Accessing single outputs with Apply

"use strict";
const pulumi = require("@pulumi/pulumi");
const aws = require("@pulumi/aws");

let certCertificate = new aws.acm.Certificate("cert", {
    domainName: "example.com",
    validationMethod: "DNS",
});

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

let certCertificate = new aws.acm.Certificate("cert", {
    domainName: "example.com",
    validationMethod: "DNS",
});

import pulumi
import pulumi_aws as aws

certificate = aws.acm.Certificate('cert',
    domain_name='example.com',
    validation_method='DNS'
)

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/acm"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := acm.NewCertificate(ctx, "cert", &acm.CertificateArgs{
			DomainName:       pulumi.String("example.com"),
			ValidationMethod: pulumi.String("DNS"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using Pulumi;
using Pulumi.Aws.Acm;
using System.Collections.Generic;

return await Deployment.RunAsync(() =>
{
    var cert = new Certificate("cert", new CertificateArgs
    {
        DomainName = "example",
        ValidationMethod = "DNS",
    });
});

package myproject;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.acm.Certificate;
import com.pulumi.aws.acm.CertificateArgs;

public class App {
    public static void main(String[] args) {
        Pulumi.run(ctx -> {
            var cert = new Certificate("cert",
                CertificateArgs.builder()
                    .domainName("example")
                    .validationMethod("DNS")
                    .build());
        });
    }
}

name: aws-acm-certificate-yaml
runtime: yaml

resources:
  cert:
    type: aws:acm:Certificate
    properties:
      domainName: example.com
      validationMethod: DNS

"use strict";
const pulumi = require("@pulumi/pulumi");
const aws = require("@pulumi/aws");

// Create an S3 bucket
const s3Bucket = new aws.s3.Bucket("myBucket");

// IAM Policy Document that allows the Lambda service to write to the S3 bucket
const s3BucketPolicyDocument = s3Bucket.arn.apply(arn =>
    JSON.stringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Principal: { Service: "lambda.amazonaws.com" },
                Action: ["s3:PutObject", "s3:PutObjectAcl"],
                Resource: `${arn}/*`,
            },
        ],
    }),
);

// Attach the policy to the bucket
const s3BucketPolicy = new aws.s3.BucketPolicy("myBucketPolicy", {
    bucket: s3Bucket.id,
    policy: s3BucketPolicyDocument,
});

// Export the names and ARNs of the created resources
exports.bucketName = s3Bucket.id;
exports.bucketArn = s3Bucket.arn;

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an S3 bucket
const s3Bucket = new aws.s3.Bucket("myBucket");

// IAM Policy Document that allows the Lambda service to write to the S3 bucket
const s3BucketPolicyDocument = s3Bucket.arn.apply(arn =>
    JSON.stringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Principal: { Service: "lambda.amazonaws.com" },
                Action: ["s3:PutObject", "s3:PutObjectAcl"],
                Resource: `${arn}/*`,
            },
        ],
    }),
);

// Attach the policy to the bucket
const s3BucketPolicy = new aws.s3.BucketPolicy("myBucketPolicy", {
    bucket: s3Bucket.id,
    policy: s3BucketPolicyDocument,
});

// Export the names and ARNs of the created resources
export const bucketName = s3Bucket.id;
export const bucketArn = s3Bucket.arn;

import pulumi
import pulumi_aws as aws
import json

# Create an S3 bucket
s3_bucket = aws.s3.Bucket("myBucket")

# IAM Policy Document that allows the Lambda service to write to the S3 bucket
s3_bucket_policy_document = s3_bucket.arn.apply(
    lambda arn: json.dumps(
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {"Service": "lambda.amazonaws.com"},
                    "Action": ["s3:PutObject", "s3:PutObjectAcl"],
                    "Resource": f"{arn}/*",
                }
            ],
        }
    )
)

# Attach the policy to the bucket
s3_bucket_policy = aws.s3.BucketPolicy(
    "myBucketPolicy",
    bucket=s3_bucket.id,
    policy=s3_bucket_policy_document,
)

# Export the names and ARNs of the created resources
pulumi.export("bucket_name", s3_bucket.id)
pulumi.export("bucket_arn", s3_bucket.arn)

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/s3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create an S3 bucket
		s3Bucket, err := s3.NewBucket(ctx, "myBucket", nil)
		if err != nil {
			return err
		}

		// IAM Policy Document that allows the Lambda service to write to the S3 bucket
		s3Bucket.Arn.ApplyT(func(arn string) (string, error) {
			policy := fmt.Sprintf(`{
				"Version": "2012-10-17",
				"Statement": [{
					"Effect": "Allow",
					"Principal": {"Service": "lambda.amazonaws.com"},
					"Action": ["s3:PutObject", "s3:PutObjectAcl"],
					"Resource": "%s/*"
				}]
			}`, arn)

			// Attach the policy to the bucket
			_, err := s3.NewBucketPolicy(ctx, "myBucketPolicy", &s3.BucketPolicyArgs{
				Bucket: s3Bucket.ID(),
				Policy: pulumi.String(policy),
			})
			if err != nil {
				return "", err
			}

			return "", nil
		})

