IAM Roles Anywhere

3 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

RolesAnywhereCRL # CLOUD CONTROL · AWS::RolesAnywhere::CRL

RolesAnywhereCRL manages AWS::RolesAnywhere::CRL through the AWS Cloud Control API.

kubectl get rolesanywherecrls · example on GitHub

Example

# RolesAnywhereCRL — IAM Roles Anywhere
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/rolesanywhere.html#rolesanywherecrl
apiVersion: aws.konfig.io/v1alpha1
kind: RolesAnywhereCRL
metadata:
  name: example-rolesanywherecrl
  namespace: default
spec:
  crlData: example
  enabled: true
  name: example-rolesanywherecrl
  providerRef:
    name: example-rolesanywherecrl
    region: us-east-1
  tags:
  - key: example
    value: example
  trustAnchorArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`crlData`	string	yes
`enabled`	boolean	—
`name`	string	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`trustAnchorArn`	string	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`crlId`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

RolesAnywhereProfile # CLOUD CONTROL · AWS::RolesAnywhere::Profile

RolesAnywhereProfile manages AWS::RolesAnywhere::Profile through the AWS Cloud Control API.

kubectl get rolesanywhereprofiles · example on GitHub

Example

# RolesAnywhereProfile — IAM Roles Anywhere
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/rolesanywhere.html#rolesanywhereprofile
apiVersion: aws.konfig.io/v1alpha1
kind: RolesAnywhereProfile
metadata:
  name: example-rolesanywhereprofile
  namespace: default
spec:
  acceptRoleSessionName: false
  attributeMappings:
  - certificateField: x509Subject
    mappingRules:
    - specifier: example
  durationSeconds: 300
  enabled: true
  managedPolicyArns:
  - example
  name: example-rolesanywhereprofile
  providerRef:
    name: example-rolesanywhereprofile
    region: us-east-1
  requireInstanceProperties: false
  roleArns:
  - arn:aws:iam::123456789012:role/example-role
  sessionPolicy: example
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`acceptRoleSessionName`	boolean	—
`attributeMappings`	array<object>	—
`attributeMappings[].certificateField`	enum	yes	Allowed: `x509Subject, x509Issuer, x509SAN`
`attributeMappings[].mappingRules`	array<object>	yes
`attributeMappings[].mappingRules[].specifier`	string	yes
`durationSeconds`	number	—
`enabled`	boolean	—
`managedPolicyArns`	array<string>	—
`name`	string	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`requireInstanceProperties`	boolean	—	Create-only in AWS: changing it requires replacing the resource.
`roleArns`	array<string>	yes
`sessionPolicy`	string	—
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`profileArn`	string	—	Read-only: reported by AWS after creation.
`profileId`	string	—	Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

RolesAnywhereTrustAnchor # CLOUD CONTROL · AWS::RolesAnywhere::TrustAnchor

RolesAnywhereTrustAnchor manages AWS::RolesAnywhere::TrustAnchor through the AWS Cloud Control API.

kubectl get rolesanywheretrustanchors · example on GitHub

Example

# RolesAnywhereTrustAnchor — IAM Roles Anywhere
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/rolesanywhere.html#rolesanywheretrustanchor
apiVersion: aws.konfig.io/v1alpha1
kind: RolesAnywhereTrustAnchor
metadata:
  name: example-rolesanywheretrustanchor
  namespace: default
spec:
  enabled: true
  name: example-rolesanywheretrustanchor
  notificationSettings:
  - channel: ALL
    enabled: true
    event: CA_CERTIFICATE_EXPIRY
    threshold: 1
  providerRef:
    name: example-rolesanywheretrustanchor
    region: us-east-1
  source:
    sourceType: AWS_ACM_PCA
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`enabled`	boolean	—
`name`	string	yes
`notificationSettings`	array<object>	—
`notificationSettings[].channel`	enum	—	Allowed: `ALL`
`notificationSettings[].enabled`	boolean	yes
`notificationSettings[].event`	enum	yes	Allowed: `CA_CERTIFICATE_EXPIRY, END_ENTITY_CERTIFICATE_EXPIRY`
`notificationSettings[].threshold`	number	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`source`	object	yes	RolesAnywhereTrustAnchorSource is a nested property type of AWS::RolesAnywhere::TrustAnchor.
`source.sourceData`	object	yes
`source.sourceType`	enum	yes	Allowed: `AWS_ACM_PCA, CERTIFICATE_BUNDLE`
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`trustAnchorArn`	string	—	Read-only: reported by AWS after creation.
`trustAnchorId`	string	—	Read-only: reported by AWS after creation.