Docs Home Pulumi IaC Pulumi ESC Pulumi Cloud Packages Tutorials
  1. Packages
  2. Alibaba Cloud Provider
  3. API Docs
  4. ram
  5. getPolicyDocument
Alibaba Cloud v3.75.0 published on Friday, Mar 7, 2025 by Pulumi
pulumi/pulumi-alicloud

alicloud.ram.getPolicyDocument

Explore with Pulumi AI

alicloud logo
Alibaba Cloud v3.75.0 published on Friday, Mar 7, 2025 by Pulumi
pulumi/pulumi-alicloud

    This data source Generates a RAM policy document of the current Alibaba Cloud user.

    NOTE: Available since v1.184.0+.

    Example Usage

    Basic Example

    import * as pulumi from "@pulumi/pulumi";
import * as alicloud from "@pulumi/alicloud";

const basicExample = alicloud.ram.getPolicyDocument({
    version: "1",
    statements: [{
        effect: "Allow",
        actions: ["oss:*"],
        resources: [
            "acs:oss:*:*:myphotos",
            "acs:oss:*:*:myphotos/*",
        ],
    }],
});
const _default = new alicloud.ram.Policy("default", {
    policyName: "tf-example",
    policyDocument: basicExample.then(basicExample => basicExample.document),
    force: true,
});

    import pulumi
import pulumi_alicloud as alicloud

basic_example = alicloud.ram.get_policy_document(version="1",
    statements=[{
        "effect": "Allow",
        "actions": ["oss:*"],
        "resources": [
            "acs:oss:*:*:myphotos",
            "acs:oss:*:*:myphotos/*",
        ],
    }])
default = alicloud.ram.Policy("default",
    policy_name="tf-example",
    policy_document=basic_example.document,
    force=True)

    package main

import (
	"github.com/pulumi/pulumi-alicloud/sdk/v3/go/alicloud/ram"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		basicExample, err := ram.GetPolicyDocument(ctx, &ram.GetPolicyDocumentArgs{
			Version: pulumi.StringRef("1"),
			Statements: []ram.GetPolicyDocumentStatement{
				{
					Effect: pulumi.StringRef("Allow"),
					Actions: []string{
						"oss:*",
					},
					Resources: []string{
						"acs:oss:*:*:myphotos",
						"acs:oss:*:*:myphotos/*",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = ram.NewPolicy(ctx, "default", &ram.PolicyArgs{
			PolicyName:     pulumi.String("tf-example"),
			PolicyDocument: pulumi.String(basicExample.Document),
			Force:          pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AliCloud = Pulumi.AliCloud;

return await Deployment.RunAsync(() => 
{
    var basicExample = AliCloud.Ram.GetPolicyDocument.Invoke(new()
    {
        Version = "1",
        Statements = new[]
        {
            new AliCloud.Ram.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Effect = "Allow",
                Actions = new[]
                {
                    "oss:*",
                },
                Resources = new[]
                {
                    "acs:oss:*:*:myphotos",
                    "acs:oss:*:*:myphotos/*",
                },
            },
        },
    });

    var @default = new AliCloud.Ram.Policy("default", new()
    {
        PolicyName = "tf-example",
        PolicyDocument = basicExample.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Document),
        Force = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.alicloud.ram.RamFunctions;
import com.pulumi.alicloud.ram.inputs.GetPolicyDocumentArgs;
import com.pulumi.alicloud.ram.Policy;
import com.pulumi.alicloud.ram.PolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var basicExample = RamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .version("1")
            .statements(GetPolicyDocumentStatementArgs.builder()
                .effect("Allow")
                .actions("oss:*")
                .resources(                
                    "acs:oss:*:*:myphotos",
                    "acs:oss:*:*:myphotos/*")
                .build())
            .build());

        var default_ = new Policy("default", PolicyArgs.builder()
            .policyName("tf-example")
            .policyDocument(basicExample.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.document()))
            .force(true)
            .build());

    }
}

    resources:
  default:
    type: alicloud:ram:Policy
    properties:
      policyName: tf-example
      policyDocument: ${basicExample.document}
      force: true
variables:
  basicExample:
    fn::invoke:
      function: alicloud:ram:getPolicyDocument
      arguments:
        version: '1'
        statements:
          - effect: Allow
            actions:
              - oss:*
            resources:
              - acs:oss:*:*:myphotos
              - acs:oss:*:*:myphotos/*

    data.alicloud_ram_policy_document.basic_example.document will evaluate to:

    {
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "oss:*",
      "Resource": [
        "acs:oss:*:*:myphotos",
        "acs:oss:*:*:myphotos/*"
      ]
    }
  ],
  "Version": "1"
}

