java.lang.Object
- com.pulumi.resources.Resource
- - com.pulumi.resources.CustomResource
  - - com.pulumi.aws.amp.ResourcePolicy

public class ResourcePolicy
extends com.pulumi.resources.CustomResource

Manages an Amazon Managed Service for Prometheus (AMP) Resource Policy. Resource-based policies allow you to grant permissions to other AWS accounts or services to access your Prometheus workspace. This enables cross-account access and fine-grained permissions for workspace sharing. The following actions are supported in resource policies for Prometheus workspaces: `aps:RemoteWrite`, `aps:QueryMetrics`, `aps:GetSeries`, `aps:GetLabels`, `aps:GetMetricMetadata`. > **Note:** Only Prometheus-compatible APIs can be used for workspace sharing. Non-Prometheus-compatible APIs added to the policy will be ignored. If your workspace uses customer-managed KMS keys for encryption, you must grant the principals in your resource-based policy access to those KMS keys through KMS grants. The resource ARN in the policy document must match the workspace ARN that the policy is being attached to. ## Example Usage ### Basic Resource Policy

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.amp.Workspace;
 import com.pulumi.aws.amp.WorkspaceArgs;
 import com.pulumi.aws.AwsFunctions;
 import com.pulumi.aws.inputs.GetCallerIdentityArgs;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.amp.ResourcePolicy;
 import com.pulumi.aws.amp.ResourcePolicyArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var exampleWorkspace = new Workspace("exampleWorkspace", WorkspaceArgs.builder()
             .alias("example-workspace")
             .build());
 
         final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
             .build());
 
         final var example = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("AWS")
                     .identifiers(current.accountId())
                     .build())
                 .effect("Allow")
                 .actions(                
                     "aps:RemoteWrite",
                     "aps:QueryMetrics",
                     "aps:GetSeries",
                     "aps:GetLabels",
                     "aps:GetMetricMetadata")
                 .resources(exampleWorkspace.arn())
                 .build())
             .build());
 
         var exampleResourcePolicy = new ResourcePolicy("exampleResourcePolicy", ResourcePolicyArgs.builder()
             .workspaceId(exampleWorkspace.id())
             .policyDocument(example.applyValue(_example -> _example.json()))
             .build());
 
     }
 }

### Cross-Account Access

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.amp.Workspace;
 import com.pulumi.aws.amp.WorkspaceArgs;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.amp.ResourcePolicy;
 import com.pulumi.aws.amp.ResourcePolicyArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new Workspace("example", WorkspaceArgs.builder()
             .alias("example-workspace")
             .build());
 
         final var crossAccount = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("AWS")
                     .identifiers("arn:aws:iam::123456789012:root")
                     .build())
                 .effect("Allow")
                 .actions(                
                     "aps:RemoteWrite",
                     "aps:QueryMetrics")
                 .resources(example.arn())
                 .build())
             .build());
 
         var crossAccountResourcePolicy = new ResourcePolicy("crossAccountResourcePolicy", ResourcePolicyArgs.builder()
             .workspaceId(example.id())
             .policyDocument(crossAccount.applyValue(_crossAccount -> _crossAccount.json()))
             .build());
 
     }
 }

### Service-Specific Access

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.amp.Workspace;
 import com.pulumi.aws.amp.WorkspaceArgs;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.amp.ResourcePolicy;
 import com.pulumi.aws.amp.ResourcePolicyArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new Workspace("example", WorkspaceArgs.builder()
             .alias("example-workspace")
             .build());
 
         final var serviceAccess = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("Service")
                     .identifiers("grafana.amazonaws.com")
                     .build())
                 .effect("Allow")
                 .actions(                
                     "aps:QueryMetrics",
                     "aps:GetSeries",
                     "aps:GetLabels",
                     "aps:GetMetricMetadata")
                 .resources(example.arn())
                 .build())
             .build());
 
         var serviceAccessResourcePolicy = new ResourcePolicy("serviceAccessResourcePolicy", ResourcePolicyArgs.builder()
             .workspaceId(example.id())
             .policyDocument(serviceAccess.applyValue(_serviceAccess -> _serviceAccess.json()))
             .build());
 
