@pulumi/aws 7.9.0-alpha.1760704543 → 7.9.0-alpha.1761090036

package/amp/index.d.ts

@@ -13,6 +13,9 @@ export declare const getWorkspacesOutput: typeof import("./getWorkspaces").getWo
 export { QueryLoggingConfigurationArgs, QueryLoggingConfigurationState } from "./queryLoggingConfiguration";
 export type QueryLoggingConfiguration = import("./queryLoggingConfiguration").QueryLoggingConfiguration;
 export declare const QueryLoggingConfiguration: typeof import("./queryLoggingConfiguration").QueryLoggingConfiguration;
+export { ResourcePolicyArgs, ResourcePolicyState } from "./resourcePolicy";
+export type ResourcePolicy = import("./resourcePolicy").ResourcePolicy;
+export declare const ResourcePolicy: typeof import("./resourcePolicy").ResourcePolicy;
 export { RuleGroupNamespaceArgs, RuleGroupNamespaceState } from "./ruleGroupNamespace";
 export type RuleGroupNamespace = import("./ruleGroupNamespace").RuleGroupNamespace;
 export declare const RuleGroupNamespace: typeof import("./ruleGroupNamespace").RuleGroupNamespace;

package/amp/index.js

@@ -2,7 +2,7 @@
 // *** WARNING: this file was generated by pulumi-language-nodejs. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WorkspaceConfiguration = exports.Workspace = exports.Scraper = exports.RuleGroupNamespace = exports.QueryLoggingConfiguration = exports.getWorkspacesOutput = exports.getWorkspaces = exports.getWorkspaceOutput = exports.getWorkspace = exports.getDefaultScraperConfigurationOutput = exports.getDefaultScraperConfiguration = exports.AlertManagerDefinition = void 0;
+exports.WorkspaceConfiguration = exports.Workspace = exports.Scraper = exports.RuleGroupNamespace = exports.ResourcePolicy = exports.QueryLoggingConfiguration = exports.getWorkspacesOutput = exports.getWorkspaces = exports.getWorkspaceOutput = exports.getWorkspace = exports.getDefaultScraperConfigurationOutput = exports.getDefaultScraperConfiguration = exports.AlertManagerDefinition = void 0;
 const pulumi = require("@pulumi/pulumi");
 const utilities = require("../utilities");
 exports.AlertManagerDefinition = null;
@@ -18,6 +18,8 @@ exports.getWorkspacesOutput = null;
 utilities.lazyLoad(exports, ["getWorkspaces", "getWorkspacesOutput"], () => require("./getWorkspaces"));
 exports.QueryLoggingConfiguration = null;
 utilities.lazyLoad(exports, ["QueryLoggingConfiguration"], () => require("./queryLoggingConfiguration"));
+exports.ResourcePolicy = null;
+utilities.lazyLoad(exports, ["ResourcePolicy"], () => require("./resourcePolicy"));
 exports.RuleGroupNamespace = null;
 utilities.lazyLoad(exports, ["RuleGroupNamespace"], () => require("./ruleGroupNamespace"));
 exports.Scraper = null;
@@ -34,6 +36,8 @@ const _module = {
                 return new exports.AlertManagerDefinition(name, undefined, { urn });
             case "aws:amp/queryLoggingConfiguration:QueryLoggingConfiguration":
                 return new exports.QueryLoggingConfiguration(name, undefined, { urn });
+            case "aws:amp/resourcePolicy:ResourcePolicy":
+                return new exports.ResourcePolicy(name, undefined, { urn });
             case "aws:amp/ruleGroupNamespace:RuleGroupNamespace":
                 return new exports.RuleGroupNamespace(name, undefined, { urn });
             case "aws:amp/scraper:Scraper":
@@ -49,6 +53,7 @@ const _module = {
 };
 pulumi.runtime.registerResourceModule("aws", "amp/alertManagerDefinition", _module);
 pulumi.runtime.registerResourceModule("aws", "amp/queryLoggingConfiguration", _module);
+pulumi.runtime.registerResourceModule("aws", "amp/resourcePolicy", _module);
 pulumi.runtime.registerResourceModule("aws", "amp/ruleGroupNamespace", _module);
 pulumi.runtime.registerResourceModule("aws", "amp/scraper", _module);
 pulumi.runtime.registerResourceModule("aws", "amp/workspace", _module);