    Example Multiple Condition Keys and Values

    import * as pulumi from "@pulumi/pulumi";
import * as alicloud from "@pulumi/alicloud";

const multipleCondition = alicloud.ram.getPolicyDocument({
    version: "1",
    statements: [
        {
            effect: "Allow",
            actions: [
                "oss:ListBuckets",
                "oss:GetBucketStat",
                "oss:GetBucketInfo",
                "oss:GetBucketTagging",
                "oss:GetBucketAcl",
            ],
            resources: ["acs:oss:*:*:*"],
        },
        {
            effect: "Allow",
            actions: [
                "oss:GetObject",
                "oss:GetObjectAcl",
            ],
            resources: ["acs:oss:*:*:myphotos/hangzhou/2015/*"],
        },
        {
            effect: "Allow",
            actions: ["oss:ListObjects"],
            resources: ["acs:oss:*:*:myphotos"],
            conditions: [
                {
                    operator: "StringLike",
                    variable: "oss:Delimiter",
                    values: ["/"],
                },
                {
                    operator: "StringLike",
                    variable: "oss:Prefix",
                    values: [
                        "",
                        "hangzhou/",
                        "hangzhou/2015/*",
                    ],
                },
            ],
        },
    ],
});
const policy = new alicloud.ram.Policy("policy", {
    policyName: "tf-example-condition",
    policyDocument: multipleCondition.then(multipleCondition => multipleCondition.document),
    force: true,
});

    import pulumi
import pulumi_alicloud as alicloud

multiple_condition = alicloud.ram.get_policy_document(version="1",
    statements=[
        {
            "effect": "Allow",
            "actions": [
                "oss:ListBuckets",
                "oss:GetBucketStat",
                "oss:GetBucketInfo",
                "oss:GetBucketTagging",
                "oss:GetBucketAcl",
            ],
            "resources": ["acs:oss:*:*:*"],
        },
        {
            "effect": "Allow",
            "actions": [
                "oss:GetObject",
                "oss:GetObjectAcl",
            ],
            "resources": ["acs:oss:*:*:myphotos/hangzhou/2015/*"],
        },
        {
            "effect": "Allow",
            "actions": ["oss:ListObjects"],
            "resources": ["acs:oss:*:*:myphotos"],
            "conditions": [
                {
                    "operator": "StringLike",
                    "variable": "oss:Delimiter",
                    "values": ["/"],
                },
                {
                    "operator": "StringLike",
                    "variable": "oss:Prefix",
                    "values": [
                        "",
                        "hangzhou/",
                        "hangzhou/2015/*",
                    ],
                },
            ],
        },
    ])
policy = alicloud.ram.Policy("policy",
    policy_name="tf-example-condition",
    policy_document=multiple_condition.document,
    force=True)

    package main

import (
	"github.com/pulumi/pulumi-alicloud/sdk/v3/go/alicloud/ram"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		multipleCondition, err := ram.GetPolicyDocument(ctx, &ram.GetPolicyDocumentArgs{
			Version: pulumi.StringRef("1"),
			Statements: []ram.GetPolicyDocumentStatement{
				{
					Effect: pulumi.StringRef("Allow"),
					Actions: []string{
						"oss:ListBuckets",
						"oss:GetBucketStat",
						"oss:GetBucketInfo",
						"oss:GetBucketTagging",
						"oss:GetBucketAcl",
					},
					Resources: []string{
						"acs:oss:*:*:*",
					},
				},
				{
					Effect: pulumi.StringRef("Allow"),
					Actions: []string{
						"oss:GetObject",
						"oss:GetObjectAcl",
					},
					Resources: []string{
						"acs:oss:*:*:myphotos/hangzhou/2015/*",
					},
				},
				{
					Effect: pulumi.StringRef("Allow"),
					Actions: []string{
						"oss:ListObjects",
					},
					Resources: []string{
						"acs:oss:*:*:myphotos",
					},
					Conditions: []ram.GetPolicyDocumentStatementCondition{
						{
							Operator: "StringLike",
							Variable: "oss:Delimiter",
							Values: []string{
								"/",
							},
						},
						{
							Operator: "StringLike",
							Variable: "oss:Prefix",
							Values: []string{
								"",
								"hangzhou/",
								"hangzhou/2015/*",
							},
						},
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = ram.NewPolicy(ctx, "policy", &ram.PolicyArgs{
			PolicyName:     pulumi.String("tf-example-condition"),
			PolicyDocument: pulumi.String(multipleCondition.Document),
			Force:          pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AliCloud = Pulumi.AliCloud;

