Verified Permissions

5 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

VerifiedPermissionsIdentitySource # CLOUD CONTROL · AWS::VerifiedPermissions::IdentitySource

VerifiedPermissionsIdentitySource manages AWS::VerifiedPermissions::IdentitySource through the AWS Cloud Control API.

kubectl get verifiedpermissionsidentitysources · example on GitHub

Example

# VerifiedPermissionsIdentitySource — Verified Permissions
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/verifiedpermissions.html#verifiedpermissionsidentitysource
apiVersion: aws.konfig.io/v1alpha1
kind: VerifiedPermissionsIdentitySource
metadata:
  name: example-verifiedpermissionsidentitysource
  namespace: default
spec:
  policyStoreId: example-id
  principalEntityType: example
  providerRef:
    name: example-verifiedpermissionsidentitysource
    region: us-east-1

Spec

Field	Type	Required	Description
`configuration`	object	yes
`policyStoreId`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`principalEntityType`	string	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`details`	object	—	Read-only: reported by AWS after creation.
`details.clientIds`	array<string>	—
`details.discoveryUrl`	string	—
`details.openIdIssuer`	enum	—	Allowed: `COGNITO`
`details.userPoolArn`	string	—
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`identitySourceId`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

VerifiedPermissionsPolicy # CLOUD CONTROL · AWS::VerifiedPermissions::Policy

VerifiedPermissionsPolicy manages AWS::VerifiedPermissions::Policy through the AWS Cloud Control API.

kubectl get verifiedpermissionspolicies · example on GitHub

Example

# VerifiedPermissionsPolicy — Verified Permissions
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/verifiedpermissions.html#verifiedpermissionspolicy
apiVersion: aws.konfig.io/v1alpha1
kind: VerifiedPermissionsPolicy
metadata:
  name: example-verifiedpermissionspolicy
  namespace: default
spec:
  name: example-verifiedpermissionspolicy
  policyStoreId: example-id
  providerRef:
    name: example-verifiedpermissionspolicy
    region: us-east-1

Spec

Field	Type	Required	Description
`definition`	object	yes
`name`	string	—
`policyStoreId`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`policyId`	string	—	Read-only: reported by AWS after creation.
`policyType`	enum	—	Read-only: reported by AWS after creation. Allowed: `STATIC, TEMPLATE_LINKED`
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

VerifiedPermissionsPolicyStore # CLOUD CONTROL · AWS::VerifiedPermissions::PolicyStore

VerifiedPermissionsPolicyStore manages AWS::VerifiedPermissions::PolicyStore through the AWS Cloud Control API.

kubectl get verifiedpermissionspolicystores · example on GitHub

Example

# VerifiedPermissionsPolicyStore — Verified Permissions
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/verifiedpermissions.html#verifiedpermissionspolicystore
apiVersion: aws.konfig.io/v1alpha1
kind: VerifiedPermissionsPolicyStore
metadata:
  name: example-verifiedpermissionspolicystore
  namespace: default
spec:
  deletionProtection:
    mode: ENABLED
  description: Managed by konfig-konector
  providerRef:
    name: example-verifiedpermissionspolicystore
    region: us-east-1
  schema:
    cedarJson: example
  tags:
  - key: example
    value: example
  validationSettings:
    mode: 'OFF'

Spec

Field	Type	Required	Description
`deletionProtection`	object	—	VerifiedPermissionsPolicyStoreDeletionProtection is a nested property type of AWS::VerifiedPermissions::PolicyStore.
`deletionProtection.mode`	enum	yes	Allowed: `ENABLED, DISABLED`
`description`	string	—
`encryptionSettings`	object	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`schema`	object	—	VerifiedPermissionsPolicyStoreSchemaDefinition is a nested property type of AWS::VerifiedPermissions::PolicyStore.
`schema.cedarJson`	string	—
`tags`	array<object>	—	The tags to add to the policy store
`tags[].key`	string	yes
`tags[].value`	string	yes
`validationSettings`	object	yes	VerifiedPermissionsPolicyStoreValidationSettings is a nested property type of AWS::VerifiedPermissions::PolicyStore.
`validationSettings.mode`	enum	yes	Allowed: `OFF, STRICT`

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`encryptionState`	object	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`policyStoreId`	string	—	Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

VerifiedPermissionsPolicyStoreAlias # CLOUD CONTROL · AWS::VerifiedPermissions::PolicyStoreAlias

VerifiedPermissionsPolicyStoreAlias manages AWS::VerifiedPermissions::PolicyStoreAlias through the AWS Cloud Control API.

kubectl get verifiedpermissionspolicystorealiases · example on GitHub

Example

# VerifiedPermissionsPolicyStoreAlias — Verified Permissions
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/verifiedpermissions.html#verifiedpermissionspolicystorealias
apiVersion: aws.konfig.io/v1alpha1
kind: VerifiedPermissionsPolicyStoreAlias
metadata:
  name: example-verifiedpermissionspolicystorealias
  namespace: default
spec:
  aliasName: example-verifiedpermissionspolicystorealias
  policyStoreId: example-id
  providerRef:
    name: example-verifiedpermissionspolicystorealias
    region: us-east-1

Spec

Field	Type	Required	Description
`aliasName`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`policyStoreId`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

VerifiedPermissionsPolicyTemplate # CLOUD CONTROL · AWS::VerifiedPermissions::PolicyTemplate

VerifiedPermissionsPolicyTemplate manages AWS::VerifiedPermissions::PolicyTemplate through the AWS Cloud Control API.

kubectl get verifiedpermissionspolicytemplates · example on GitHub

Example

# VerifiedPermissionsPolicyTemplate — Verified Permissions
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/verifiedpermissions.html#verifiedpermissionspolicytemplate
apiVersion: aws.konfig.io/v1alpha1
kind: VerifiedPermissionsPolicyTemplate
metadata:
  name: example-verifiedpermissionspolicytemplate
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-verifiedpermissionspolicytemplate
  policyStoreId: example-id
  providerRef:
    name: example-verifiedpermissionspolicytemplate
    region: us-east-1
  statement: example

Spec

Field	Type	Required	Description
`description`	string	—
`name`	string	—
`policyStoreId`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`statement`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`policyTemplateId`	string	—	Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.