Package: confluentcloud-iam-serviceaccount
ConfluentCloud::IAM::ServiceAccountAllows to create a new Service Account into an organization in Confluent Cloud via API.See thedocsfor propertiesInstallRequirementsYou needAn account on Confluent Cloud PlatformHave a Confluent Cloud API KeyAWS Account, and for the following installation steps, aws cliConfluent API Key# Optionally create an API key via the CLIconfluentapi-keycreate--resourcecloud-ojsonexportAPI_KEY=<APIKEYRETURNED>exportAPI_SECRET=<APISECRETRETURNED>Create a secret in AWS Secrets Manager with the API keyawscloudformationdeploy--stack-nameconfluent-cloud-api-credentials--templateconfluent-secrets.template\--parameter-overridesConfluentApiKey=${API_KEY}ConfluentSecretKey=${API_SECRET}Save the secret ARN into a variableexportSECRET_ARN=`awscloudformationdescribe-stack-resources--stack-nameconfluent-cloud-api-credentials--logical-resource-idConfluentSecret|jq-r.StackResources[0].PhysicalResourceId`Activate the 3rd party CloudFormation resourceOption 1 - IAM and Resource togetherUsing theactivate.templatewe create IAM roles and enable the resource in the account, all at once.awscloudformationdeploy--stackcfn-resource--confluentcloud-iam-serviceaccount--templateactivate.template\--capabilitiesCAPABILITY_IAMThis option offers the "extra security" to have a different IAM Execution role for that resource than others.Option 2 - IAM first, resource separateMost recommended if you consider enabling multiple ConfluentCloud:: resources publishedWe are going to usecfn-resources-iam-roles.templatetemplate to create theExecutionandLoggingRolefirst, then use these in theactivate.templateas parameters.awscloudformationdeploy--stack-nameiam--cfn--confluentcloud-resources--templatecfn-resources-iam-roles.template\--capabilitiesCAPABILITY_IAMExport the IAM Roles to env varsEXEC_ROLE_ARN=`awscloudformationdescribe-stacks--stack-nameiam--cfn--confluentcloud-resources|jq-r'.Stacks[0].Outputs[] |  select(.OutputKey=="ExecutionRoleArn")'|jq-r.OutputValue`LOGGING_ROLE_ARN=`awscloudformationdescribe-stacks--stack-nameiam--cfn--confluentcloud-resources|jq-r'.Stacks[0].Outputs[] |  select(.OutputKey=="CloudWatchRoleArn")'|jq-r.OutputValue`Now, we activate the resource using these IAM Rolesawscloudformationdeploy--stackcfn-resource--confluentcloud-iam-serviceaccount--templateactivate.template\--capabilitiesCAPABILITY_IAM\--parameter-overridesExecutionRoleArn=${EXEC_ROLE_ARN}LoggingRoleArn=${LOGGING_ROLE_ARN}Create a new Service accountawscloudformationdeploy--stack-namemy-first-service-account--templateresource-test.template\--parameter-overridesConfluentCloudApiSecrets=${SECRET_ARN}ServiceAccountName=cfn-test-service-accountTroubleshootingIf you are getting errors with the resource, you can see in the logs what issues occurred that lead to this issue.
With the templateactivate.template, you can see that there is a CloudWatch log group that
will be logging the code execution and so you can open anissueon GitHubIf at any point in the logging you'd notice information that is not supposed to be there, please notify it immediately.
With that said, as the "vendor" of that resource, we willneverhave access to these logs or anything in your account.