AWS.RolesAnywhere reference

Crl

Source: src/AWS/RolesAnywhere/Crl.ts

An IAM Roles Anywhere certificate revocation list (CRL). A CRL is a PEM-encoded list of certificates revoked by the trust anchor’s certificate authority; IAM Roles Anywhere refuses to vend credentials for revoked certificates while the CRL is enabled.

Crl: Importing a CRL

const anchor = yield* RolesAnywhere.TrustAnchor("Anchor", {
  certificateBundle: CA_CERTIFICATE_PEM,
});
const crl = yield* RolesAnywhere.Crl("Crl", {
  crlData: CRL_PEM,
  trustAnchorArn: anchor.trustAnchorArn,
});

Crl: Rotating the CRL

const crl = yield* RolesAnywhere.Crl("Crl", {
  crlData: NEXT_CRL_PEM, // re-deploy with the CA's latest CRL
  trustAnchorArn: anchor.trustAnchorArn,
});

GetSubject

Source: src/AWS/RolesAnywhere/GetSubject.ts

Runtime binding for rolesanywhere:GetSubject.

Reads a subject — the audit record IAM Roles Anywhere keeps for each certificate identity that has requested credentials, including the certificates presented and the time of the last authentication attempt. Account-level operation — subjects are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RolesAnywhere.GetSubjectHttp).

GetSubject: Auditing Certificate Identities

// init — account-level binding, no resource argument
const getSubject = yield* AWS.RolesAnywhere.GetSubject();

// runtime
const { subject } = yield* getSubject({ subjectId });
const lastSeen = subject?.lastSeenAt;

ListSubjects

Source: src/AWS/RolesAnywhere/ListSubjects.ts

Runtime binding for rolesanywhere:ListSubjects.

Lists the subjects — the audit records IAM Roles Anywhere keeps for each certificate identity that has requested credentials in the account and Region. The backbone of workload-identity auditing: which certificates authenticated, and when they were last seen. Account-level operation — the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RolesAnywhere.ListSubjectsHttp).

ListSubjects: Auditing Certificate Identities

// init — account-level binding, no resource argument
const listSubjects = yield* AWS.RolesAnywhere.ListSubjects();

// runtime
const { subjects } = yield* listSubjects();

Profile

Source: src/AWS/RolesAnywhere/Profile.ts

An IAM Roles Anywhere profile — the list of IAM roles that the Roles Anywhere service is trusted to assume for authenticated certificate identities, optionally intersected with managed policies and an inline session policy.

Profile: Creating a Profile

const role = yield* IAM.Role("WorkloadRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { Service: "rolesanywhere.amazonaws.com" },
        Action: ["sts:AssumeRole", "sts:TagSession", "sts:SetSourceIdentity"],
      },
    ],
  },
});
const profile = yield* RolesAnywhere.Profile("Profile", {
  roleArns: [role.roleArn],
});

Profile: Restricting the Session

const profile = yield* RolesAnywhere.Profile("Profile", {
  roleArns: [role.roleArn],
  duration: "15 minutes",
  sessionPolicy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [
      { Effect: "Allow", Action: "s3:GetObject", Resource: "*" },
    ],
  }),
});

Profile: Mapping Certificate Attributes

const profile = yield* RolesAnywhere.Profile("Profile", {
  roleArns: [role.roleArn],
  attributeMappings: [
    {
      certificateField: "x509Subject",
      mappingRules: [{ specifier: "CN" }],
    },
  ],
});

TrustAnchor

Source: src/AWS/RolesAnywhere/TrustAnchor.ts

An IAM Roles Anywhere trust anchor. A trust anchor establishes trust between IAM Roles Anywhere and your certificate authority (CA) — either an uploaded PEM CA certificate bundle or a reference to an AWS Private CA. Workloads outside AWS authenticate with certificates issued by the CA in exchange for temporary AWS credentials.

TrustAnchor: Creating a Trust Anchor

Certificate Bundle Trust Anchor

const anchor = yield* RolesAnywhere.TrustAnchor("Anchor", {
  certificateBundle: CA_CERTIFICATE_PEM,
});

AWS Private CA Trust Anchor

const anchor = yield* RolesAnywhere.TrustAnchor("Anchor", {
  acmPcaArn: privateCa.certificateAuthorityArn,
});

TrustAnchor: Disabling a Trust Anchor

const anchor = yield* RolesAnywhere.TrustAnchor("Anchor", {
  certificateBundle: CA_CERTIFICATE_PEM,
  enabled: false,
});

TrustAnchor: Expiry Notifications

const anchor = yield* RolesAnywhere.TrustAnchor("Anchor", {
  certificateBundle: CA_CERTIFICATE_PEM,
  notificationSettings: [
    { event: "CA_CERTIFICATE_EXPIRY", threshold: "30 days" },
  ],
});