Class DefaultIamStatement.Builder

java.lang.Object

software.amazon.awssdk.policybuilder.iam.internal.DefaultIamStatement.Builder

All Implemented Interfaces:

IamStatement.Builder, Buildable, CopyableBuilder<IamStatement.Builder,IamStatement>, SdkBuilder<IamStatement.Builder,IamStatement>

Enclosing class:

DefaultIamStatement

public static class DefaultIamStatement.Builder
extends Object
implements IamStatement.Builder

Method Summary

Modifier and Type	Method	Description
IamStatement.Builder	actionIds(Collection<String> actions)	Configure the Action element of the statement, specifying the actions that are allowed or denied.
IamStatement.Builder	actions(Collection<IamAction> actions)	Configure the Action element of the statement, specifying the actions that are allowed or denied.
IamStatement.Builder	addAction(String action)	Append an Action element to this statement, specifying an action that is allowed or denied.
IamStatement.Builder	addAction(IamAction action)	Append an Action element to this statement, specifying an action that is allowed or denied.
IamStatement.Builder	addCondition(String operator, String key, String value)	Append a Condition to the statement, specifying a condition in which the statement is in effect.
IamStatement.Builder	addCondition(Consumer<IamCondition.Builder> condition)	Append a Condition to the statement, specifying a condition in which the statement is in effect.
IamStatement.Builder	addCondition(IamCondition condition)	Append a Condition to the statement, specifying a condition in which the statement is in effect.
IamStatement.Builder	addCondition(IamConditionOperator operator, String key, String value)	Append a Condition to the statement, specifying a condition in which the statement is in effect.
IamStatement.Builder	addCondition(IamConditionOperator operator, IamConditionKey key, String value)	Append a Condition to the statement, specifying a condition in which the statement is in effect.
IamStatement.Builder	addConditions(String operator, String key, Collection<String> values)	Append multiple Conditions to the statement, specifying conditions in which the statement is in effect.
IamStatement.Builder	addConditions(IamConditionOperator operator, String key, Collection<String> values)	Append multiple Conditions to the statement, specifying conditions in which the statement is in effect.
IamStatement.Builder	addConditions(IamConditionOperator operator, IamConditionKey key, Collection<String> values)	Append multiple Conditions to the statement, specifying conditions in which the statement is in effect.
IamStatement.Builder	addNotAction(String notAction)	Append a NotAction element to this statement, specifying an action that is denied or allowed.
IamStatement.Builder	addNotAction(IamAction notAction)	Append a NotAction element to this statement, specifying an action that is denied or allowed.
IamStatement.Builder	addNotPrincipal(String iamPrincipalType, String principal)	Append a NotPrincipal to this statement, specifying that all principals are affected by the policy except the ones listed.
IamStatement.Builder	addNotPrincipal(Consumer<IamPrincipal.Builder> notPrincipal)	Append a NotPrincipal to this statement, specifying that all principals are affected by the policy except the ones listed.
IamStatement.Builder	addNotPrincipal(IamPrincipal notPrincipal)	Append a NotPrincipal to this statement, specifying that all principals are affected by the policy except the ones listed.
IamStatement.Builder	addNotPrincipal(IamPrincipalType iamPrincipalType, String principal)	Append a NotPrincipal to this statement, specifying that all principals are affected by the policy except the ones listed.
IamStatement.Builder	addNotPrincipals(String notPrincipalType, Collection<String> notPrincipals)	Append multiple NotPrincipals to this statement, specifying that all principals are affected by the policy except the ones listed.
IamStatement.Builder	addNotPrincipals(IamPrincipalType notPrincipalType, Collection<String> notPrincipals)	Append multiple NotPrincipals to this statement, specifying that all principals are affected by the policy except the ones listed.
IamStatement.Builder	addNotResource(String notResource)	Append a NotResource element to the statement, specifying that the statement should apply to every resource except the ones listed.
IamStatement.Builder	addNotResource(IamResource notResource)	Append a NotResource element to the statement, specifying that the statement should apply to every resource except the ones listed.
IamStatement.Builder	addPrincipal(String iamPrincipalType, String principal)	Append a Principal to this statement, specifying a principal that is allowed or denied access to a resource.
IamStatement.Builder	addPrincipal(Consumer<IamPrincipal.Builder> principal)	Append a Principal to this statement, specifying a principal that is allowed or denied access to a resource.
IamStatement.Builder	addPrincipal(IamPrincipal principal)	Append a Principal to this statement, specifying a principal that is allowed or denied access to a resource.
IamStatement.Builder	addPrincipal(IamPrincipalType iamPrincipalType, String principal)	Append a Principal to this statement, specifying a principal that is allowed or denied access to a resource.
IamStatement.Builder	addPrincipals(String principalType, Collection<String> principals)	Append multiple Principals to this statement, specifying principals that are allowed or denied access to a resource.
IamStatement.Builder	addPrincipals(IamPrincipalType principalType, Collection<String> principals)	Append multiple Principals to this statement, specifying principals that are allowed or denied access to a resource.
IamStatement.Builder	addResource(String resource)	Append a Resource element to the statement, specifying a resource that the statement covers.
IamStatement.Builder	addResource(IamResource resource)	Append a Resource element to the statement, specifying a resource that the statement covers.
IamStatement	build()	An immutable object that is created from the properties that have been set on the builder.
IamStatement.Builder	conditions(Collection<IamCondition> conditions)	Configure the Condition element of the statement, specifying the conditions in which the statement is in effect.
IamStatement.Builder	effect(String effect)	Configure the Effect element of the policy, specifying whether the statement results in an allow or deny.
IamStatement.Builder	effect(IamEffect effect)	Configure the Effect element of the policy, specifying whether the statement results in an allow or deny.
IamStatement.Builder	notActionIds(Collection<String> notActions)	Configure the NotAction element of the statement, specifying actions that are denied or allowed.
IamStatement.Builder	notActions(Collection<IamAction> notActions)	Configure the NotAction element of the statement, specifying actions that are denied or allowed.
IamStatement.Builder	notPrincipals(Collection<IamPrincipal> notPrincipals)	Configure the NotPrincipal element of the statement, specifying that all principals are affected by the policy except the ones listed.
IamStatement.Builder	notResourceIds(Collection<String> notResources)	Configure the NotResource element of the statement, specifying that the statement should apply to every resource except the ones listed.
IamStatement.Builder	notResources(Collection<IamResource> notResources)	Configure the NotResource element of the statement, specifying that the statement should apply to every resource except the ones listed.
IamStatement.Builder	principals(Collection<IamPrincipal> principals)	Configure the Principal element of the statement, specifying the principals that are allowed or denied access to a resource.
IamStatement.Builder	resourceIds(Collection<String> resources)	Configure the Resource element of the statement, specifying the resource(s) that the statement covers.
IamStatement.Builder	resources(Collection<IamResource> resources)	Configure the Resource element of the statement, specifying the resource(s) that the statement covers.
IamStatement.Builder	sid(String sid)	Configure the Sid element of the policy, specifying an identifier for the statement.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface software.amazon.awssdk.utils.builder.CopyableBuilder

