i --type aws

Resource Types

Generic AWS resourceThis resource type allows consumers to use the AWS Service Connector to connect to any AWS service or resource. When used by connector clients, they are provided a generic Python boto3 session instance pre-configured with AWS credentials. This session can then be used to create boto3 clients for any particular AWS service.

This generic AWS resource type is meant to be used with Stack Components that are not represented by other, more specific resource types, like S3 buckets, Kubernetes clusters, or Docker registries. It should be accompanied by a matching set of AWS permissions that allow access to the set of remote resources required by the client(s).

The resource name represents the AWS region that the connector is authorized to access.

S3 bucket

Allows users to connect to S3 buckets. When used by connector consumers, they are provided a pre-configured boto3 S3 client instance.

The configured credentials must have at least the following AWS IAM permissions associated with the ARNs of S3 buckets that the connector will be allowed to access (e.g. arn:aws:s3:::* and arn:aws:s3:::*/* represent all the available S3 buckets).

s3:ListBucket

s3:GetObject

s3:PutObject

s3:DeleteObject

s3:ListAllMyBuckets

If you are using the AWS IAM role, Session Token, or Federation Token authentication methods, you don't have to worry too much about restricting the permissions of the AWS credentials that you use to access the AWS cloud resources. These authentication methods already support automatically generating temporary tokens with permissions down-scoped to the minimum required to access the target resource.

If set, the resource name must identify an S3 bucket using one of the following formats:

S3 bucket URI (canonical resource name): s3://{bucket-name}

S3 bucket ARN: arn:aws:s3:::{bucket-name}

S3 bucket name: {bucket-name}

EKS Kubernetes cluster