aws-cdk-lib 2.145.0__py3-none-any.whl → 2.146.0__py3-none-any.whl

aws_cdk/aws_iam/__init__.py

@@ -12866,16 +12866,21 @@ class Role(
 
     Example::
 
-        # definition: sfn.IChainable
-        role = iam.Role(self, "Role",
-            assumed_by=iam.ServicePrincipal("lambda.amazonaws.com")
-        )
-        state_machine = sfn.StateMachine(self, "StateMachine",
-            definition_body=sfn.DefinitionBody.from_chainable(definition)
+        # Option 3: Create a new role that allows the account root principal to assume. Add this role in the `system:masters` and witch to this role from the AWS console.
+        # cluster: eks.Cluster
+        
+        
+        console_read_only_role = iam.Role(self, "ConsoleReadOnlyRole",
+            assumed_by=iam.ArnPrincipal("arn_for_trusted_principal")
         )
+        console_read_only_role.add_to_policy(iam.PolicyStatement(
+            actions=["eks:AccessKubernetesApi", "eks:Describe*", "eks:List*"
+            ],
+            resources=[cluster.cluster_arn]
+        ))
         
-        # Give role permission to get execution history of ALL executions for the state machine
-        state_machine.grant_execution(role, "states:GetExecutionHistory")
+        # Add this role to system:masters RBAC group
+        cluster.aws_auth.add_masters_role(console_read_only_role)
     '''
 
     def __init__(

aws_cdk/aws_opensearchservice/__init__.py

@@ -5358,6 +5358,12 @@ class EngineVersion(
         '''AWS OpenSearch 2.11.'''
         return typing.cast("EngineVersion", jsii.sget(cls, "OPENSEARCH_2_11"))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="OPENSEARCH_2_13")
+    def OPENSEARCH_2_13(cls) -> "EngineVersion":
+        '''AWS OpenSearch 2.13.'''
+        return typing.cast("EngineVersion", jsii.sget(cls, "OPENSEARCH_2_13"))
+
     @jsii.python.classproperty
     @jsii.member(jsii_name="OPENSEARCH_2_3")
     def OPENSEARCH_2_3(cls) -> "EngineVersion":