package/amp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../amp/index.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAK7B,QAAA,sBAAsB,GAAqE,IAAW,CAAC;AACpH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAGtF,QAAA,8BAA8B,GAAqF,IAAW,CAAC;AAC/H,QAAA,oCAAoC,GAA2F,IAAW,CAAC;AACxJ,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,gCAAgC,EAAC,sCAAsC,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,CAAC;AAG7I,QAAA,YAAY,GAAiD,IAAW,CAAC;AACzE,QAAA,kBAAkB,GAAuD,IAAW,CAAC;AAClG,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,cAAc,EAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAGvF,QAAA,aAAa,GAAmD,IAAW,CAAC;AAC5E,QAAA,mBAAmB,GAAyD,IAAW,CAAC;AACrG,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,eAAe,EAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAI1F,QAAA,yBAAyB,GAA2E,IAAW,CAAC;AAC7H,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC;AAI5F,QAAA,kBAAkB,GAA6D,IAAW,CAAC;AACxG,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAI9E,QAAA,OAAO,GAAuC,IAAW,CAAC;AACvE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAIxD,QAAA,SAAS,GAA2C,IAAW,CAAC;AAC7E,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;AAI5D,QAAA,sBAAsB,GAAqE,IAAW,CAAC;AACpH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAGnG,MAAM,OAAO,GAAG;IACZ,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE;IAC/B,SAAS,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,GAAW,EAAmB,EAAE;QACpE,QAAQ,IAAI,EAAE;YACV,KAAK,uDAAuD;gBACxD,OAAO,IAAI,8BAAsB,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACpE,KAAK,6DAA6D;gBAC9D,OAAO,IAAI,iCAAyB,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACvE,KAAK,+CAA+C;gBAChD,OAAO,IAAI,0BAAkB,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YAChE,KAAK,yBAAyB;gBAC1B,OAAO,IAAI,eAAO,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACrD,KAAK,6BAA6B;gBAC9B,OAAO,IAAI,iBAAS,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACvD,KAAK,uDAAuD;gBACxD,OAAO,IAAI,8BAAsB,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACpE;gBACI,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;SACxD;IACL,CAAC;CACJ,CAAC;AACF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,4BAA4B,EAAE,OAAO,CAAC,CAAA;AACnF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,+BAA+B,EAAE,OAAO,CAAC,CAAA;AACtF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAA;AAC/E,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;AACpE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;AACtE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,4BAA4B,EAAE,OAAO,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../amp/index.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAK7B,QAAA,sBAAsB,GAAqE,IAAW,CAAC;AACpH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAGtF,QAAA,8BAA8B,GAAqF,IAAW,CAAC;AAC/H,QAAA,oCAAoC,GAA2F,IAAW,CAAC;AACxJ,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,gCAAgC,EAAC,sCAAsC,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,CAAC;AAG7I,QAAA,YAAY,GAAiD,IAAW,CAAC;AACzE,QAAA,kBAAkB,GAAuD,IAAW,CAAC;AAClG,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,cAAc,EAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAGvF,QAAA,aAAa,GAAmD,IAAW,CAAC;AAC5E,QAAA,mBAAmB,GAAyD,IAAW,CAAC;AACrG,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,eAAe,EAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAI1F,QAAA,yBAAyB,GAA2E,IAAW,CAAC;AAC7H,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC;AAI5F,QAAA,cAAc,GAAqD,IAAW,CAAC;AAC5F,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAItE,QAAA,kBAAkB,GAA6D,IAAW,CAAC;AACxG,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAI9E,QAAA,OAAO,GAAuC,IAAW,CAAC;AACvE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAIxD,QAAA,SAAS,GAA2C,IAAW,CAAC;AAC7E,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;AAI5D,QAAA,sBAAsB,GAAqE,IAAW,CAAC;AACpH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAGnG,MAAM,OAAO,GAAG;IACZ,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE;IAC/B,SAAS,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,GAAW,EAAmB,EAAE;QACpE,QAAQ,IAAI,EAAE;YACV,KAAK,uDAAuD;gBACxD,OAAO,IAAI,8BAAsB,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACpE,KAAK,6DAA6D;gBAC9D,OAAO,IAAI,iCAAyB,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACvE,KAAK,uCAAuC;gBACxC,OAAO,IAAI,sBAAc,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YAC5D,KAAK,+CAA+C;gBAChD,OAAO,IAAI,0BAAkB,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YAChE,KAAK,yBAAyB;gBAC1B,OAAO,IAAI,eAAO,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACrD,KAAK,6BAA6B;gBAC9B,OAAO,IAAI,iBAAS,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACvD,KAAK,uDAAuD;gBACxD,OAAO,IAAI,8BAAsB,CAAC,IAAI,EAAO,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YACpE;gBACI,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;SACxD;IACL,CAAC;CACJ,CAAC;AACF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,4BAA4B,EAAE,OAAO,CAAC,CAAA;AACnF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,+BAA+B,EAAE,OAAO,CAAC,CAAA;AACtF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAA;AAC3E,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAA;AAC/E,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;AACpE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;AACtE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,4BAA4B,EAAE,OAAO,CAAC,CAAA"}

