| 1 | import type * as grafana from "@distilled.cloud/aws/grafana"; |
| 2 | import type * as Duration from "effect/Duration"; |
| 3 | import type * as Effect from "effect/Effect"; |
| 4 | import * as Binding from "../../Binding.ts"; |
| 5 | import type { Workspace } from "./Workspace.ts"; |
| 6 | |
| 7 | /** |
| 8 | * Request for {@link CreateWorkspaceServiceAccountToken}. The wire field |
| 9 | * `secondsToLive` is surfaced as a {@link Duration.Input} `timeToLive`. |
| 10 | */ |
| 11 | export interface CreateWorkspaceServiceAccountTokenRequest { |
| 12 | /** A name for the token, unique within the service account. */ |
| 13 | name: string; |
| 14 | /** The id of the service account to mint the token for. */ |
| 15 | serviceAccountId: string; |
| 16 | /** |
| 17 | * How long the token is valid — converted to whole seconds on the wire |
| 18 | * (`secondsToLive`). Maximum 30 days. |
| 19 | */ |
| 20 | timeToLive: Duration.Input; |
| 21 | } |
| 22 | |
| 23 | /** |
| 24 | * Runtime binding for the `CreateWorkspaceServiceAccountToken` operation |
| 25 | * (IAM action `grafana:CreateWorkspaceServiceAccountToken`), scoped to one |
| 26 | * {@link Workspace}. |
| 27 | * |
| 28 | * Mints a short-lived API token for a Grafana service account. The token |
| 29 | * `key` is returned exactly once, as a `Redacted` value — use it as a |
| 30 | * `Bearer` token against the workspace's Grafana HTTP API. Ideal for token |
| 31 | * rotation from a scheduled Lambda. Provide the implementation with |
| 32 | * `Effect.provide(AWS.Grafana.CreateWorkspaceServiceAccountTokenHttp)`. |
| 33 | * ### Managing Service Accounts |
| 34 | * **Example:** Mint a Short-Lived Grafana API Token |
| 35 | * ```typescript |
| 36 | * const createToken = |
| 37 | * yield* Grafana.CreateWorkspaceServiceAccountToken(workspace); |
| 38 | * |
| 39 | * const { serviceAccountToken } = yield* createToken({ |
| 40 | * name: "rotation-2026-07", |
| 41 | * serviceAccountId: account.id, |
| 42 | * timeToLive: "1 hour", |
| 43 | * }); |
| 44 | * const key = Redacted.value(serviceAccountToken.key); // "glsa_..." |
| 45 | * ``` |
| 46 | * |
| 47 | * @binding |
| 48 | */ |
| 49 | export interface CreateWorkspaceServiceAccountToken extends Binding.Service< |
| 50 | CreateWorkspaceServiceAccountToken, |
| 51 | "AWS.Grafana.CreateWorkspaceServiceAccountToken", |
| 52 | ( |
| 53 | workspace: Workspace, |
| 54 | ) => Effect.Effect< |
| 55 | ( |
| 56 | request: CreateWorkspaceServiceAccountTokenRequest, |
| 57 | ) => Effect.Effect< |
| 58 | grafana.CreateWorkspaceServiceAccountTokenResponse, |
| 59 | grafana.CreateWorkspaceServiceAccountTokenError |
| 60 | > |
| 61 | > |
| 62 | > {} |
| 63 | export const CreateWorkspaceServiceAccountToken = |
| 64 | Binding.Service<CreateWorkspaceServiceAccountToken>( |
| 65 | "AWS.Grafana.CreateWorkspaceServiceAccountToken", |
| 66 | ); |