Accessing single outputs with Apply

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Get the account ID of the current user as a Pulumi output.
const accountID = aws.getCallerIdentityOutput().accountId;

// Create an S3 bucket.
const bucket = new aws.s3.Bucket("my-bucket");

// Create an S3 bucket policy allowing anyone in the account to list the contents of the bucket.
const policy = new aws.s3.BucketPolicy("my-bucket-policy", {
    bucket: bucket.id,
    policy: pulumi.jsonStringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Principal: {
                    AWS: pulumi.interpolate`arn:aws:iam::${accountID}:root`,
                },
                Action: "s3:ListBucket",
                Resource: bucket.arn,
            },
        ],
    }),
});

// Export the name of the bucket.
export const bucketName = bucket.id;

import pulumi
import pulumi_aws as aws

# Get the account ID of the current user as a Pulumi output.
account_id = aws.get_caller_identity_output().apply(
    lambda identity: identity.account_id
)

# Create an S3 bucket.
bucket = aws.s3.Bucket("my-bucket")

# Create an S3 bucket policy allowing anyone in the account to list the contents of the bucket.
policy = aws.s3.BucketPolicy(
    "my-bucket-policy",
    bucket=bucket.id,
    policy=pulumi.Output.json_dumps(
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": pulumi.Output.format("arn:aws:iam::{0}:root", account_id)
                    },
                    "Action": "s3:ListBucket",
                    "Resource": bucket.arn,
                }
            ],
        }
    ),
)

# Export the name of the bucket
pulumi.export("bucketName", bucket.id)

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/s3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {

		// Get the account ID of the current user as a Pulumi Output.
		callerIdentity, err := aws.GetCallerIdentity(ctx, nil, nil)
		if err != nil {
			return err
		}
		accountID := callerIdentity.AccountId

		// Create an AWS resource (S3 Bucket)
		bucket, err := s3.NewBucket(ctx, "my-bucket", nil)
		if err != nil {
			return err
		}

		// Create an S3 bucket policy allowing anyone in the account to list the contents of the bucket.
		_, err = s3.NewBucketPolicy(ctx, "my-bucket-policy", &s3.BucketPolicyArgs{
			Bucket: bucket.ID(),
			Policy: pulumi.JSONMarshal(map[string]interface{}{
				"Version": pulumi.ToOutput("2012-10-17"),
				"Statement": pulumi.ToOutput([]interface{}{
					pulumi.ToMapOutput(map[string]pulumi.Output{
						"Effect": pulumi.ToOutput("Allow"),
						"Principal": pulumi.ToMapOutput(map[string]pulumi.Output{
							"AWS": pulumi.Sprintf("arn:aws:iam::%s:root", accountID),
						}),
						"Action":   pulumi.ToOutput("s3:ListBucket"),
						"Resource": bucket.Arn,
					}),
				}),
			}),
		})
		if err != nil {
			return err
		}

		// Export the name of the bucket
		ctx.Export("bucketName", bucket.ID())
		return nil
	})
}

using System.Collections.Generic;
using Pulumi;
using Pulumi.Aws.S3;

return await Deployment.RunAsync(() =>
{
    // Get the account ID of the current user as a Pulumi output.
    var accountID = Pulumi.Aws.GetCallerIdentity.Invoke().Apply(identity => identity.AccountId);

    // Create an S3 bucket.
    var bucket = new Bucket("my-bucket");

    // Create an S3 bucket policy allowing anyone in the account to list the contents of the bucket.
    var policy = new BucketPolicy("my-bucket-policy", new BucketPolicyArgs
        {
            Bucket = bucket.Id,
            Policy = Output.JsonSerialize(Output.Create(
                new
                {
                    Version = "2012-10-17",
                    Statement = new[]
                    {
                        new
                        {
                            Effect = "Allow",
                            Principal = new
                            {
                                AWS = Output.Format($"arn:aws:iam::{accountID}:root")
                            },
                            Action = "s3:ListBucket",
                            Resource = bucket.Arn,
                        }
                    }
                }
            ))
        }
    );

    // Export the name of the bucket.
    return new Dictionary<string, object?> { ["bucketName"] = bucket.Id };
});

package myproject;

import static com.pulumi.codegen.internal.Serialization.*;

import com.pulumi.Pulumi;
import com.pulumi.core.Either;
import com.pulumi.core.Output;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.s3.Bucket;
import com.pulumi.aws.s3.BucketPolicy;
import com.pulumi.aws.s3.BucketPolicyArgs;

public class App {
    public static void main(String[] args) {
        Pulumi.run(ctx -> {
            // Get the account ID of the current user as a Pulumi output.
            var accountID = AwsFunctions.getCallerIdentity().applyValue(identity -> identity.accountId());

            // Create an S3 bucket.
            var bucket = new Bucket("my-bucket");

            // Build the policy document, waiting for the account ID and bucket ARN to resolve.
            var policyDocument = Output.tuple(accountID, bucket.arn()).applyValue(t -> serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("AWS", "arn:aws:iam::" + t.t1 + ":root")
                        )),
                        jsonProperty("Action", "s3:ListBucket"),
                        jsonProperty("Resource", t.t2)
                    )))
                )
            ));