return await Deployment.RunAsync(() => 
{
    var multipleCondition = AliCloud.Ram.GetPolicyDocument.Invoke(new()
    {
        Version = "1",
        Statements = new[]
        {
            new AliCloud.Ram.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Effect = "Allow",
                Actions = new[]
                {
                    "oss:ListBuckets",
                    "oss:GetBucketStat",
                    "oss:GetBucketInfo",
                    "oss:GetBucketTagging",
                    "oss:GetBucketAcl",
                },
                Resources = new[]
                {
                    "acs:oss:*:*:*",
                },
            },
            new AliCloud.Ram.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Effect = "Allow",
                Actions = new[]
                {
                    "oss:GetObject",
                    "oss:GetObjectAcl",
                },
                Resources = new[]
                {
                    "acs:oss:*:*:myphotos/hangzhou/2015/*",
                },
            },
            new AliCloud.Ram.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Effect = "Allow",
                Actions = new[]
                {
                    "oss:ListObjects",
                },
                Resources = new[]
                {
                    "acs:oss:*:*:myphotos",
                },
                Conditions = new[]
                {
                    new AliCloud.Ram.Inputs.GetPolicyDocumentStatementConditionInputArgs
                    {
                        Operator = "StringLike",
                        Variable = "oss:Delimiter",
                        Values = new[]
                        {
                            "/",
                        },
                    },
                    new AliCloud.Ram.Inputs.GetPolicyDocumentStatementConditionInputArgs
                    {
                        Operator = "StringLike",
                        Variable = "oss:Prefix",
                        Values = new[]
                        {
                            "",
                            "hangzhou/",
                            "hangzhou/2015/*",
                        },
                    },
                },
            },
        },
    });

    var policy = new AliCloud.Ram.Policy("policy", new()
    {
        PolicyName = "tf-example-condition",
        PolicyDocument = multipleCondition.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Document),
        Force = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.alicloud.ram.RamFunctions;
import com.pulumi.alicloud.ram.inputs.GetPolicyDocumentArgs;
import com.pulumi.alicloud.ram.Policy;
import com.pulumi.alicloud.ram.PolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var multipleCondition = RamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .version("1")
            .statements(            
                GetPolicyDocumentStatementArgs.builder()
                    .effect("Allow")
                    .actions(                    
                        "oss:ListBuckets",
                        "oss:GetBucketStat",
                        "oss:GetBucketInfo",
                        "oss:GetBucketTagging",
                        "oss:GetBucketAcl")
                    .resources("acs:oss:*:*:*")
                    .build(),
                GetPolicyDocumentStatementArgs.builder()
                    .effect("Allow")
                    .actions(                    
                        "oss:GetObject",
                        "oss:GetObjectAcl")
                    .resources("acs:oss:*:*:myphotos/hangzhou/2015/*")
                    .build(),
                GetPolicyDocumentStatementArgs.builder()
                    .effect("Allow")
                    .actions("oss:ListObjects")
                    .resources("acs:oss:*:*:myphotos")
                    .conditions(                    
                        GetPolicyDocumentStatementConditionArgs.builder()
                            .operator("StringLike")
                            .variable("oss:Delimiter")
                            .values("/")
                            .build(),
                        GetPolicyDocumentStatementConditionArgs.builder()
                            .operator("StringLike")
                            .variable("oss:Prefix")
                            .values(                            
                                "",
                                "hangzhou/",
                                "hangzhou/2015/*")
                            .build())
                    .build())
            .build());

        var policy = new Policy("policy", PolicyArgs.builder()
            .policyName("tf-example-condition")
            .policyDocument(multipleCondition.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.document()))
            .force(true)
            .build());

    }
}

    resources:
  policy:
    type: alicloud:ram:Policy
    properties:
      policyName: tf-example-condition
      policyDocument: ${multipleCondition.document}
      force: true
variables:
  multipleCondition:
    fn::invoke:
      function: alicloud:ram:getPolicyDocument
      arguments:
        version: '1'
        statements:
          - effect: Allow
            actions:
              - oss:ListBuckets
              - oss:GetBucketStat
              - oss:GetBucketInfo
              - oss:GetBucketTagging
              - oss:GetBucketAcl
            resources:
              - acs:oss:*:*:*
          - effect: Allow
            actions:
              - oss:GetObject
              - oss:GetObjectAcl
            resources:
              - acs:oss:*:*:myphotos/hangzhou/2015/*
          - effect: Allow
            actions:
              - oss:ListObjects
            resources:
              - acs:oss:*:*:myphotos
            conditions:
              - operator: StringLike
                variable: oss:Delimiter
                values:
                  - /
              - operator: StringLike
                variable: oss:Prefix
                values:
                  - ""
                  - hangzhou/
                  - hangzhou/2015/*

    data.alicloud_ram_policy_document.multiple_condition.document will evaluate to:

    {
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:ListBuckets",
        "oss:GetBucketStat",
        "oss:GetBucketInfo",
        "oss:GetBucketTagging",
        "oss:GetBucketAcl"
      ],
      "Resource": "acs:oss:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject",
        "oss:GetObjectAcl"
      ],
      "Resource": "acs:oss:*:*:myphotos/hangzhou/2015/*"
    },
    {
      "Effect": "Allow",
      "Action": "oss:ListObjects",
      "Resource": "acs:oss:*:*:myphotos",
      "Condition": {
        "StringLike": {
          "oss:Delimiter": "/",
          "oss:Prefix": [
            "",
            "hangzhou/",
            "hangzhou/2015/*"
          ]
        }
      }
    }
  ],
  "Version": "1"
}