		// Export the names and ARNs of the created resources
		ctx.Export("bucketName", s3Bucket.ID())
		ctx.Export("bucketArn", s3Bucket.Arn)

		return nil
	})
}

using Pulumi;
using Pulumi.Aws.Iam;
using Pulumi.Aws.S3;
using System.Collections.Generic;
using System.Text.Json;

return await Deployment.RunAsync(() =>
{
    var bucket = new Bucket("myBucket");

    var s3BucketPolicyDocument = bucket.Arn.Apply(arn => JsonSerializer.Serialize(new
    {
        Version = "2012-10-17",
        Statement = new[]
        {
            new
            {
                Effect = "Allow",
                Principal = new { Service = "lambda.amazonaws.com" },
                Action = new[] { "s3:PutObject", "s3:PutObjectAcl" },
                Resource = $"{arn}/*"
            }
        }
    }));

    var bucketPolicy = new BucketPolicy("myBucketPolicy", new BucketPolicyArgs
    {
        Bucket = bucket.Id,
        Policy = s3BucketPolicyDocument
    });

    return new Dictionary<string, object?>
    {
        ["bucketName"] = bucket.Id,
        ["bucketArn"] = bucket.Arn
    };
});

package myproject;

import com.pulumi.Pulumi;
import com.pulumi.aws.s3.Bucket;
import com.pulumi.aws.s3.BucketPolicy;
import com.pulumi.aws.s3.BucketPolicyArgs;
import static com.pulumi.codegen.internal.Serialization.*;

public class App {
    public static void main(String[] args) {
        Pulumi.run(ctx -> {
            var bucket = new Bucket("myBucket");

            var policyDocument = bucket.arn().applyValue(arn -> serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Action", jsonArray("s3:PutObject", "s3:PutObjectAcl")),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("Service", "lambda.amazonaws.com")
                        )),
                        jsonProperty("Resource", arn + "/*")
                    )))
                )
            ));

            var bucketPolicy = new BucketPolicy("myBucketPolicy", BucketPolicyArgs.builder()
                .bucket(bucket.id())
                .policy(policyDocument)
                .build());

            ctx.export("bucketName", bucket.id());
            ctx.export("bucketArn", bucket.arn());
        });
    }
}

name: aws-s3bucket-bucketpolicy-yaml
runtime: yaml
description: An example that deploys an S3 bucket and bucket policy on AWS.

resources:
  myBucket:
    type: aws:s3/bucket:Bucket

  myBucketPolicy:
    type: aws:s3/bucketPolicy:BucketPolicy
    properties:
      bucket: ${myBucket.id}
      policy:
        fn::toJSON:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Service: "lambda.amazonaws.com"
              Action:
                - "s3:PutObject"
                - "s3:PutObjectAcl"
              Resource: "${myBucket.arn}/*"

outputs:
  bucket_name: ${myBucket.id}
  bucket_arn: ${myBucket.arn}

"use strict";
const pulumi = require("@pulumi/pulumi");
const aws = require("@pulumi/aws");

// Get the account ID of the current user as a Pulumi output.
const accountID = aws.getCallerIdentityOutput().accountId;

// Create an S3 bucket.
const bucket = new aws.s3.Bucket("my-bucket");

// Create an S3 bucket policy allowing anyone in the account to list the contents of the bucket.
const policy = new aws.s3.BucketPolicy("my-bucket-policy", {
    bucket: bucket.id,
    policy: pulumi.jsonStringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Principal: {
                    AWS: pulumi.interpolate`arn:aws:iam::${accountID}:root`,
                },
                Action: "s3:ListBucket",
                Resource: bucket.arn,
            },
        ],
    }),
});

// Export the name of the bucket
exports.bucketName = bucket.id;

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Get the account ID of the current user as a Pulumi output.
const accountID = aws.getCallerIdentityOutput().accountId;

// Create an S3 bucket.
const bucket = new aws.s3.Bucket("my-bucket");

// Create an S3 bucket policy allowing anyone in the account to list the contents of the bucket.
const policy = new aws.s3.BucketPolicy("my-bucket-policy", {
    bucket: bucket.id,
    policy: pulumi.jsonStringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Principal: {
                    AWS: pulumi.interpolate`arn:aws:iam::${accountID}:root`,
                },
                Action: "s3:ListBucket",
                Resource: bucket.arn,
            },
        ],
    }),
});

// Export the name of the bucket.
export const bucketName = bucket.id;

import pulumi
import pulumi_aws as aws

# Get the account ID of the current user as a Pulumi output.
account_id = aws.get_caller_identity_output().apply(
    lambda identity: identity.account_id
)

# Create an S3 bucket.
bucket = aws.s3.Bucket("my-bucket")

# Create an S3 bucket policy allowing anyone in the account to list the contents of the bucket.
policy = aws.s3.BucketPolicy(
    "my-bucket-policy",
    bucket=bucket.id,
    policy=pulumi.Output.json_dumps(
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": pulumi.Output.format("arn:aws:iam::{0}:root", account_id)
                    },
                    "Action": "s3:ListBucket",
                    "Resource": bucket.arn,
                }
            ],
        }
    ),
)