copy

Methods inherited from interface software.amazon.awssdk.utils.builder.SdkBuilder

applyMutation

Method Details

sid

public IamStatement.Builder sid(String sid)

Description copied from interface: IamStatement.Builder

Configure the Sid element of the policy, specifying an identifier for the statement.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookMetadata") // An identifier for the statement
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

sid in interface IamStatement.Builder

See Also:

• Sid user guide

effect

public IamStatement.Builder effect(IamEffect effect)

Description copied from interface: IamStatement.Builder

Configure the Effect element of the policy, specifying whether the statement results in an allow or deny.

This value is required.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookMetadata")
                .effect(IamEffect.ALLOW) // The statement ALLOWS access
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

effect in interface IamStatement.Builder

See Also:

• IamEffect
• Effect user guide

effect

public IamStatement.Builder effect(String effect)

Description copied from interface: IamStatement.Builder

Configure the Effect element of the policy, specifying whether the statement results in an allow or deny.

This works the same as IamStatement.Builder.effect(IamEffect), except you do not need to IamEffect. This value is required.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookMetadata")
                .effect("Allow") // The statement ALLOWs access
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

effect in interface IamStatement.Builder

See Also:

• IamEffect
• Effect user guide

principals

public IamStatement.Builder principals(Collection<IamPrincipal> principals)

Description copied from interface: IamStatement.Builder

Configure the Principal element of the statement, specifying the principals that are allowed or denied access to a resource.

This will replace any other principals already added to the statement.