    Example Assume-Role Policy with RAM Principal

    import * as pulumi from "@pulumi/pulumi";
import * as alicloud from "@pulumi/alicloud";

const ramExample = alicloud.ram.getPolicyDocument({
    statements: [{
        effect: "Allow",
        actions: ["sts:AssumeRole"],
        principals: [{
            entity: "RAM",
            identifiers: ["acs:ram::123456789012****:root"],
        }],
    }],
});
const role = new alicloud.ram.Role("role", {
    name: "tf-example-role-ram",
    document: ramExample.then(ramExample => ramExample.document),
    force: true,
});

    import pulumi
import pulumi_alicloud as alicloud

ram_example = alicloud.ram.get_policy_document(statements=[{
    "effect": "Allow",
    "actions": ["sts:AssumeRole"],
    "principals": [{
        "entity": "RAM",
        "identifiers": ["acs:ram::123456789012****:root"],
    }],
}])
role = alicloud.ram.Role("role",
    name="tf-example-role-ram",
    document=ram_example.document,
    force=True)

    package main

import (
	"github.com/pulumi/pulumi-alicloud/sdk/v3/go/alicloud/ram"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		ramExample, err := ram.GetPolicyDocument(ctx, &ram.GetPolicyDocumentArgs{
			Statements: []ram.GetPolicyDocumentStatement{
				{
					Effect: pulumi.StringRef("Allow"),
					Actions: []string{
						"sts:AssumeRole",
					},
					Principals: []ram.GetPolicyDocumentStatementPrincipal{
						{
							Entity: "RAM",
							Identifiers: []string{
								"acs:ram::123456789012****:root",
							},
						},
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = ram.NewRole(ctx, "role", &ram.RoleArgs{
			Name:     pulumi.String("tf-example-role-ram"),
			Document: pulumi.String(ramExample.Document),
			Force:    pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AliCloud = Pulumi.AliCloud;

return await Deployment.RunAsync(() => 
{
    var ramExample = AliCloud.Ram.GetPolicyDocument.Invoke(new()
    {
        Statements = new[]
        {
            new AliCloud.Ram.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Effect = "Allow",
                Actions = new[]
                {
                    "sts:AssumeRole",
                },
                Principals = new[]
                {
                    new AliCloud.Ram.Inputs.GetPolicyDocumentStatementPrincipalInputArgs
                    {
                        Entity = "RAM",
                        Identifiers = new[]
                        {
                            "acs:ram::123456789012****:root",
                        },
                    },
                },
            },
        },
    });

    var role = new AliCloud.Ram.Role("role", new()
    {
        Name = "tf-example-role-ram",
        Document = ramExample.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Document),
        Force = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.alicloud.ram.RamFunctions;
import com.pulumi.alicloud.ram.inputs.GetPolicyDocumentArgs;
import com.pulumi.alicloud.ram.Role;
import com.pulumi.alicloud.ram.RoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var ramExample = RamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .effect("Allow")
                .actions("sts:AssumeRole")
                .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                    .entity("RAM")
                    .identifiers("acs:ram::123456789012****:root")
                    .build())
                .build())
            .build());

        var role = new Role("role", RoleArgs.builder()
            .name("tf-example-role-ram")
            .document(ramExample.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.document()))
            .force(true)
            .build());

    }
}

    resources:
  role:
    type: alicloud:ram:Role
    properties:
      name: tf-example-role-ram
      document: ${ramExample.document}
      force: true
variables:
  ramExample:
    fn::invoke:
      function: alicloud:ram:getPolicyDocument
      arguments:
        statements:
          - effect: Allow
            actions:
              - sts:AssumeRole
            principals:
              - entity: RAM
                identifiers:
                  - acs:ram::123456789012****:root

    data.alicloud_ram_policy_document.ram_example.document will evaluate to:

    {
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Principal": {
        "RAM": [
          "acs:ram::123456789012****:root"
        ]
      }
    }
  ],
  "Version": "1"
}

    Example Assume-Role Policy with Service Principal

    import * as pulumi from "@pulumi/pulumi";
import * as alicloud from "@pulumi/alicloud";

const serviceExample = alicloud.ram.getPolicyDocument({
    statements: [{
        effect: "Allow",
        actions: ["sts:AssumeRole"],
        principals: [{
            entity: "Service",
            identifiers: ["ecs.aliyuncs.com"],
        }],
    }],
});
const role = new alicloud.ram.Role("role", {
    name: "tf-example-role-service",
    document: serviceExample.then(serviceExample => serviceExample.document),
    force: true,
});

    import pulumi
import pulumi_alicloud as alicloud

service_example = alicloud.ram.get_policy_document(statements=[{
    "effect": "Allow",
    "actions": ["sts:AssumeRole"],
    "principals": [{
        "entity": "Service",
        "identifiers": ["ecs.aliyuncs.com"],
    }],
}])
role = alicloud.ram.Role("role",
    name="tf-example-role-service",
    document=service_example.document,
    force=True)