package/amp/resourcePolicy.d.ts

@@ -0,0 +1,214 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "../types/input";
+import * as outputs from "../types/output";
+/**
+ * Manages an Amazon Managed Service for Prometheus (AMP) Resource Policy.
+ *
+ * Resource-based policies allow you to grant permissions to other AWS accounts or services to access your Prometheus workspace. This enables cross-account access and fine-grained permissions for workspace sharing.
+ *
+ * ## Example Usage
+ *
+ * ### Basic Resource Policy
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const exampleWorkspace = new aws.amp.Workspace("example", {alias: "example-workspace"});
+ * const current = aws.getCallerIdentity({});
+ * const example = pulumi.all([current, exampleWorkspace.arn]).apply(([current, arn]) => aws.iam.getPolicyDocumentOutput({
+ *     statements: [{
+ *         effect: "Allow",
+ *         principals: [{
+ *             type: "AWS",
+ *             identifiers: [current.accountId],
+ *         }],
+ *         actions: [
+ *             "aps:RemoteWrite",
+ *             "aps:QueryMetrics",
+ *             "aps:GetSeries",
+ *             "aps:GetLabels",
+ *             "aps:GetMetricMetadata",
+ *         ],
+ *         resources: [arn],
+ *     }],
+ * }));
+ * const exampleResourcePolicy = new aws.amp.ResourcePolicy("example", {
+ *     workspaceId: exampleWorkspace.id,
+ *     policyDocument: example.apply(example => example.json),
+ * });
+ * ```
+ *
+ * ### Cross-Account Access
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = new aws.amp.Workspace("example", {alias: "example-workspace"});
+ * const crossAccount = aws.iam.getPolicyDocumentOutput({
+ *     statements: [{
+ *         effect: "Allow",
+ *         principals: [{
+ *             type: "AWS",
+ *             identifiers: ["arn:aws:iam::123456789012:root"],
+ *         }],
+ *         actions: [
+ *             "aps:RemoteWrite",
+ *             "aps:QueryMetrics",
+ *         ],
+ *         resources: [example.arn],
+ *     }],
+ * });
+ * const crossAccountResourcePolicy = new aws.amp.ResourcePolicy("cross_account", {
+ *     workspaceId: example.id,
+ *     policyDocument: crossAccount.apply(crossAccount => crossAccount.json),
+ * });
+ * ```
+ *
+ * ### Service-Specific Access
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = new aws.amp.Workspace("example", {alias: "example-workspace"});
+ * const serviceAccess = aws.iam.getPolicyDocumentOutput({
+ *     statements: [{
+ *         effect: "Allow",
+ *         principals: [{
+ *             type: "Service",
+ *             identifiers: ["grafana.amazonaws.com"],
+ *         }],
+ *         actions: [
+ *             "aps:QueryMetrics",
+ *             "aps:GetSeries",
+ *             "aps:GetLabels",
+ *             "aps:GetMetricMetadata",
+ *         ],
+ *         resources: [example.arn],
+ *     }],
+ * });
+ * const serviceAccessResourcePolicy = new aws.amp.ResourcePolicy("service_access", {
+ *     workspaceId: example.id,
+ *     policyDocument: serviceAccess.apply(serviceAccess => serviceAccess.json),
+ * });
+ * ```
+ *
+ * ## Supported Actions
+ *
+ * The following actions are supported in resource policies for Prometheus workspaces:
+ *
+ * * `aps:RemoteWrite` - Allows writing metrics to the workspace
+ * * `aps:QueryMetrics` - Allows querying metrics from the workspace
+ * * `aps:GetSeries` - Allows retrieving time series data
+ * * `aps:GetLabels` - Allows retrieving label names and values
+ * * `aps:GetMetricMetadata` - Allows retrieving metric metadata
+ *
+ * ## Notes
+ *
+ * * Only Prometheus-compatible APIs can be used for workspace sharing. Non-Prometheus-compatible APIs added to the policy will be ignored.
