampermission
    region: us-east-1
  resourceType: example
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`name`	string	yes	The name of the permission.
`policyTemplate`	object	yes	Policy template for the permission.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceType`	string	yes	The resource type this permission can be used with.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`isResourceTypeDefault`	boolean	—	Set to true to use this as the default permission.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`permissionType`	string	—	Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`version`	string	—	Version of the permission.

ResourceShare # GA

ResourceShare is the Schema for managing AWS RAM resource shares.

kubectl get resourceshares · example on GitHub

Example

# ResourceShare — RAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ram.html#resourceshare
apiVersion: aws.konfig.io/v1alpha1
kind: ResourceShare
metadata:
  name: example-resourceshare
  namespace: default
spec:
  allowExternalPrincipals: false
  name: example-resourceshare
  permissionArns:
  - example
  principals:
  - example
  providerRef:
    name: example-resourceshare
    region: us-east-1
  resourceArns:
  - example
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`allowExternalPrincipals`	boolean	—	AllowExternalPrincipals permits sharing with accounts outside the organization.
`name`	string	yes	Name is the name of the resource share.
`permissionArns`	array<string>	—	PermissionArns are RAM permission ARNs to associate with the share.
`principals`	array<string>	—	Principals to share with: 12-digit account IDs, OU ARNs, organization ARNs, or IAM role/user ARNs.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceArns`	array<string>	—	ResourceArns are the ARNs of the resources to share.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the resource share.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

ResourceShareInvitation # GA WIP · CROSS-ACCOUNT

STATUS: WIP.

kubectl get resourceshareinvitations · example on GitHub

Example

# ResourceShareInvitation — RAM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ram.html#resourceshareinvitation
apiVersion: aws.konfig.io/v1alpha1
kind: ResourceShareInvitation
metadata:
  name: example-resourceshareinvitation
  namespace: default
spec:
  providerRef:
    name: example-resourceshareinvitation
    region: us-east-1
  resourceShareRef:
    name: example-resourceshare

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceShareRef`	object	yes	ResourceShareRef identifies the share to accept.
`resourceShareRef.arn`	string	—	ARN is a direct resource share ARN.
`resourceShareRef.name`	string	—	Name of a ResourceShare CR.
`resourceShareRef.namespace`	string	—	Namespace of the ResourceShare CR.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`invitationArn`	string	—	InvitationARN is the accepted invitation, when one existed.
`lastSyncTime`	string	—	LastSyncTime is the last successful sync.
`observedGeneration`	integer	—	ObservedGeneration is the generation last reconciled.
`resourceArns`	array<string>	—	ResourceARNs shared with this account through the share.
`resourceShareArn`	string	—	ResourceShareARN is the share that was accepted.
`senderAccountId`	string	—	SenderAccountID owns the share.
`status`	string	—	Status is the RAM invitation status (PENDING, ACCEPTED, ...).