    package main

import (
	"github.com/pulumi/pulumi-alicloud/sdk/v3/go/alicloud/ram"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		serviceExample, err := ram.GetPolicyDocument(ctx, &ram.GetPolicyDocumentArgs{
			Statements: []ram.GetPolicyDocumentStatement{
				{
					Effect: pulumi.StringRef("Allow"),
					Actions: []string{
						"sts:AssumeRole",
					},
					Principals: []ram.GetPolicyDocumentStatementPrincipal{
						{
							Entity: "Service",
							Identifiers: []string{
								"ecs.aliyuncs.com",
							},
						},
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = ram.NewRole(ctx, "role", &ram.RoleArgs{
			Name:     pulumi.String("tf-example-role-service"),
			Document: pulumi.String(serviceExample.Document),
			Force:    pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AliCloud = Pulumi.AliCloud;

return await Deployment.RunAsync(() => 
{
    var serviceExample = AliCloud.Ram.GetPolicyDocument.Invoke(new()
    {
        Statements = new[]
        {
            new AliCloud.Ram.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Effect = "Allow",
                Actions = new[]
                {
                    "sts:AssumeRole",
                },
                Principals = new[]
                {
                    new AliCloud.Ram.Inputs.GetPolicyDocumentStatementPrincipalInputArgs
                    {
                        Entity = "Service",
                        Identifiers = new[]
                        {
                            "ecs.aliyuncs.com",
                        },
                    },
                },
            },
        },
    });

    var role = new AliCloud.Ram.Role("role", new()
    {
        Name = "tf-example-role-service",
        Document = serviceExample.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Document),
        Force = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.alicloud.ram.RamFunctions;
import com.pulumi.alicloud.ram.inputs.GetPolicyDocumentArgs;
import com.pulumi.alicloud.ram.Role;
import com.pulumi.alicloud.ram.RoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var serviceExample = RamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .effect("Allow")
                .actions("sts:AssumeRole")
                .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                    .entity("Service")
                    .identifiers("ecs.aliyuncs.com")
                    .build())
                .build())
            .build());

        var role = new Role("role", RoleArgs.builder()
            .name("tf-example-role-service")
            .document(serviceExample.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.document()))
            .force(true)
            .build());

    }
}

    resources:
  role:
    type: alicloud:ram:Role
    properties:
      name: tf-example-role-service
      document: ${serviceExample.document}
      force: true
variables:
  serviceExample:
    fn::invoke:
      function: alicloud:ram:getPolicyDocument
      arguments:
        statements:
          - effect: Allow
            actions:
              - sts:AssumeRole
            principals:
              - entity: Service
                identifiers:
                  - ecs.aliyuncs.com

    data.alicloud_ram_policy_document.service_example.document will evaluate to:

    {
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": [
          "ecs.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}

    Example Assume-Role Policy with Federated Principal

    import * as pulumi from "@pulumi/pulumi";
import * as alicloud from "@pulumi/alicloud";

const federatedExample = alicloud.ram.getPolicyDocument({
    statements: [{
        effect: "Allow",
        actions: ["sts:AssumeRole"],
        principals: [{
            entity: "Federated",
            identifiers: ["acs:ram::123456789012****:saml-provider/testprovider"],
        }],
        conditions: [{
            operator: "StringEquals",
            variable: "saml:recipient",
            values: ["https://signin.aliyun.com/saml-role/sso"],
        }],
    }],
});
const role = new alicloud.ram.Role("role", {
    name: "tf-example-role-federated",
    document: federatedExample.then(federatedExample => federatedExample.document),
    force: true,
});

    import pulumi
import pulumi_alicloud as alicloud

federated_example = alicloud.ram.get_policy_document(statements=[{
    "effect": "Allow",
    "actions": ["sts:AssumeRole"],
    "principals": [{
        "entity": "Federated",
        "identifiers": ["acs:ram::123456789012****:saml-provider/testprovider"],
    }],
    "conditions": [{
        "operator": "StringEquals",
        "variable": "saml:recipient",
        "values": ["https://signin.aliyun.com/saml-role/sso"],
    }],
}])
role = alicloud.ram.Role("role",
    name="tf-example-role-federated",
    document=federated_example.document,
    force=True)