+ * * If your workspace uses customer-managed KMS keys for encryption, you must grant the principals in your resource-based policy access to those KMS keys through KMS grants.
+ * * The resource ARN in the policy document must match the workspace ARN that the policy is being attached to.
+ * * Resource policies enable cross-account access and fine-grained permissions for Prometheus workspaces.
+ *
+ * ## Import
+ *
+ * Using `pulumi import`, import AMP Resource Policies using the workspace ID. For example:
+ *
+ * ```sh
+ * $ pulumi import aws:amp/resourcePolicy:ResourcePolicy example ws-12345678-90ab-cdef-1234-567890abcdef
+ * ```
+ */
+export declare class ResourcePolicy extends pulumi.CustomResource {
+    /**
+     * Get an existing ResourcePolicy resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ResourcePolicyState, opts?: pulumi.CustomResourceOptions): ResourcePolicy;
+    /**
+     * Returns true if the given object is an instance of ResourcePolicy.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj: any): obj is ResourcePolicy;
+    /**
+     * The JSON policy document to use as the resource-based policy. This policy defines the permissions that other AWS accounts or services have to access your workspace.
+     *
+     * The following arguments are optional:
+     */
+    readonly policyDocument: pulumi.Output<string>;
+    /**
+     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
+     */
+    readonly region: pulumi.Output<string>;
+    /**
+     * The revision ID of the current resource-based policy.
+     */
+    readonly revisionId: pulumi.Output<string>;
+    readonly timeouts: pulumi.Output<outputs.amp.ResourcePolicyTimeouts | undefined>;
+    /**
+     * The ID of the workspace to attach the resource-based policy to.
+     */
+    readonly workspaceId: pulumi.Output<string>;
+    /**
+     * Create a ResourcePolicy resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: ResourcePolicyArgs, opts?: pulumi.CustomResourceOptions);
+}
+/**
+ * Input properties used for looking up and filtering ResourcePolicy resources.
+ */
+export interface ResourcePolicyState {
+    /**
+     * The JSON policy document to use as the resource-based policy. This policy defines the permissions that other AWS accounts or services have to access your workspace.
+     *
+     * The following arguments are optional:
+     */
+    policyDocument?: pulumi.Input<string>;
+    /**
+     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
+     */
+    region?: pulumi.Input<string>;
+    /**
+     * The revision ID of the current resource-based policy.
+     */
+    revisionId?: pulumi.Input<string>;
+    timeouts?: pulumi.Input<inputs.amp.ResourcePolicyTimeouts>;
+    /**
+     * The ID of the workspace to attach the resource-based policy to.
+     */
+    workspaceId?: pulumi.Input<string>;
+}
+/**
+ * The set of arguments for constructing a ResourcePolicy resource.
+ */
+export interface ResourcePolicyArgs {
+    /**
+     * The JSON policy document to use as the resource-based policy. This policy defines the permissions that other AWS accounts or services have to access your workspace.