List<IamPrincipal> bookReaderRoles =
    IamPrincipal.createAll("AWS",
                           Arrays.asList("arn:aws:iam::123456789012:role/books-service",
                                         "arn:aws:iam::123456789012:role/books-operator"));

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.ALLOW)
                .principals(bookReaderRoles) // This statement allows access to the books service and operators
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

principals in interface IamStatement.Builder

See Also:

• IamPrincipal
• Principal user guide

addPrincipal

public IamStatement.Builder addPrincipal(IamPrincipal principal)

Description copied from interface: IamStatement.Builder

Append a Principal to this statement, specifying a principal that is allowed or denied access to a resource.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.ALLOW)
                 // This statement allows access to the books service:
                .addPrincipal(IamPrincipal.create("AWS", "arn:aws:iam::123456789012:role/books-service"))
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addPrincipal in interface IamStatement.Builder

See Also:

• Principal user guide

addPrincipal

public IamStatement.Builder addPrincipal(Consumer<IamPrincipal.Builder> principal)

Description copied from interface: IamStatement.Builder

Append a Principal to this statement, specifying a principal that is allowed or denied access to a resource.

This works the same as IamStatement.Builder.addPrincipal(IamPrincipal), except you do not need to specify IamPrincipal .builder() or build().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.ALLOW)
                // This statement allows access to the books service:
                .addPrincipal(p -> p.type("AWS").id("arn:aws:iam::123456789012:role/books-service"))
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addPrincipal in interface IamStatement.Builder

See Also:

• Principal user guide

addPrincipal

public IamStatement.Builder addPrincipal(IamPrincipalType iamPrincipalType,
 String principal)

Description copied from interface: IamStatement.Builder

Append a Principal to this statement, specifying a principal that is allowed or denied access to a resource.

This works the same as IamStatement.Builder.addPrincipal(IamPrincipal), except you do not need to specify IamPrincipal .create().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.ALLOW)
                // This statement allows access to the books service:
                .addPrincipal(IamPrincipalType.AWS, "arn:aws:iam::123456789012:role/books-service")
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addPrincipal in interface IamStatement.Builder

See Also:

• Principal user guide

addPrincipal

public IamStatement.Builder addPrincipal(String iamPrincipalType,
 String principal)

Description copied from interface: IamStatement.Builder

Append a Principal to this statement, specifying a principal that is allowed or denied access to a resource.

This works the same as IamStatement.Builder.addPrincipal(IamPrincipalType, String), except you do not need to specify IamPrincipalType.create().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.ALLOW)
                // This statement allows access to the books service:
                .addPrincipal("AWS", "arn:aws:iam::123456789012:role/books-service")
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addPrincipal in interface IamStatement.Builder

See Also:

• Principal user guide

addPrincipals

public IamStatement.Builder addPrincipals(IamPrincipalType principalType,
 Collection<String> principals)

Description copied from interface: IamStatement.Builder

Append multiple Principals to this statement, specifying principals that are allowed or denied access to a resource.

This works the same as calling IamStatement.Builder.addPrincipal(IamPrincipalType, String) multiple times with the same IamPrincipalType.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.ALLOW)
                 // This statement allows access to the books service and operators:
                .addPrincipals(IamPrincipalType.AWS,
                               Arrays.asList("arn:aws:iam::123456789012:role/books-service",
                                            "arn:aws:iam::123456789012:role/books-operator"))
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addPrincipals in interface IamStatement.Builder

See Also:

• Principal user guide

addPrincipals

public IamStatement.Builder addPrincipals(String principalType,
 Collection<String> principals)

Description copied from interface: IamStatement.Builder

Append multiple Principals to this statement, specifying principals that are allowed or denied access to a resource.

This works the same as calling IamStatement.Builder.addPrincipal(String, String) multiple times with the same IamPrincipalType.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.ALLOW)
                 // This statement allows access to the books service and operators:
                .addPrincipals("AWS", Arrays.asList("arn:aws:iam::123456789012:role/books-service",
                                                    "arn:aws:iam::123456789012:role/books-operator"))
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addPrincipals in interface IamStatement.Builder

See Also:

• Principal user guide

notPrincipals

public IamStatement.Builder notPrincipals(Collection<IamPrincipal> notPrincipals)

Description copied from interface: IamStatement.Builder

Configure the NotPrincipal element of the statement, specifying that all principals are affected by the policy except the ones listed.

Very few scenarios require the use of NotPrincipal. We recommend that you explore other authorization options before you decide to use NotPrincipal. NotPrincipal can only be used with IamEffect.DENY statements.

