awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(pam): update AWS IAM resource documentation and forms

Browse Source 
- Renamed PAM Role to Resource Role in documentation and forms to clarify the role's purpose.
- Enhanced AWS IAM account and resource forms to reflect the new naming conventions and improve user guidance.
- Added new images to the documentation for better visual understanding of the setup process.
- Updated session duration handling and trust policy instructions to align with the new Resource Role terminology.
This commit is contained in:
Victor Santos
2025-12-09 14:35:20 -03:00
parent 817d5a27c3
commit afae53c639
10 changed files with 245 additions and 207 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/AwsIamAccountForm.tsx
View File

@@ -97,17 +97,17 @@ export const AwsIamAccountForm = ({ account, resourceId, resourceType, onSubmit
enabled: !!resourceIdToFetch && !!resourceTypeToFetch
});
const pamRoleArn =
const resourceRoleArn =
(resource?.resourceType === PamResourceType.AwsIam &&
(resource as TAwsIamResource).connectionDetails?.roleArn) ||
"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/<YOUR_PAM_ROLE_NAME>";
"arn:aws:iam::<YOUR_ACCOUNT_ID>:role/<YOUR_RESOURCE_ROLE_NAME>";
const targetRoleTrustPolicy = `{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {
"AWS": "${pamRoleArn}"
"AWS": "${resourceRoleArn}"
},
"Action": "sts:AssumeRole",
"Condition": {
@@ -229,10 +229,9 @@ export const AwsIamAccountForm = ({ account, resourceId, resourceType, onSubmit
</AccordionTrigger>
<AccordionContent className="px-4 pb-2.5">
<p className="mb-3 text-sm text-mineshaft-300">
The target role must have a trust policy that allows the PAM role (created in the
&quot;Resources&quot; tab) to assume it. If your target role name follows the
wildcard pattern you defined in the PAM role&apos;s permissions policy, no
additional changes are needed.
The target role must have a trust policy that allows the Resource Role (created in
the &quot;Resources&quot; tab) to assume it. Ensure the target role&apos;s trust
policy includes the Resource Role as a trusted principal.
</p>
<p className="mb-2 text-sm font-medium text-mineshaft-200">
@@ -247,12 +246,11 @@ export const AwsIamAccountForm = ({ account, resourceId, resourceType, onSubmit
</pre>
</div>
<p className="text-xs text-mineshaft-400">
<strong>Note:</strong> The Principal role ARN shown above is from the PAM Resource
<strong>Note:</strong> The Principal role ARN shown above is from the Resource
selected for this account. The External ID{" "}
<code className="rounded bg-mineshaft-700 px-1 font-bold">{projectId}</code> is your
current project ID. If your target role name doesn&apos;t match the wildcard pattern
in your PAM Resource&apos;s role&apos;s permissions policy, you&apos;ll need to
update that policy to include this role&apos;s ARN.
current project ID. If you configured granular permissions in your Resource
Role&apos;s policy, ensure this target role&apos;s ARN is included.
</p>
</AccordionContent>
</AccordionItem>

15
frontend/src/pages/pam/PamAccountsPage/components/PamAccountHeader.tsx
View File

@@ -1,5 +1,10 @@
import { DocumentationLinkBadge } from "@app/components/v3";
import { PAM_RESOURCE_TYPE_MAP, PamResourceType } from "@app/hooks/api/pam";
const PAM_ACCOUNT_DOCS_MAP: Partial<Record<PamResourceType, string>> = {
[PamResourceType.AwsIam]: "aws-iam#create-pam-accounts"
};
type Props = {
resourceName: string;
resourceType: PamResourceType;
@@ -8,6 +13,7 @@ type Props = {
export const PamAccountHeader = ({ resourceName, resourceType, onBack }: Props) => {
const details = PAM_RESOURCE_TYPE_MAP[resourceType];
const docsPath = PAM_ACCOUNT_DOCS_MAP[resourceType];
return (
<div className="mb-4 flex w-full items-start gap-2 border-b border-mineshaft-500 pb-4">
@@ -17,7 +23,14 @@ export const PamAccountHeader = ({ resourceName, resourceType, onBack }: Props)
className="h-12 w-12 rounded-md bg-bunker-500 p-2"
/>
<div>
<div className="flex items-center text-mineshaft-300">{resourceName}</div>
<div className="flex items-center gap-x-2 text-mineshaft-300">
{resourceName}
{docsPath && (
<DocumentationLinkBadge
href={`https://infisical.com/docs/documentation/platform/pam/resources/${docsPath}`}
/>
)}
</div>
<p className="text-sm leading-4 text-mineshaft-400">{details.name} resource</p>
</div>
{onBack && (

38
frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/AwsIamResourceForm.tsx
View File