+     *
+     * The following arguments are optional:
+     */
+    policyDocument: pulumi.Input<string>;
+    /**
+     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
+     */
+    region?: pulumi.Input<string>;
+    /**
+     * The revision ID of the current resource-based policy.
+     */
+    revisionId?: pulumi.Input<string>;
+    timeouts?: pulumi.Input<inputs.amp.ResourcePolicyTimeouts>;
+    /**
+     * The ID of the workspace to attach the resource-based policy to.
+     */
+    workspaceId: pulumi.Input<string>;
+}

package/amp/resourcePolicy.js

@@ -0,0 +1,182 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourcePolicy = void 0;
+const pulumi = require("@pulumi/pulumi");
+const utilities = require("../utilities");
+/**
+ * Manages an Amazon Managed Service for Prometheus (AMP) Resource Policy.
+ *
+ * Resource-based policies allow you to grant permissions to other AWS accounts or services to access your Prometheus workspace. This enables cross-account access and fine-grained permissions for workspace sharing.
+ *
+ * ## Example Usage
+ *
+ * ### Basic Resource Policy
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const exampleWorkspace = new aws.amp.Workspace("example", {alias: "example-workspace"});
+ * const current = aws.getCallerIdentity({});
+ * const example = pulumi.all([current, exampleWorkspace.arn]).apply(([current, arn]) => aws.iam.getPolicyDocumentOutput({
+ *     statements: [{
+ *         effect: "Allow",
+ *         principals: [{
+ *             type: "AWS",
+ *             identifiers: [current.accountId],
+ *         }],
+ *         actions: [
+ *             "aps:RemoteWrite",
+ *             "aps:QueryMetrics",
+ *             "aps:GetSeries",
+ *             "aps:GetLabels",
+ *             "aps:GetMetricMetadata",
+ *         ],
+ *         resources: [arn],
+ *     }],
+ * }));
+ * const exampleResourcePolicy = new aws.amp.ResourcePolicy("example", {
+ *     workspaceId: exampleWorkspace.id,
+ *     policyDocument: example.apply(example => example.json),
+ * });
+ * ```
+ *
+ * ### Cross-Account Access
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = new aws.amp.Workspace("example", {alias: "example-workspace"});
+ * const crossAccount = aws.iam.getPolicyDocumentOutput({
+ *     statements: [{
+ *         effect: "Allow",
+ *         principals: [{
+ *             type: "AWS",
+ *             identifiers: ["arn:aws:iam::123456789012:root"],
+ *         }],
+ *         actions: [
+ *             "aps:RemoteWrite",
+ *             "aps:QueryMetrics",
+ *         ],
+ *         resources: [example.arn],
+ *     }],
+ * });
+ * const crossAccountResourcePolicy = new aws.amp.ResourcePolicy("cross_account", {
+ *     workspaceId: example.id,
+ *     policyDocument: crossAccount.apply(crossAccount => crossAccount.json),
+ * });
+ * ```
+ *
+ * ### Service-Specific Access
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = new aws.amp.Workspace("example", {alias: "example-workspace"});
+ * const serviceAccess = aws.iam.getPolicyDocumentOutput({
+ *     statements: [{
+ *         effect: "Allow",
+ *         principals: [{
+ *             type: "Service",
+ *             identifiers: ["grafana.amazonaws.com"],
+ *         }],
+ *         actions: [
+ *             "aps:QueryMetrics",
+ *             "aps:GetSeries",
+ *             "aps:GetLabels",
+ *             "aps:GetMetricMetadata",
+ *         ],
+ *         resources: [example.arn],
+ *     }],
+ * });
+ * const serviceAccessResourcePolicy = new aws.amp.ResourcePolicy("service_access", {
+ *     workspaceId: example.id,
+ *     policyDocument: serviceAccess.apply(serviceAccess => serviceAccess.json),
+ * });
+ * ```
+ *
+ * ## Supported Actions
+ *
+ * The following actions are supported in resource policies for Prometheus workspaces:
+ *
+ * * `aps:RemoteWrite` - Allows writing metrics to the workspace
+ * * `aps:QueryMetrics` - Allows querying metrics from the workspace
+ * * `aps:GetSeries` - Allows retrieving time series data
+ * * `aps:GetLabels` - Allows retrieving label names and values
+ * * `aps:GetMetricMetadata` - Allows retrieving metric metadata
+ *
+ * ## Notes
+ *
+ * * Only Prometheus-compatible APIs can be used for workspace sharing. Non-Prometheus-compatible APIs added to the policy will be ignored.