     }
 }

## Import Using `pulumi import`, import AMP Resource Policies using the workspace ID. For example: ```sh $ pulumi import aws:amp/resourcePolicy:ResourcePolicy example ws-12345678-90ab-cdef-1234-567890abcdef ```

Nested Class Summary
- Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource
  com.pulumi.resources.CustomResource.CustomResourceInternal
- Nested classes/interfaces inherited from class com.pulumi.resources.Resource
  com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

Field Summary
- Fields inherited from class com.pulumi.resources.Resource
  childResources, remote

Constructor Summary

Constructors
Constructor	Description
`ResourcePolicy(java.lang.String name)`
`ResourcePolicy(java.lang.String name, ResourcePolicyArgs args)`
`ResourcePolicy(java.lang.String name, ResourcePolicyArgs args, com.pulumi.resources.CustomResourceOptions options)`

Method Summary

All Methods Static Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`static ResourcePolicy`	`get(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, ResourcePolicyState state, com.pulumi.resources.CustomResourceOptions options)`	Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
`com.pulumi.core.Output<java.lang.String>`	`policyDocument()`
`com.pulumi.core.Output<java.lang.String>`	`region()`
`com.pulumi.core.Output<java.lang.String>`	`revisionId()`
`com.pulumi.core.Output<java.util.Optional<ResourcePolicyTimeouts>>`	`timeouts()`
`com.pulumi.core.Output<java.lang.String>`	`workspaceId()`

Methods inherited from class com.pulumi.resources.CustomResource
getId, id, idFuture

Methods inherited from class com.pulumi.resources.Resource
getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - ResourcePolicy
```
public ResourcePolicy(java.lang.String name)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
  - ResourcePolicy
```
public ResourcePolicy(java.lang.String name,
                      ResourcePolicyArgs args)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
  - ResourcePolicy
```
public ResourcePolicy(java.lang.String name,
                      ResourcePolicyArgs args,
                      @Nullable
                      com.pulumi.resources.CustomResourceOptions options)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
    
    options - A bag of options that control this resource's behavior.
- Method Detail
  - policyDocument
```
public com.pulumi.core.Output<java.lang.String> policyDocument()
```
    Returns:
    
    JSON policy document to use as the resource-based policy. This policy defines the permissions that other AWS accounts or services have to access your workspace.
  - region
```
public com.pulumi.core.Output<java.lang.String> region()
```
    Returns:
    
    Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
  - revisionId
```
public com.pulumi.core.Output<java.lang.String> revisionId()
```
    Returns:
    
    Revision ID of the current resource-based policy.
  - timeouts
```
public com.pulumi.core.Output<java.util.Optional<ResourcePolicyTimeouts>> timeouts()
```
  - workspaceId
```
public com.pulumi.core.Output<java.lang.String> workspaceId()
```
    Returns:
    
    ID of the workspace to attach the resource-based policy to. The following arguments are optional:
  - get
```
public static ResourcePolicy get(java.lang.String name,
                                 com.pulumi.core.Output<java.lang.String> id,
                                 @Nullable
                                 ResourcePolicyState state,
                                 @Nullable
                                 com.pulumi.resources.CustomResourceOptions options)
```
    Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
    
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    id - The _unique_ provider ID of the resource to lookup.
    
    state -
    
    options - Optional settings to control the behavior of the CustomResource.

Class ResourcePolicy

Nested Class Summary

Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

Nested classes/interfaces inherited from class com.pulumi.resources.Resource

Field Summary

Fields inherited from class com.pulumi.resources.Resource

Constructor Summary

Method Summary

Methods inherited from class com.pulumi.resources.CustomResource

Methods inherited from class com.pulumi.resources.Resource

Methods inherited from class java.lang.Object

Constructor Detail

ResourcePolicy

ResourcePolicy

ResourcePolicy

Method Detail

policyDocument

region

revisionId

timeouts

workspaceId

get