@@ -30,7 +30,7 @@ const AwsIamConnectionDetailsSchema = z.object({
roleArn: z
.string()
.trim()
.min(1, "PAM Role ARN is required")
.min(1, "Resource Role ARN is required")
.refine((val) => arnRoleRegex.test(val), {
message: "ARN must be in the format 'arn:aws:iam::123456789012:role/RoleName'"
})
@@ -57,7 +57,7 @@ export const AwsIamResourceForm = ({ resource, onSubmit }: Props) => {
"Statement": [{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::<YOUR_ACCOUNT_ID>:role/<YOUR_PREFIX>-*"
"Resource": "arn:aws:iam::<YOUR_ACCOUNT_ID>:role/*"
}]
}`;
@@ -116,12 +116,15 @@ export const AwsIamResourceForm = ({ resource, onSubmit }: Props) => {
control={control}
render={({ field, fieldState: { error } }) => (
<FormControl
helperText="The ARN of the Infisical PAM role that can assume target roles"
helperText="The ARN of the Infisical Resource Role that can assume target roles"
errorText={error?.message}
isError={Boolean(error?.message)}
label="PAM Role ARN"
label="Resource Role ARN"
>
<Input placeholder="arn:aws:iam::123456789012:role/InfisicalPAMRole" {...field} />
<Input
placeholder="arn:aws:iam::123456789012:role/InfisicalResourceRole"
{...field}
/>
</FormControl>
)}
/>
@@ -148,12 +151,12 @@ export const AwsIamResourceForm = ({ resource, onSubmit }: Props) => {
Step 1: Create a permissions policy for assuming target roles
</p>
<p className="mb-3 text-sm text-mineshaft-300">
This policy allows the PAM role to assume target roles. We recommend using a
wildcard pattern (e.g.,{" "}
<code className="rounded bg-mineshaft-700 px-1 text-xs">pam-*</code> or{" "}
<code className="rounded bg-mineshaft-700 px-1 text-xs">privileged-*</code>) so you
can add new accounts without updating this policy. Choose a prefix that fits your
naming conventions.
This policy allows the Resource Role to assume target roles. For simplicity, use a
wildcard to allow assuming any role in your account. For more granular control,
replace <code className="rounded bg-mineshaft-700 px-1 text-xs">/*</code> with a
specific pattern like{" "}
<code className="rounded bg-mineshaft-700 px-1 text-xs">/pam-*</code> or{" "}
<code className="rounded bg-mineshaft-700 px-1 text-xs">/infisical-*</code>.
</p>
<div className="relative mb-4">
<div className="absolute top-1 right-1">
@@ -165,12 +168,12 @@ export const AwsIamResourceForm = ({ resource, onSubmit }: Props) => {
</div>
<p className="mb-2 text-sm font-medium text-mineshaft-200">
Step 2: Create the PAM role with a trust policy
Step 2: Create the Resource Role with a trust policy
</p>
<p className="mb-3 text-sm text-mineshaft-300">
Create an IAM role (e.g.,{" "}
<code className="rounded bg-mineshaft-700 px-1 text-xs">InfisicalPAMRole</code>)
with the permissions policy above and the following trust policy:
<code className="rounded bg-mineshaft-700 px-1 text-xs">InfisicalResourceRole</code>
) with the permissions policy above and the following trust policy:
</p>
<div className="relative mb-4">
<div className="absolute top-1 right-3">
@@ -189,11 +192,8 @@ export const AwsIamResourceForm = ({ resource, onSubmit }: Props) => {
<code className="rounded bg-mineshaft-700 px-1 font-bold">
{INFISICAL_AWS_ACCOUNT_EU}
</code>{" "}
for EU region. Replace{" "}
<code className="rounded bg-mineshaft-700 px-1 font-bold">
&lt;INFISICAL_AWS_ACCOUNT_ID&gt;
</code>{" "}
with the appropriate Infisical AWS account ID for your region. The External ID{" "}
for EU region. For dedicated instances, contact Infisical support. For self-hosted
instances, use your Infisical deployment&apos;s AWS account ID. The External ID{" "}
<code className="rounded bg-mineshaft-700 px-1 font-bold">{projectId}</code> is your
current project ID.
</p>

15
frontend/src/pages/pam/PamResourcesPage/components/PamResourceHeader.tsx
View File

@@ -1,5 +1,10 @@
import { DocumentationLinkBadge } from "@app/components/v3";
import { PAM_RESOURCE_TYPE_MAP, PamResourceType } from "@app/hooks/api/pam";
const PAM_RESOURCE_DOCS_MAP: Partial<Record<PamResourceType, string>> = {
[PamResourceType.AwsIam]: "aws-iam#create-the-pam-resource"
};
type Props = {
resourceType: PamResourceType;
onBack?: () => void;
@@ -7,6 +12,7 @@ type Props = {
export const PamResourceHeader = ({ resourceType, onBack }: Props) => {
const details = PAM_RESOURCE_TYPE_MAP[resourceType];
const docsPath = PAM_RESOURCE_DOCS_MAP[resourceType];
return (
<div className="mb-4 flex w-full items-start gap-2 border-b border-mineshaft-500 pb-4">
@@ -16,7 +22,14 @@ export const PamResourceHeader = ({ resourceType, onBack }: Props) => {
className="h-12 w-12 rounded-md bg-bunker-500 p-2"
/>
<div>
<div className="flex items-center text-mineshaft-300">{details.name}</div>
<div className="flex items-center gap-x-2 text-mineshaft-300">
{details.name}
{docsPath && (
<DocumentationLinkBadge
href={`https://infisical.com/docs/documentation/platform/pam/resources/${docsPath}`}
/>
)}
</div>
<p className="text-sm leading-4 text-mineshaft-400">Resource</p>
</div>
{onBack && (