This will replace any other not-principals already added to the statement.

List<IamPrincipal> bookReaderRoles =
    IamPrincipal.createAll("AWS",
                           Arrays.asList("arn:aws:iam::123456789012:role/books-service",
                                         "arn:aws:iam::123456789012:role/books-operator"));

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.DENY)
                 // This statement denies access to everyone except the books service and operators:
                .notPrincipals(bookReaderRoles)
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

notPrincipals in interface IamStatement.Builder

See Also:

• NotPrincipal user guide

addNotPrincipal

public IamStatement.Builder addNotPrincipal(IamPrincipal notPrincipal)

Description copied from interface: IamStatement.Builder

Append a NotPrincipal to this statement, specifying that all principals are affected by the policy except the ones listed.

Very few scenarios require the use of NotPrincipal. We recommend that you explore other authorization options before you decide to use NotPrincipal. NotPrincipal can only be used with IamEffect.DENY statements.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.DENY)
                 // This statement denies access to everyone except the books service:
                .addNotPrincipal(IamPrincipal.create("AWS", "arn:aws:iam::123456789012:role/books-service"))
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addNotPrincipal in interface IamStatement.Builder

See Also:

• NotPrincipal user guide

addNotPrincipal

public IamStatement.Builder addNotPrincipal(Consumer<IamPrincipal.Builder> notPrincipal)

Description copied from interface: IamStatement.Builder

Append a NotPrincipal to this statement, specifying that all principals are affected by the policy except the ones listed.

Very few scenarios require the use of NotPrincipal. We recommend that you explore other authorization options before you decide to use NotPrincipal. NotPrincipal can only be used with IamEffect.DENY statements.

This works the same as IamStatement.Builder.addNotPrincipal(IamPrincipal), except you do not need to specify IamPrincipal .builder() or build().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.DENY)
                 // This statement denies access to everyone except the books service:
                .addNotPrincipal(p -> p.type("AWS").id("arn:aws:iam::123456789012:role/books-service"))
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addNotPrincipal in interface IamStatement.Builder

See Also:

• NotPrincipal user guide

addNotPrincipal

public IamStatement.Builder addNotPrincipal(IamPrincipalType iamPrincipalType,
 String principal)

Description copied from interface: IamStatement.Builder

Append a NotPrincipal to this statement, specifying that all principals are affected by the policy except the ones listed.

Very few scenarios require the use of NotPrincipal. We recommend that you explore other authorization options before you decide to use NotPrincipal. NotPrincipal can only be used with IamEffect.DENY statements.

This works the same as IamStatement.Builder.addNotPrincipal(IamPrincipal), except you do not need to specify IamPrincipal .create().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.DENY)
                 // This statement denies access to everyone except the books service:
                .addNotPrincipal(IamPrincipalType.AWS, "arn:aws:iam::123456789012:role/books-service")
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addNotPrincipal in interface IamStatement.Builder

See Also:

• NotPrincipal user guide

addNotPrincipal

public IamStatement.Builder addNotPrincipal(String iamPrincipalType,
 String principal)

Description copied from interface: IamStatement.Builder

Append a NotPrincipal to this statement, specifying that all principals are affected by the policy except the ones listed.

Very few scenarios require the use of NotPrincipal. We recommend that you explore other authorization options before you decide to use NotPrincipal. NotPrincipal can only be used with IamEffect.DENY statements.

This works the same as IamStatement.Builder.addNotPrincipal(IamPrincipalType, String), except you do not need to specify IamPrincipalType.create().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.DENY)
                 // This statement denies access to everyone except the books service:
                .addNotPrincipal("AWS", "arn:aws:iam::123456789012:role/books-service")
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addNotPrincipal in interface IamStatement.Builder

See Also:

• NotPrincipal user guide

addNotPrincipals

public IamStatement.Builder addNotPrincipals(IamPrincipalType notPrincipalType,
 Collection<String> notPrincipals)

Description copied from interface: IamStatement.Builder

Append multiple NotPrincipals to this statement, specifying that all principals are affected by the policy except the ones listed.

Very few scenarios require the use of NotPrincipal. We recommend that you explore other authorization options before you decide to use NotPrincipal. NotPrincipal can only be used with IamEffect.DENY statements.

