Resource: awsAcmpcaPolicy

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
const dataAwsIamPolicyDocumentExample =
  new aws.dataAwsIamPolicyDocument.DataAwsIamPolicyDocument(this, "example", {
    statement: [
      {
        actions: [
          "acm-pca:DescribeCertificateAuthority",
          "acm-pca:GetCertificate",
          "acm-pca:GetCertificateAuthorityCertificate",
          "acm-pca:ListPermissions",
          "acm-pca:ListTags",
        ],
        effect: "Allow",
        principals: [
          {
            identifiers: ["${data.aws_caller_identity.current.account_id}"],
            type: "AWS",
          },
        ],
        resources: ["${aws_acmpca_certificate_authority.example.arn}"],
        sid: "1",
      },
      {
        actions: ["acm-pca:IssueCertificate"],
        condition: [
          {
            test: "StringEquals",
            values: ["arn:aws:acm-pca:::template/EndEntityCertificate/V1"],
            variable: "acm-pca:TemplateArn",
          },
        ],
        effect: "${Allow}",
        principals: [
          {
            identifiers: ["${data.aws_caller_identity.current.account_id}"],
            type: "AWS",
          },
        ],
        resources: ["${aws_acmpca_certificate_authority.example.arn}"],
        sid: "2",
      },
    ],
  });
const awsAcmpcaPolicyExample = new aws.acmpcaPolicy.AcmpcaPolicy(
  this,
  "example_1",
  {
    policy: dataAwsIamPolicyDocumentExample.json,
    resourceArn: "${aws_acmpca_certificate_authority.example.arn}",
  }
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
awsAcmpcaPolicyExample.overrideLogicalId("example");