+ * * If your workspace uses customer-managed KMS keys for encryption, you must grant the principals in your resource-based policy access to those KMS keys through KMS grants.
+ * * The resource ARN in the policy document must match the workspace ARN that the policy is being attached to.
+ * * Resource policies enable cross-account access and fine-grained permissions for Prometheus workspaces.
+ *
+ * ## Import
+ *
+ * Using `pulumi import`, import AMP Resource Policies using the workspace ID. For example:
+ *
+ * ```sh
+ * $ pulumi import aws:amp/resourcePolicy:ResourcePolicy example ws-12345678-90ab-cdef-1234-567890abcdef
+ * ```
+ */
+class ResourcePolicy extends pulumi.CustomResource {
+    /**
+     * Get an existing ResourcePolicy resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name, id, state, opts) {
+        return new ResourcePolicy(name, state, { ...opts, id: id });
+    }
+    /**
+     * Returns true if the given object is an instance of ResourcePolicy.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === ResourcePolicy.__pulumiType;
+    }
+    constructor(name, argsOrState, opts) {
+        let resourceInputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState;
+            resourceInputs["policyDocument"] = state?.policyDocument;
+            resourceInputs["region"] = state?.region;
+            resourceInputs["revisionId"] = state?.revisionId;
+            resourceInputs["timeouts"] = state?.timeouts;
+            resourceInputs["workspaceId"] = state?.workspaceId;
+        }
+        else {
+            const args = argsOrState;
+            if (args?.policyDocument === undefined && !opts.urn) {
+                throw new Error("Missing required property 'policyDocument'");
+            }
+            if (args?.workspaceId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'workspaceId'");
+            }
+            resourceInputs["policyDocument"] = args?.policyDocument;
+            resourceInputs["region"] = args?.region;
+            resourceInputs["revisionId"] = args?.revisionId;
+            resourceInputs["timeouts"] = args?.timeouts;
+            resourceInputs["workspaceId"] = args?.workspaceId;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(ResourcePolicy.__pulumiType, name, resourceInputs, opts);
+    }
+}
+exports.ResourcePolicy = ResourcePolicy;
+/** @internal */
+ResourcePolicy.__pulumiType = 'aws:amp/resourcePolicy:ResourcePolicy';
+//# sourceMappingURL=resourcePolicy.js.map

package/amp/resourcePolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourcePolicy.js","sourceRoot":"","sources":["../../amp/resourcePolicy.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AAIzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AACH,MAAa,cAAe,SAAQ,MAAM,CAAC,cAAc;IACrD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAA2B,EAAE,IAAmC;QACzH,OAAO,IAAI,cAAc,CAAC,IAAI,EAAO,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,cAAc,CAAC,YAAY,CAAC;IAC/D,CAAC;IA8BD,YAAY,IAAY,EAAE,WAAsD,EAAE,IAAmC;QACjH,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAA8C,CAAC;YAC7D,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,EAAE,cAAc,CAAC;YACzD,cAAc,CAAC,QAAQ,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC;YACzC,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,EAAE,UAAU,CAAC;YACjD,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC;YAC7C,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,EAAE,WAAW,CAAC;SACtD;aAAM;YACH,MAAM,IAAI,GAAG,WAA6C,CAAC;YAC3D,IAAI,IAAI,EAAE,cAAc,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACjD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;aACjE;YACD,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;aAC9D;YACD,cAAc,CAAC,gBAAgB,CAAC,GAAG,IAAI,EAAE,cAAc,CAAC;YACxD,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC;YAChD,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC;YAC5C,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;SACrD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;;AAlFL,wCAmFC;AArEG,gBAAgB;AACO,2BAAY,GAAG,uCAAuC,CAAC"}