    package main

import (
	"github.com/pulumi/pulumi-alicloud/sdk/v3/go/alicloud/ram"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		federatedExample, err := ram.GetPolicyDocument(ctx, &ram.GetPolicyDocumentArgs{
			Statements: []ram.GetPolicyDocumentStatement{
				{
					Effect: pulumi.StringRef("Allow"),
					Actions: []string{
						"sts:AssumeRole",
					},
					Principals: []ram.GetPolicyDocumentStatementPrincipal{
						{
							Entity: "Federated",
							Identifiers: []string{
								"acs:ram::123456789012****:saml-provider/testprovider",
							},
						},
					},
					Conditions: []ram.GetPolicyDocumentStatementCondition{
						{
							Operator: "StringEquals",
							Variable: "saml:recipient",
							Values: []string{
								"https://signin.aliyun.com/saml-role/sso",
							},
						},
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = ram.NewRole(ctx, "role", &ram.RoleArgs{
			Name:     pulumi.String("tf-example-role-federated"),
			Document: pulumi.String(federatedExample.Document),
			Force:    pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AliCloud = Pulumi.AliCloud;

return await Deployment.RunAsync(() => 
{
    var federatedExample = AliCloud.Ram.GetPolicyDocument.Invoke(new()
    {
        Statements = new[]
        {
            new AliCloud.Ram.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Effect = "Allow",
                Actions = new[]
                {
                    "sts:AssumeRole",
                },
                Principals = new[]
                {
                    new AliCloud.Ram.Inputs.GetPolicyDocumentStatementPrincipalInputArgs
                    {
                        Entity = "Federated",
                        Identifiers = new[]
                        {
                            "acs:ram::123456789012****:saml-provider/testprovider",
                        },
                    },
                },
                Conditions = new[]
                {
                    new AliCloud.Ram.Inputs.GetPolicyDocumentStatementConditionInputArgs
                    {
                        Operator = "StringEquals",
                        Variable = "saml:recipient",
                        Values = new[]
                        {
                            "https://signin.aliyun.com/saml-role/sso",
                        },
                    },
                },
            },
        },
    });

    var role = new AliCloud.Ram.Role("role", new()
    {
        Name = "tf-example-role-federated",
        Document = federatedExample.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Document),
        Force = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.alicloud.ram.RamFunctions;
import com.pulumi.alicloud.ram.inputs.GetPolicyDocumentArgs;
import com.pulumi.alicloud.ram.Role;
import com.pulumi.alicloud.ram.RoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var federatedExample = RamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .effect("Allow")
                .actions("sts:AssumeRole")
                .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                    .entity("Federated")
                    .identifiers("acs:ram::123456789012****:saml-provider/testprovider")
                    .build())
                .conditions(GetPolicyDocumentStatementConditionArgs.builder()
                    .operator("StringEquals")
                    .variable("saml:recipient")
                    .values("https://signin.aliyun.com/saml-role/sso")
                    .build())
                .build())
            .build());

        var role = new Role("role", RoleArgs.builder()
            .name("tf-example-role-federated")
            .document(federatedExample.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.document()))
            .force(true)
            .build());

    }
}

    resources:
  role:
    type: alicloud:ram:Role
    properties:
      name: tf-example-role-federated
      document: ${federatedExample.document}
      force: true
variables:
  federatedExample:
    fn::invoke:
      function: alicloud:ram:getPolicyDocument
      arguments:
        statements:
          - effect: Allow
            actions:
              - sts:AssumeRole
            principals:
              - entity: Federated
                identifiers:
                  - acs:ram::123456789012****:saml-provider/testprovider
            conditions:
              - operator: StringEquals
                variable: saml:recipient
                values:
                  - https://signin.aliyun.com/saml-role/sso

    data.alicloud_ram_policy_document.federated_example.document will evaluate to:

    {
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Principal": {
        "Federated": [
          "acs:ram::123456789012****:saml-provider/testprovider"
        ]
      },
      "Condition": {
        "StringEquals": {
          "saml:recipient": "https://signin.aliyun.com/saml-role/sso"
        }
      }
    }
  ],
  "Version": "1"
}

    Using getPolicyDocument

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getPolicyDocument(args: GetPolicyDocumentArgs, opts?: InvokeOptions): Promise<GetPolicyDocumentResult>
function getPolicyDocumentOutput(args: GetPolicyDocumentOutputArgs, opts?: InvokeOptions): Output<GetPolicyDocumentResult>
    def get_policy_document(output_file: Optional[str] = None,
                        statements: Optional[Sequence[GetPolicyDocumentStatement]] = None,
                        version: Optional[str] = None,
                        opts: Optional[InvokeOptions] = None) -> GetPolicyDocumentResult
def get_policy_document_output(output_file: Optional[pulumi.Input[str]] = None,
                        statements: Optional[pulumi.Input[Sequence[pulumi.Input[GetPolicyDocumentStatementArgs]]]] = None,
                        version: Optional[pulumi.Input[str]] = None,
                        opts: Optional[InvokeOptions] = None) -> Output[GetPolicyDocumentResult]
    func GetPolicyDocument(ctx *Context, args *GetPolicyDocumentArgs, opts ...InvokeOption) (*GetPolicyDocumentResult, error)
func GetPolicyDocumentOutput(ctx *Context, args *GetPolicyDocumentOutputArgs, opts ...InvokeOption) GetPolicyDocumentResultOutput

