component: iamEdit helper function

examples/aws-bucket-policy/sst.config.ts

@@ -17,16 +17,15 @@ export default $config({
     const bucket = new sst.aws.Bucket("MyBucket", {
       transform: {
         policy: (args) => {
-          // use $jsonParse and $jsonStringify helper functions to manipulate JSON strings
+          // use sst.aws.iamEdit helper function to manipulate IAM policy
           // containing Output values from components
-          args.policy = $jsonParse(args.policy).apply((policy) => {
+          args.policy = sst.aws.iamEdit(args.policy, (policy) => {
             policy.Statement.push({
               Effect: "Allow",
               Principal: { Service: "ses.amazonaws.com" },
               Action: "s3:PutObject",
               Resource: $interpolate`arn:aws:s3:::${args.bucket}/*`,
             });
-            return $jsonStringify(policy);
           });
         },
       },

platform/src/components/aws/iam-edit.ts

@@ -0,0 +1,22 @@
+import { Input, jsonStringify, output, UnwrappedObject } from "@pulumi/pulumi";
+import { iam } from "@pulumi/aws";
+import { Prettify } from "../component";
+
+type PartialUnwrappedPolicyDocument = {
+  Id?: string;
+  Version: "2008-10-17" | "2012-10-17";
+  Statement: Input<iam.PolicyStatement>[];
+};
+
+export function iamEdit(
+  policy: Input<iam.PolicyDocument | string>,
+  cb: (doc: Prettify<PartialUnwrappedPolicyDocument>) => void,
+) {
+  return output(policy).apply((v) => {
+    const json = typeof v === "string" ? JSON.parse(v) : v;
+    cb(json);
+    return iam.getPolicyDocumentOutput({
+      sourcePolicyDocuments: [jsonStringify(json)],
+    }).json;
+  });
+}

platform/src/components/aws/index.ts

@@ -34,6 +34,7 @@ export * from "./vpc.js";
 export * from "./react.js";
 export { linkable } from "./linkable.js";
 export { permission } from "./permission.js";
+export { iamEdit } from "./iam-edit.js";
 
 // internal components
 export * from "./cdn.js";