# Export the name of the bucket
pulumi.export("bucketName", bucket.id)

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/s3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {

		// Get the account ID of the current user as a Pulumi Output.
		callerIdentity, err := aws.GetCallerIdentity(ctx, nil, nil)
		if err != nil {
			return err
		}
		accountID := callerIdentity.AccountId

		// Create an AWS resource (S3 Bucket)
		bucket, err := s3.NewBucket(ctx, "my-bucket", nil)
		if err != nil {
			return err
		}

		// Create an S3 bucket policy allowing anyone in the account to list the contents of the bucket.
		_, err = s3.NewBucketPolicy(ctx, "my-bucket-policy", &s3.BucketPolicyArgs{
			Bucket: bucket.ID(),
			Policy: pulumi.JSONMarshal(map[string]interface{}{
				"Version": pulumi.ToOutput("2012-10-17"),
				"Statement": pulumi.ToOutput([]interface{}{
					pulumi.ToMapOutput(map[string]pulumi.Output{
						"Effect": pulumi.ToOutput("Allow"),
						"Principal": pulumi.ToMapOutput(map[string]pulumi.Output{
							"AWS": pulumi.Sprintf("arn:aws:iam::%s:root", accountID),
						}),
						"Action":   pulumi.ToOutput("s3:ListBucket"),
						"Resource": bucket.Arn,
					}),
				}),
			}),
		})
		if err != nil {
			return err
		}

		// Export the name of the bucket
		ctx.Export("bucketName", bucket.ID())
		return nil
	})
}

using System.Collections.Generic;
using Pulumi;
using Pulumi.Aws.S3;

return await Deployment.RunAsync(() =>
{
    // Get the account ID of the current user as a Pulumi output.
    var accountID = Pulumi.Aws.GetCallerIdentity.Invoke().Apply(identity => identity.AccountId);

    // Create an S3 bucket.
    var bucket = new Bucket("my-bucket");

    // Create an S3 bucket policy allowing anyone in the account to list the contents of the bucket.
    var policy = new BucketPolicy("my-bucket-policy", new BucketPolicyArgs
        {
            Bucket = bucket.Id,
            Policy = Output.JsonSerialize(Output.Create(
                new
                {
                    Version = "2012-10-17",
                    Statement = new[]
                    {
                        new
                        {
                            Effect = "Allow",
                            Principal = new
                            {
                                AWS = Output.Format($"arn:aws:iam::{accountID}:root")
                            },
                            Action = "s3:ListBucket",
                            Resource = bucket.Arn,
                        }
                    }
                }
            ))
        }
    );

    // Export the name of the bucket.
    return new Dictionary<string, object?> { ["bucketName"] = bucket.Id };
});

"use strict";
const pulumi = require("@pulumi/pulumi");

const jsonIAMPolicy = pulumi.output(`{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket"
        }
    ]
}`);

// Parse the string output.
const policyWithNoStatements = pulumi.jsonParse(jsonIAMPolicy).apply(policy => {
    // Empty the policy's Statements list.
    policy.Statement = [];
    return policy;
});

// Export the modified policy.
exports.policy = policyWithNoStatements;

import * as pulumi from "@pulumi/pulumi";

const jsonIAMPolicy = pulumi.output(`{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket"
        }
    ]
}`);

// Parse the string output.
const policyWithNoStatements: pulumi.Output<object> = pulumi.jsonParse(jsonIAMPolicy).apply(policy => {
    // Empty the policy's Statements list.
    policy.Statement = [];
    return policy;
});

// Export the modified policy.
export const policy = policyWithNoStatements;

import pulumi

json_iam_policy = pulumi.Output.from_input(
    """
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket"
        }
    ]
}
"""
)


def update_policy(policy):
    # Empty the policy's Statements list.
    policy.update({"Statement": []})
    return policy


# Parse the string output.
policy_with_no_statements = pulumi.Output.json_loads(json_iam_policy).apply(
    lambda policy: update_policy
)

# Export the modified policy.
pulumi.export("policy", policy_with_no_statements)

package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {

		jsonIAMPolicy := pulumi.ToOutput(`{
		    "Version": "2012-10-17",
		    "Statement": [
		        {
		            "Sid": "VisualEditor0",
		            "Effect": "Allow",
		            "Action": [
		                "s3:ListAllMyBuckets",
		                "s3:GetBucketLocation"
		            ],
		            "Resource": "*"
		        },
		        {
		            "Sid": "VisualEditor1",
		            "Effect": "Allow",
		            "Action": "s3:*",
		            "Resource": "arn:aws:s3:::my-bucket"
		        }
		    ]
		}`).(pulumi.StringInput)

		// Parse the string output.
		policyWithNoStatements := pulumi.JSONUnmarshal(jsonIAMPolicy).ApplyT(
			func(v interface{}) (interface{}, error) {

				// Empty the policy's Statements list.
				v.(map[string]interface{})["Statement"] = []pulumi.ArrayOutput{}
				return v, nil
			},
		)

		// Export the modified policy.
		ctx.Export("policy", policyWithNoStatements)
		return nil
	})
}