    > Note: This function is named GetPolicyDocument in the Go SDK.

    public static class GetPolicyDocument 
{
    public static Task<GetPolicyDocumentResult> InvokeAsync(GetPolicyDocumentArgs args, InvokeOptions? opts = null)
    public static Output<GetPolicyDocumentResult> Invoke(GetPolicyDocumentInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetPolicyDocumentResult> getPolicyDocument(GetPolicyDocumentArgs args, InvokeOptions options)
public static Output<GetPolicyDocumentResult> getPolicyDocument(GetPolicyDocumentArgs args, InvokeOptions options)

    fn::invoke:
  function: alicloud:ram/getPolicyDocument:getPolicyDocument
  arguments:
    # arguments dictionary

    The following arguments are supported:

    OutputFile string
    File name where to save data source results (after running pulumi preview).
    Statements List<Pulumi.AliCloud.Ram.Inputs.GetPolicyDocumentStatement>
    Statement of the RAM policy document. See the following Block statement. See statement below.
    Version string
    Version of the RAM policy document. Valid value is 1. Default value is 1.
    OutputFile string
    File name where to save data source results (after running pulumi preview).
    Statements []GetPolicyDocumentStatement
    Statement of the RAM policy document. See the following Block statement. See statement below.
    Version string
    Version of the RAM policy document. Valid value is 1. Default value is 1.
    outputFile String
    File name where to save data source results (after running pulumi preview).
    statements List<GetPolicyDocumentStatement>
    Statement of the RAM policy document. See the following Block statement. See statement below.
    version String
    Version of the RAM policy document. Valid value is 1. Default value is 1.
    outputFile string
    File name where to save data source results (after running pulumi preview).
    statements GetPolicyDocumentStatement[]
    Statement of the RAM policy document. See the following Block statement. See statement below.
    version string
    Version of the RAM policy document. Valid value is 1. Default value is 1.
    output_file str
    File name where to save data source results (after running pulumi preview).
    statements Sequence[GetPolicyDocumentStatement]
    Statement of the RAM policy document. See the following Block statement. See statement below.
    version str
    Version of the RAM policy document. Valid value is 1. Default value is 1.
    outputFile String
    File name where to save data source results (after running pulumi preview).
    statements List<Property Map>
    Statement of the RAM policy document. See the following Block statement. See statement below.
    version String
    Version of the RAM policy document. Valid value is 1. Default value is 1.

    getPolicyDocument Result

    The following output properties are available:

    Document string
    Standard policy document rendered based on the arguments above.
    Id string
    The provider-assigned unique ID for this managed resource.
    OutputFile string
    Statements List<Pulumi.AliCloud.Ram.Outputs.GetPolicyDocumentStatement>
    Version string
    Document string
    Standard policy document rendered based on the arguments above.
    Id string
    The provider-assigned unique ID for this managed resource.
    OutputFile string
    Statements []GetPolicyDocumentStatement
    Version string
    document String
    Standard policy document rendered based on the arguments above.
    id String
    The provider-assigned unique ID for this managed resource.
    outputFile String
    statements List<GetPolicyDocumentStatement>
    version String
    document string
    Standard policy document rendered based on the arguments above.
    id string
    The provider-assigned unique ID for this managed resource.
    outputFile string
    statements GetPolicyDocumentStatement[]
    version string
    document str
    Standard policy document rendered based on the arguments above.
    id str
    The provider-assigned unique ID for this managed resource.
    output_file str
    statements Sequence[GetPolicyDocumentStatement]
    version str
    document String
    Standard policy document rendered based on the arguments above.
    id String
    The provider-assigned unique ID for this managed resource.
    outputFile String
    statements List<Property Map>
    version String

