如何使用 AWS CDK 为 Java 的账户创建 IAM 委托人？

Question

I want to create a policy that looks like this (which will permit cross account access to a SNS topic):

{
  "Statement":[{
    "Effect":"Allow",
    "Principal":{
      "AWS":"111122223333"
    },
    "Action":"sns:Subscribe",
    "Resource":"arn:aws:sns:us-east-2:123456789012:MyTopic"
  }]
}

How do I create this using the Java CDK? I think I should be using AccountPrincipal but I can't find a class that seems relevant that has a public constructor.

myTopic.addToResourcePolicy(
    PolicyStatement.Builder
        .create()
        .actions(List.of("sns:Subscribe"))
        .effect(Effect.ALLOW)
        .resources(List.of("arn:aws:sns:us-east-2:123456789012:MyTopic"))
        .principals(List.of(  ...how do I create a principal here?... ))
        .build()
);

Answer 1

Use AccountRootPrincipal (which implements IPrincipal ) like below:

List.of(new AccountRootPrincipal())