This works the same as calling IamStatement.Builder.addNotPrincipal(IamPrincipalType, String) multiple times with the same IamPrincipalType.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.DENY)
                 // This statement denies access to everyone except the books service and operators:
                .addNotPrincipals(IamPrincipalType.AWS,
                                  Arrays.asList("arn:aws:iam::123456789012:role/books-service",
                                               "arn:aws:iam::123456789012:role/books-operator"))
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addNotPrincipals in interface IamStatement.Builder

See Also:

• NotPrincipal user guide

addNotPrincipals

public IamStatement.Builder addNotPrincipals(String notPrincipalType,
 Collection<String> notPrincipals)

Description copied from interface: IamStatement.Builder

Append multiple NotPrincipals to this statement, specifying that all principals are affected by the policy except the ones listed.

Very few scenarios require the use of NotPrincipal. We recommend that you explore other authorization options before you decide to use NotPrincipal. NotPrincipal can only be used with IamEffect.DENY statements.

This works the same as calling IamStatement.Builder.addNotPrincipal(String, String) multiple times with the same IamPrincipalType.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookContent")
                .effect(IamEffect.DENY)
                 // This statement denies access to everyone except the books service and operators:
                .addNotPrincipals("AWS", Arrays.asList("arn:aws:iam::123456789012:role/books-service",
                                                       "arn:aws:iam::123456789012:role/books-operator"))
                .addAction("s3:GetObject")
                .addResource("arn:aws:s3:us-west-2:123456789012:accesspoint/book-content/object/*")
                .build();

Specified by:

addNotPrincipals in interface IamStatement.Builder

See Also:

• NotPrincipal user guide

actions

public IamStatement.Builder actions(Collection<IamAction> actions)

Description copied from interface: IamStatement.Builder

Configure the Action element of the statement, specifying the actions that are allowed or denied.

This will replace any other actions already added to the statement.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadWriteBookMetadata")
                .effect(IamEffect.ALLOW)
                // This statement grants access to read and write items in Amazon DynamoDB:
                .actions(Arrays.asList(IamAction.create("dynamodb:PutItem"),
                                       IamAction.create("dynamodb:GetItem")))
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

actions in interface IamStatement.Builder

See Also:

• Action user guide

actionIds

public IamStatement.Builder actionIds(Collection<String> actions)

Description copied from interface: IamStatement.Builder

Configure the Action element of the statement, specifying the actions that are allowed or denied.

This works the same as IamStatement.Builder.actions(Collection), except you do not need to call IamAction.create() on each action. This will replace any other actions already added to the statement.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadWriteBookMetadata")
                .effect(IamEffect.ALLOW)
                // This statement grants access to read and write items in Amazon DynamoDB:
                .actionIds(Arrays.asList("dynamodb:PutItem", "dynamodb:GetItem"))
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

actionIds in interface IamStatement.Builder

See Also:

• Action user guide

addAction

public IamStatement.Builder addAction(IamAction action)

Description copied from interface: IamStatement.Builder

Append an Action element to this statement, specifying an action that is allowed or denied.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookMetadata")
                .effect(IamEffect.ALLOW)
                // This statement grants access to read items in Amazon DynamoDB:
                .addAction(IamAction.create("dynamodb:GetItem"))
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

addAction in interface IamStatement.Builder

See Also:

• Action user guide

addAction

public IamStatement.Builder addAction(String action)

Description copied from interface: IamStatement.Builder

Append an Action element to this statement, specifying an action that is allowed or denied.

This works the same as IamStatement.Builder.addAction(IamAction), except you do not need to call IamAction.create().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookMetadata")
                .effect(IamEffect.ALLOW)
                // This statement grants access to read items in Amazon DynamoDB:
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

addAction in interface IamStatement.Builder

See Also:

• Action user guide

notActions

public IamStatement.Builder notActions(Collection<IamAction> notActions)

Description copied from interface: IamStatement.Builder

Configure the NotAction element of the statement, specifying actions that are denied or allowed.

This will replace any other not-actions already added to the statement.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantAllButDeleteBookMetadataTable")
                .effect(IamEffect.ALLOW)
                // This statement grants access to do ALL CURRENT AND FUTURE actions against the books table, except
                // dynamodb:DeleteTable
                .notActions(Arrays.asList(IamAction.create("dynamodb:DeleteTable")))
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

notActions in interface IamStatement.Builder

See Also:

• NotAction user guide

notActionIds

public IamStatement.Builder notActionIds(Collection<String> notActions)

Description copied from interface: IamStatement.Builder

Configure the NotAction element of the statement, specifying actions that are denied or allowed.