    Supporting Types

    GetPolicyDocumentStatement

    Actions List<string>
    Action of the RAM policy document. If you want to create a RAM role policy document, it must be ["sts:AssumeRole"].
    Conditions List<Pulumi.AliCloud.Ram.Inputs.GetPolicyDocumentStatementCondition>
    Specifies the condition that are required for a policy to take effect. See condition below.
    Effect string
    This parameter indicates whether or not the action is allowed. Valid values are Allow and Deny. Default value is Allow. If you want to create a RAM role policy document, it must be Allow.
    Principals List<Pulumi.AliCloud.Ram.Inputs.GetPolicyDocumentStatementPrincipal>
    Principal of the RAM policy document. If you want to create a RAM role policy document, it must be set. See principal below.
    Resources List<string>
    List of specific objects which will be authorized. If you want to create a RAM policy document, it must be set.
    Actions []string
    Action of the RAM policy document. If you want to create a RAM role policy document, it must be ["sts:AssumeRole"].
    Conditions []GetPolicyDocumentStatementCondition
    Specifies the condition that are required for a policy to take effect. See condition below.
    Effect string
    This parameter indicates whether or not the action is allowed. Valid values are Allow and Deny. Default value is Allow. If you want to create a RAM role policy document, it must be Allow.
    Principals []GetPolicyDocumentStatementPrincipal
    Principal of the RAM policy document. If you want to create a RAM role policy document, it must be set. See principal below.
    Resources []string
    List of specific objects which will be authorized. If you want to create a RAM policy document, it must be set.
    actions List<String>
    Action of the RAM policy document. If you want to create a RAM role policy document, it must be ["sts:AssumeRole"].
    conditions List<GetPolicyDocumentStatementCondition>
    Specifies the condition that are required for a policy to take effect. See condition below.
    effect String
    This parameter indicates whether or not the action is allowed. Valid values are Allow and Deny. Default value is Allow. If you want to create a RAM role policy document, it must be Allow.
    principals List<GetPolicyDocumentStatementPrincipal>
    Principal of the RAM policy document. If you want to create a RAM role policy document, it must be set. See principal below.
    resources List<String>
    List of specific objects which will be authorized. If you want to create a RAM policy document, it must be set.
    actions string[]
    Action of the RAM policy document. If you want to create a RAM role policy document, it must be ["sts:AssumeRole"].
    conditions GetPolicyDocumentStatementCondition[]
    Specifies the condition that are required for a policy to take effect. See condition below.
    effect string
    This parameter indicates whether or not the action is allowed. Valid values are Allow and Deny. Default value is Allow. If you want to create a RAM role policy document, it must be Allow.
    principals GetPolicyDocumentStatementPrincipal[]
    Principal of the RAM policy document. If you want to create a RAM role policy document, it must be set. See principal below.
    resources string[]
    List of specific objects which will be authorized. If you want to create a RAM policy document, it must be set.
    actions Sequence[str]
    Action of the RAM policy document. If you want to create a RAM role policy document, it must be ["sts:AssumeRole"].
    conditions Sequence[GetPolicyDocumentStatementCondition]
    Specifies the condition that are required for a policy to take effect. See condition below.
    effect str
    This parameter indicates whether or not the action is allowed. Valid values are Allow and Deny. Default value is Allow. If you want to create a RAM role policy document, it must be Allow.
    principals Sequence[GetPolicyDocumentStatementPrincipal]
    Principal of the RAM policy document. If you want to create a RAM role policy document, it must be set. See principal below.
    resources Sequence[str]
    List of specific objects which will be authorized. If you want to create a RAM policy document, it must be set.
    actions List<String>
    Action of the RAM policy document. If you want to create a RAM role policy document, it must be ["sts:AssumeRole"].
    conditions List<Property Map>
    Specifies the condition that are required for a policy to take effect. See condition below.
    effect String
    This parameter indicates whether or not the action is allowed. Valid values are Allow and Deny. Default value is Allow. If you want to create a RAM role policy document, it must be Allow.
    principals List<Property Map>
    Principal of the RAM policy document. If you want to create a RAM role policy document, it must be set. See principal below.
    resources List<String>
    List of specific objects which will be authorized. If you want to create a RAM policy document, it must be set.

    GetPolicyDocumentStatementCondition

    Operator string
    The operator of the condition.
    Values List<string>
    The values of the condition.
    Variable string
    The variable of the condition.
    Operator string
    The operator of the condition.
    Values []string
    The values of the condition.
    Variable string
    The variable of the condition.
    operator String
    The operator of the condition.
    values List<String>
    The values of the condition.
    variable String
    The variable of the condition.
    operator string
    The operator of the condition.
    values string[]
    The values of the condition.
    variable string
    The variable of the condition.
    operator str
    The operator of the condition.
    values Sequence[str]
    The values of the condition.
    variable str
    The variable of the condition.
    operator String
    The operator of the condition.
    values List<String>
    The values of the condition.
    variable String
    The variable of the condition.

    GetPolicyDocumentStatementPrincipal

    Entity string
    The trusted entity. Valid values: RAM, Service and Federated.
    Identifiers List<string>
    The identifiers of the principal.
    Entity string
    The trusted entity. Valid values: RAM, Service and Federated.
    Identifiers []string
    The identifiers of the principal.
    entity String
    The trusted entity. Valid values: RAM, Service and Federated.
    identifiers List<String>
    The identifiers of the principal.
    entity string
    The trusted entity. Valid values: RAM, Service and Federated.
    identifiers string[]
    The identifiers of the principal.
    entity str
    The trusted entity. Valid values: RAM, Service and Federated.
    identifiers Sequence[str]
    The identifiers of the principal.
    entity String
    The trusted entity. Valid values: RAM, Service and Federated.
    identifiers List<String>
    The identifiers of the principal.

    Package Details

    Repository
    Alibaba Cloud pulumi/pulumi-alicloud
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the alicloud Terraform Provider.
    alicloud logo
    Alibaba Cloud v3.75.0 published on Friday, Mar 7, 2025 by Pulumi
    pulumi/pulumi-alicloud