            // Create an S3 bucket policy allowing anyone in the account to list the contents of the bucket.
            var policy = new BucketPolicy("my-bucket-policy", BucketPolicyArgs.builder()
                .bucket(bucket.id())
                .policy(policyDocument.applyValue(Either::ofLeft))
                .build());

            // Export the name of the bucket.
            ctx.export("bucketName", bucket.id());
        });
    }
}

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an S3 bucket.
const bucket = new aws.s3.Bucket("my-bucket");

// Create an S3 bucket policy that grants read access to all objects in the bucket.
// The Resource field uses pulumi.interpolate to append "/*" to the bucket ARN,
// targeting individual objects rather than the bucket itself.
const policy = new aws.s3.BucketPolicy("my-bucket-policy", {
    bucket: bucket.id,
    policy: pulumi.jsonStringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Principal: "*",
                Action: "s3:GetObject",
                Resource: pulumi.interpolate`${bucket.arn}/*`,
            },
        ],
    }),
});

// Export the name of the bucket.
export const bucketName = bucket.id;

import pulumi
import pulumi_aws as aws

# Create an S3 bucket.
bucket = aws.s3.Bucket("my-bucket")

# Create an S3 bucket policy that grants read access to all objects in the bucket.
# The Resource field uses pulumi.Output.concat to append "/*" to the bucket ARN,
# targeting individual objects rather than the bucket itself.
policy = aws.s3.BucketPolicy(
    "my-bucket-policy",
    bucket=bucket.id,
    policy=pulumi.Output.json_dumps(
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": "*",
                    "Action": "s3:GetObject",
                    "Resource": pulumi.Output.concat(bucket.arn, "/*"),
                }
            ],
        }
    ),
)

# Export the name of the bucket.
pulumi.export("bucketName", bucket.id)

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/s3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {

		// Create an S3 bucket.
		bucket, err := s3.NewBucket(ctx, "my-bucket", nil)
		if err != nil {
			return err
		}

		// Create an S3 bucket policy that grants read access to all objects in the bucket.
		// The Resource field uses pulumi.Sprintf to append "/*" to the bucket ARN,
		// targeting individual objects rather than the bucket itself.
		_, err = s3.NewBucketPolicy(ctx, "my-bucket-policy", &s3.BucketPolicyArgs{
			Bucket: bucket.ID(),
			Policy: pulumi.JSONMarshal(map[string]interface{}{
				"Version": pulumi.ToOutput("2012-10-17"),
				"Statement": pulumi.ToOutput([]interface{}{
					pulumi.ToMapOutput(map[string]pulumi.Output{
						"Effect":    pulumi.ToOutput("Allow"),
						"Principal": pulumi.ToOutput("*"),
						"Action":    pulumi.ToOutput("s3:GetObject"),
						"Resource":  pulumi.Sprintf("%s/*", bucket.Arn),
					}),
				}),
			}),
		})
		if err != nil {
			return err
		}

		// Export the name of the bucket.
		ctx.Export("bucketName", bucket.ID())
		return nil
	})
}

using System.Collections.Generic;
using Pulumi;
using Pulumi.Aws.S3;

return await Deployment.RunAsync(() =>
{
    // Create an S3 bucket.
    var bucket = new Bucket("my-bucket");

    // Create an S3 bucket policy that grants read access to all objects in the bucket.
    // The Resource field uses Output.Format to append "/*" to the bucket ARN,
    // targeting individual objects rather than the bucket itself.
    var policy = new BucketPolicy("my-bucket-policy", new BucketPolicyArgs
        {
            Bucket = bucket.Id,
            Policy = Output.JsonSerialize(Output.Create(
                new
                {
                    Version = "2012-10-17",
                    Statement = new[]
                    {
                        new
                        {
                            Effect = "Allow",
                            Principal = "*",
                            Action = "s3:GetObject",
                            Resource = Output.Format($"{bucket.Arn}/*"),
                        }
                    }
                }
            ))
        }
    );

    // Export the name of the bucket.
    return new Dictionary<string, object?> { ["bucketName"] = bucket.Id };
});

package myproject;

import static com.pulumi.codegen.internal.Serialization.*;

import com.pulumi.Pulumi;
import com.pulumi.core.Either;
import com.pulumi.aws.s3.Bucket;
import com.pulumi.aws.s3.BucketPolicy;
import com.pulumi.aws.s3.BucketPolicyArgs;

public class App {
    public static void main(String[] args) {
        Pulumi.run(ctx -> {
            // Create an S3 bucket.
            var bucket = new Bucket("my-bucket");

            // Build the policy document, appending "/*" to the bucket ARN so the
            // statement targets individual objects rather than the bucket itself.
            var policyDocument = bucket.arn().applyValue(arn -> serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Principal", "*"),
                        jsonProperty("Action", "s3:GetObject"),
                        jsonProperty("Resource", arn + "/*")
                    )))
                )
            ));

            // Create an S3 bucket policy that grants read access to all objects in the bucket.
            var policy = new BucketPolicy("my-bucket-policy", BucketPolicyArgs.builder()
                .bucket(bucket.id())
                .policy(policyDocument.applyValue(Either::ofLeft))
                .build());