This works the same as IamStatement.Builder.notActions(Collection), except you do not need to call IamAction.create() on each action. This will replace any other not-actions already added to the statement.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantAllButDeleteBookMetadataTable")
                .effect(IamEffect.ALLOW)
                // This statement grants access to do ALL CURRENT AND FUTURE actions against the books table, except
                // dynamodb:DeleteTable
                .notActionIds(Arrays.asList("dynamodb:DeleteTable"))
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

notActionIds in interface IamStatement.Builder

See Also:

• NotAction user guide

addNotAction

public IamStatement.Builder addNotAction(IamAction notAction)

Description copied from interface: IamStatement.Builder

Append a NotAction element to this statement, specifying an action that is denied or allowed.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantAllButDeleteBookMetadataTable")
                .effect(IamEffect.ALLOW)
                // This statement grants access to do ALL CURRENT AND FUTURE actions against the books table, except
                // dynamodb:DeleteTable
                .addNotAction(IamAction.create("dynamodb:DeleteTable"))
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

addNotAction in interface IamStatement.Builder

See Also:

• NotAction user guide

addNotAction

public IamStatement.Builder addNotAction(String notAction)

Description copied from interface: IamStatement.Builder

Append a NotAction element to this statement, specifying an action that is denied or allowed.

This works the same as IamStatement.Builder.addNotAction(IamAction), except you do not need to call IamAction.create().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantAllButDeleteBookMetadataTable")
                .effect(IamEffect.ALLOW)
                // This statement grants access to do ALL CURRENT AND FUTURE actions against the books table, except
                // dynamodb:DeleteTable
                .addNotAction("dynamodb:DeleteTable")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

addNotAction in interface IamStatement.Builder

See Also:

• NotAction user guide

resources

public IamStatement.Builder resources(Collection<IamResource> resources)

Description copied from interface: IamStatement.Builder

Configure the Resource element of the statement, specifying the resource(s) that the statement covers.

This will replace any other resources already added to the statement.

List<IamResource> resources =
    Arrays.asList(IamResource.create("arn:aws:dynamodb:us-east-2:123456789012:table/books"),
                  IamResource.create("arn:aws:dynamodb:us-east-2:123456789012:table/customers"));

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookAndCustomersMetadata")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                // This statement grants access to the books and customers tables:
                .resources(resources)
                .build();

Specified by:

resources in interface IamStatement.Builder

See Also:

• Resource user guide

resourceIds

public IamStatement.Builder resourceIds(Collection<String> resources)

Description copied from interface: IamStatement.Builder

Configure the Resource element of the statement, specifying the resource(s) that the statement covers.

This works the same as IamStatement.Builder.resources(Collection), except you do not need to call IamResource.create() on each resource. This will replace any other resources already added to the statement.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookAndCustomersMetadata")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                // This statement grants access to the books and customers tables:
                .resourceIds(Arrays.asList("arn:aws:dynamodb:us-east-2:123456789012:table/books",
                                           "arn:aws:dynamodb:us-east-2:123456789012:table/customers"))
                .build();

Specified by:

resourceIds in interface IamStatement.Builder

See Also:

• Resource user guide

addResource

public IamStatement.Builder addResource(IamResource resource)

Description copied from interface: IamStatement.Builder

Append a Resource element to the statement, specifying a resource that the statement covers.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookMetadata")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                // This statement grants access to the books table:
                .addResource(IamResource.create("arn:aws:dynamodb:us-east-2:123456789012:table/books"))
                .build();

Specified by:

addResource in interface IamStatement.Builder

See Also:

• Resource user guide

addResource

public IamStatement.Builder addResource(String resource)

Description copied from interface: IamStatement.Builder

Append a Resource element to the statement, specifying a resource that the statement covers.

This works the same as IamStatement.Builder.addResource(IamResource), except you do not need to call IamResource.create().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBookMetadata")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                // This statement grants access to the books table:
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                .build();

Specified by:

addResource in interface IamStatement.Builder

See Also:

• Resource user guide

notResources

public IamStatement.Builder notResources(Collection<IamResource> notResources)

Description copied from interface: IamStatement.Builder

Configure the NotResource element of the statement, specifying that the statement should apply to every resource except the ones listed.

This will replace any other not-resources already added to the statement.

List<IamResource> notResources =
    Arrays.asList(IamResource.create("arn:aws:dynamodb:us-east-2:123456789012:table/customers"));

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadNotCustomers")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                // This statement grants access to EVERY CURRENT AND FUTURE RESOURCE except the customers table:
                .notResources(notResources)
                .build();

Specified by:

notResources in interface IamStatement.Builder

See Also:

• NotResource user guide

notResourceIds

public IamStatement.Builder notResourceIds(Collection<String> notResources)

Description copied from interface: IamStatement.Builder

Configure the NotResource element of the statement, specifying that the statement should apply to every resource except the ones listed.

This works the same as IamStatement.Builder.notResources(Collection), except you do not need to call IamResource.create() on each resource. This will replace any other not-resources already added to the statement.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadNotCustomers")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                // This statement grants access to EVERY CURRENT AND FUTURE RESOURCE except the customers table:
                .notResourceIds(Arrays.asList("arn:aws:dynamodb:us-east-2:123456789012:table/customers"))
                .build();

Specified by:

notResourceIds in interface IamStatement.Builder

See Also:

• NotResource user guide

addNotResource

public IamStatement.Builder addNotResource(IamResource notResource)

Description copied from interface: IamStatement.Builder

Append a NotResource element to the statement, specifying that the statement should apply to every resource except the ones listed.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadNotCustomers")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                // This statement grants access to EVERY CURRENT AND FUTURE RESOURCE except the customers table:
                .addNotResource(IamResource.create("arn:aws:dynamodb:us-east-2:123456789012:table/customers"))
                .build();

Specified by:

addNotResource in interface IamStatement.Builder

See Also:

• NotResource user guide

addNotResource

public IamStatement.Builder addNotResource(String notResource)

Description copied from interface: IamStatement.Builder

Append a NotResource element to the statement, specifying that the statement should apply to every resource except the ones listed.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadNotCustomers")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                // This statement grants access to EVERY CURRENT AND FUTURE RESOURCE except the customers table:
                .addNotResource("arn:aws:dynamodb:us-east-2:123456789012:table/customers")
                .build();

Specified by:

addNotResource in interface IamStatement.Builder

See Also:

• NotResource user guide

conditions

public IamStatement.Builder conditions(Collection<IamCondition> conditions)

Description copied from interface: IamStatement.Builder

Configure the Condition element of the statement, specifying the conditions in which the statement is in effect.

This will replace any other conditions already added to the statement.

IamCondition startTime = IamCondition.create(IamConditionOperator.DATE_GREATER_THAN,
                                             "aws:CurrentTime",
                                             "1988-05-21T00:00:00Z");
IamCondition endTime = IamCondition.create(IamConditionOperator.DATE_LESS_THAN,
                                           "aws:CurrentTime",
                                           "2065-09-01T00:00:00Z");

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBooks")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                // This statement grants access between the specified start and end times:
                .conditions(Arrays.asList(startTime, endTime))
                .build();

Specified by:

conditions in interface IamStatement.Builder

See Also:

• Condition user guide

addCondition

public IamStatement.Builder addCondition(IamCondition condition)

Description copied from interface: IamStatement.Builder

Append a Condition to the statement, specifying a condition in which the statement is in effect.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBooks")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                // This statement grants access after a specified start time:
                .addCondition(IamCondition.create(IamConditionOperator.DATE_GREATER_THAN,
                                                  "aws:CurrentTime",
                                                  "1988-05-21T00:00:00Z"))
                .build();

Specified by:

addCondition in interface IamStatement.Builder

See Also:

• Condition user guide

addCondition

public IamStatement.Builder addCondition(Consumer<IamCondition.Builder> condition)

Description copied from interface: IamStatement.Builder

Append a Condition to the statement, specifying a condition in which the statement is in effect.

This works the same as IamStatement.Builder.addCondition(IamCondition), except you do not need to specify IamCondition .builder() or build().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBooks")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                // This statement grants access after a specified start time:
                .addCondition(c -> c.operator(IamConditionOperator.DATE_GREATER_THAN)
                                    .key("aws:CurrentTime")
                                    .value("1988-05-21T00:00:00Z"))
                .build();

Specified by:

addCondition in interface IamStatement.Builder

See Also:

• Condition user guide

addCondition

public IamStatement.Builder addCondition(IamConditionOperator operator,
 IamConditionKey key,
 String value)

Description copied from interface: IamStatement.Builder

Append a Condition to the statement, specifying a condition in which the statement is in effect.