            // Export the name of the bucket.
            ctx.export("bucketName", bucket.id());
        });
    }
}

import * as pulumi from "@pulumi/pulumi";

const jsonIAMPolicy = pulumi.output(`{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket"
        }
    ]
}`);

// Parse the string output.
const policyWithNoStatements: pulumi.Output<object> = pulumi.jsonParse(jsonIAMPolicy).apply(policy => {
    // Empty the policy's Statements list.
    policy.Statement = [];
    return policy;
});

// Export the modified policy.
export const policy = policyWithNoStatements;

import pulumi

json_iam_policy = pulumi.Output.from_input(
    """
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket"
        }
    ]
}
"""
)


def update_policy(policy):
    # Empty the policy's Statements list.
    policy.update({"Statement": []})
    return policy


# Parse the string output.
policy_with_no_statements = pulumi.Output.json_loads(json_iam_policy).apply(
    lambda policy: update_policy
)

# Export the modified policy.
pulumi.export("policy", policy_with_no_statements)

package main

import (
	"encoding/json"
	
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {

		jsonIAMPolicy := pulumi.ToOutput(`{
		    "Version": "2012-10-17",
		    "Statement": [
		        {
		            "Sid": "VisualEditor0",
		            "Effect": "Allow",
		            "Action": [
		                "s3:ListAllMyBuckets",
		                "s3:GetBucketLocation"
		            ],
		            "Resource": "*"
		        },
		        {
		            "Sid": "VisualEditor1",
		            "Effect": "Allow",
		            "Action": "s3:*",
		            "Resource": "arn:aws:s3:::my-bucket"
		        }
		    ]
		}`)

		// Parse the string output.
		policyWithNoStatements := jsonIAMPolicy.ApplyT(
			func(jsonStr string) (map[string]interface{}, error) {
				var policy map[string]interface{}
				if err := json.Unmarshal([]byte(jsonStr), &policy); err != nil {
					return nil, err
				}

				// Empty the policy's Statements list.
				policy["Statement"] = []interface{}{}
				return policy, nil
			},
		)

		// Export the modified policy.
		ctx.Export("policy", policyWithNoStatements)
		return nil
	})
}

using System.Collections.Generic;
using Pulumi;

return await Deployment.RunAsync(() =>
{
    var jsonIAMPolicy = Output.Create(
        @"
        {
            ""Version"": ""2012-10-17"",
            ""Statement"": [
                {
                    ""Sid"": ""VisualEditor0"",
                    ""Effect"": ""Allow"",
                    ""Action"": [
                        ""s3:ListAllMyBuckets"",
                        ""s3:GetBucketLocation""
                    ],
                    ""Resource"": ""*""
                },
                {
                    ""Sid"": ""VisualEditor1"",
                    ""Effect"": ""Allow"",
                    ""Action"": [
                        ""s3:*""
                    ],
                    ""Resource"": ""arn:aws:s3:::my-bucket""
                }
            ]
        }
    "
    );

    // Parse the Output<string> into a C# Dictionary.
    var policyWithNoStatements = Output
        .JsonDeserialize<Dictionary<string, object?>>(jsonIAMPolicy)
        .Apply(policy =>
        {
            // Empty the policy's Statements list.
            policy["Statement"] = new List<object?>();
            return policy;
        });

    // Export the modified policy.
    return new Dictionary<string, object?> { ["policy"] = policyWithNoStatements, };
});

package myproject;

import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.google.gson.Gson;
import com.google.gson.reflect.TypeToken;

import java.util.ArrayList;
import java.util.Map;

public class App {
    public static void main(String[] args) {
        Pulumi.run(ctx -> {
            var jsonIAMPolicy = Output.of("{\n" +
                "    \"Version\": \"2012-10-17\",\n" +
                "    \"Statement\": [\n" +
                "        {\n" +
                "            \"Sid\": \"VisualEditor0\",\n" +
                "            \"Effect\": \"Allow\",\n" +
                "            \"Action\": [\n" +
                "                \"s3:ListAllMyBuckets\",\n" +
                "                \"s3:GetBucketLocation\"\n" +
                "            ],\n" +
                "            \"Resource\": \"*\"\n" +
                "        },\n" +
                "        {\n" +
                "            \"Sid\": \"VisualEditor1\",\n" +
                "            \"Effect\": \"Allow\",\n" +
                "            \"Action\": \"s3:*\",\n" +
                "            \"Resource\": \"arn:aws:s3:::my-bucket\"\n" +
                "        }\n" +
                "    ]\n" +
                "}");

            // Parse the string output into a map and empty the policy's Statement list.
            var gson = new Gson();
            var policyWithNoStatements = jsonIAMPolicy.applyValue(json -> {
                Map<String, Object> policy = gson.fromJson(json, new TypeToken<Map<String, Object>>() {}.getType());
                policy.put("Statement", new ArrayList<>());
                return policy;
            });

            // Export the modified policy.
            ctx.export("policy", policyWithNoStatements);
        });
    }
}