This works the same as IamStatement.Builder.addCondition(IamCondition), except you do not need to specify IamCondition .create().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBooks")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                // This statement grants access after a specified start time:
                .addCondition(IamConditionOperator.DATE_GREATER_THAN,
                              IamConditionKey.create("aws:CurrentTime"),
                              "1988-05-21T00:00:00Z")
                .build();

Specified by:

addCondition in interface IamStatement.Builder

See Also:

• Condition user guide

addCondition

public IamStatement.Builder addCondition(IamConditionOperator operator,
 String key,
 String value)

Description copied from interface: IamStatement.Builder

Append a Condition to the statement, specifying a condition in which the statement is in effect.

This works the same as IamStatement.Builder.addCondition(IamCondition), except you do not need to specify IamCondition .create().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBooks")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                // This statement grants access after a specified start time:
                .addCondition(IamConditionOperator.DATE_GREATER_THAN, "aws:CurrentTime", "1988-05-21T00:00:00Z")
                .build();

Specified by:

addCondition in interface IamStatement.Builder

See Also:

• Condition user guide

addCondition

public IamStatement.Builder addCondition(String operator,
 String key,
 String value)

Description copied from interface: IamStatement.Builder

Append a Condition to the statement, specifying a condition in which the statement is in effect.

This works the same as IamStatement.Builder.addCondition(IamCondition), except you do not need to specify IamCondition .create().

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBooks")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                // This statement grants access after a specified start time:
                .addCondition("DateGreaterThan", "aws:CurrentTime", "1988-05-21T00:00:00Z")
                .build();

Specified by:

addCondition in interface IamStatement.Builder

See Also:

• Condition user guide

addConditions

public IamStatement.Builder addConditions(IamConditionOperator operator,
 IamConditionKey key,
 Collection<String> values)

Description copied from interface: IamStatement.Builder

Append multiple Conditions to the statement, specifying conditions in which the statement is in effect.

This works the same as IamStatement.Builder.addCondition(IamConditionOperator, IamConditionKey, String) multiple times with the same operator and key, but different values.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBooks")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                // This statement grants access only in the us-east-1 and us-west-2 regions:
                .addConditions(IamConditionOperator.STRING_EQUALS,
                               IamConditionKey.create("aws:RequestedRegion"),
                               Arrays.asList("us-east-1", "us-west-2"))
                .build();

Specified by:

addConditions in interface IamStatement.Builder

See Also:

• Condition user guide

addConditions

public IamStatement.Builder addConditions(IamConditionOperator operator,
 String key,
 Collection<String> values)

Description copied from interface: IamStatement.Builder

Append multiple Conditions to the statement, specifying conditions in which the statement is in effect.

This works the same as IamStatement.Builder.addCondition(IamConditionOperator, String, String) multiple times with the same operator and key, but different values.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBooks")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                // This statement grants access only in the us-east-1 and us-west-2 regions:
                .addConditions(IamConditionOperator.STRING_EQUALS,
                               "aws:RequestedRegion",
                               Arrays.asList("us-east-1", "us-west-2"))
                .build();

Specified by:

addConditions in interface IamStatement.Builder

See Also:

• Condition user guide

addConditions

public IamStatement.Builder addConditions(String operator,
 String key,
 Collection<String> values)

Description copied from interface: IamStatement.Builder

Append multiple Conditions to the statement, specifying conditions in which the statement is in effect.

This works the same as IamStatement.Builder.addCondition(String, String, String) multiple times with the same operator and key, but different values.

IamStatement statement =
    IamStatement.builder()
                .sid("GrantReadBooks")
                .effect(IamEffect.ALLOW)
                .addAction("dynamodb:GetItem")
                .addResource("arn:aws:dynamodb:us-east-2:123456789012:table/books")
                // This statement grants access only in the us-east-1 and us-west-2 regions:
                .addConditions("StringEquals", "aws:RequestedRegion", Arrays.asList("us-east-1", "us-west-2"))
                .build();

Specified by:

addConditions in interface IamStatement.Builder

See Also:

• Condition user guide

build

public IamStatement build()

Description copied from interface: SdkBuilder

An immutable object that is created from the properties that have been set on the builder.

Specified by:

build in interface Buildable

Specified by:

build in interface SdkBuilder<IamStatement.Builder,IamStatement>

Returns:

an instance of T