Uses of Enum Class
com.cloudforge.core.enums.IAMProfile

Packages that use IAMProfile

Package	Description
com.cloudforge.core.enums
com.cloudforge.core.iam
com.cloudforgeci.api.compute
com.cloudforgeci.api.core
com.cloudforgeci.api.core.iam
com.cloudforgeci.api.interfaces
com.cloudforgeci.api.launch

Uses of IAMProfile in com.cloudforge.core.enums

Subclasses with type arguments of type IAMProfile in com.cloudforge.core.enums

Modifier and Type	Class	Description
enum	IAMProfile	IAM Profile enum defining different levels of permissions for AWS resources.

Methods in com.cloudforge.core.enums that return IAMProfile

Modifier and Type	Method	Description
static IAMProfile	IAMProfile.valueOf(String name)	Returns the enum constant of this class with the specified name.
static IAMProfile[]	IAMProfile.values()	Returns an array containing the constants of this enum class, in the order they are declared.

Uses of IAMProfile in com.cloudforge.core.iam

Methods in com.cloudforge.core.iam that return IAMProfile

Modifier and Type	Method	Description
static IAMProfile	IAMProfileMapper.getRecommended(SecurityProfile securityProfile)	Gets the recommended IAM profile for a given security profile.
static IAMProfile	IAMProfileMapper.mapFromSecurity(SecurityProfile securityProfile)	Maps a Security Profile to the appropriate IAM Profile.
static IAMProfile	IAMProfileMapper.mapFromSecurity(SecurityProfile securityProfile, IAMProfile overrideIamProfile)	Maps a Security Profile to the appropriate IAM Profile with override capability.

Methods in com.cloudforge.core.iam with parameters of type IAMProfile

Modifier and Type	Method	Description
static boolean	IAMProfileMapper.isValidCombination(SecurityProfile securityProfile, IAMProfile iamProfile)	Validates that the IAM profile is appropriate for the security profile.
static IAMProfile	IAMProfileMapper.mapFromSecurity(SecurityProfile securityProfile, IAMProfile overrideIamProfile)	Maps a Security Profile to the appropriate IAM Profile with override capability.

Uses of IAMProfile in com.cloudforgeci.api.compute

Methods in com.cloudforgeci.api.compute with parameters of type IAMProfile

Modifier and Type	Method	Description
static ApplicationFactory.ApplicationSystem	ApplicationFactory.createEc2(software.constructs.Construct scope, String id, DeploymentContext cfc, SecurityProfile security, IAMProfile iamProfile, ApplicationSpec applicationSpec)	Static helper method for creating an EC2-based application deployment with explicit IAM profile.
static ApplicationFactory.ApplicationSystem	ApplicationFactory.createFargate(software.constructs.Construct scope, String id, DeploymentContext cfc, SecurityProfile security, IAMProfile iamProfile, ApplicationSpec applicationSpec)	Static helper method for creating a Fargate-based application deployment with explicit IAM profile.

Uses of IAMProfile in com.cloudforgeci.api.core

Fields in com.cloudforgeci.api.core declared as IAMProfile

Modifier and Type	Field	Description
final IAMProfile	SystemContext.iamProfile

Methods in com.cloudforgeci.api.core with parameters of type IAMProfile

Modifier and Type	Method	Description
static SystemContext	SystemContext.start(software.constructs.Construct scope, TopologyType topology, RuntimeType runtime, SecurityProfile security, IAMProfile iamProfile, DeploymentContext cfc)	Start once at the entry point; installs runtime + topology + security + iam rules and wiring.

Uses of IAMProfile in com.cloudforgeci.api.core.iam

Fields in com.cloudforgeci.api.core.iam with type parameters of type IAMProfile

Modifier and Type	Field	Description
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.ACM_PCA_PERMISSIONS	FargateRuntimeConfiguration's private-CA fallback (CfnCertificateAuthority/CfnCertificateAuthorityActivation), used when SSL is enabled without a custom domain.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.ACM_PERMISSIONS	FargateRuntimeConfiguration's public ACM Certificate L2 construct (SSL with a custom domain, DNS-validated against the app's Route 53 hosted zone).
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.ALB_PERMISSIONS	AlbFactory's ApplicationLoadBalancer/ ApplicationTargetGroup L2 constructs.
static final Map<IAMProfile, List<String>>	PermissionMatrix.ALB_PERMISSIONS	ALB permissions based on IAM profile.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.BACKUP_PERMISSIONS	BackupFactory's BackupVault/ BackupPlan/BackupSelection L2 constructs -- BackupSelection also creates its own IAM role, explicitly named (see BackupFactory#createSelectionRole) so ManagerOperatorIamSupport#IAM_ROLE_MANAGE_RESOURCES's -CfcBackupSelection pattern can match it; that role's own create/manage permissions live there, not here.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.CLOUDFRONT_PERMISSIONS	CmsCdnConfiguration/S3WebsiteTopologyConfiguration's Distribution L2 construct — CDN in front of an app's ALB origin or an S3-hosted static site.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.COGNITO_PERMISSIONS	CognitoAuthenticationFactory/CognitoSamlFactory's UserPool/ UserPoolClient/UserPoolDomain L2 constructs (application-oidc's own identity provider) -- the AwsCustomResource calls both classes also make (SAML IdP config, client-secret retrieval) carry their own dedicated, narrowly-scoped IAM policy per AWS CDK's own custom-resource convention, so those don't need anything added here.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.COMPLIANCE_PERMISSIONS	ComplianceFactory/GuardDutyFactory/WafFactory -- deliberately its own dimension, not a fourth IAMProfile tier, since compliance mode is an independent boolean toggle on DeploymentConfig (complianceMode/awsConfigEnabled/ guardDutyEnabled), orthogonal to which IAMProfile tier an app's own workload role runs under.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.DATABASE_PERMISSIONS	RdsFactory's DatabaseInstance/ ParameterGroup/SubnetGroup L2 constructs, plus the KMS key and Secrets Manager secret every encrypted instance provisions alongside it -- grouped together, not split into three separate maps, since RdsFactory always creates the three together for any app whose DatabaseSpec requests a database (there is no "RDS without its own secret and key" shape in this codebase to scope more narrowly than that).
static final Map<IAMProfile, List<String>>	PermissionMatrix.EC2_PERMISSIONS	EC2-specific permissions based on IAM profile.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.ECS_PERMISSIONS	FargateFactory's Cluster/ FargateService/FargateTaskDefinition L2 constructs -- registering and running the task definition, not the workload permissions the running task itself needs (that's PermissionMatrix).
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.EFS_PERMISSIONS	EfsFactory's FileSystem/AccessPoint L2 constructs.
static final Map<IAMProfile, List<String>>	PermissionMatrix.EFS_PERMISSIONS	EFS permissions based on IAM profile.
static final Map<IAMProfile, List<String>>	PermissionMatrix.FARGATE_PERMISSIONS	Fargate-specific permissions based on IAM profile.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.LOGS_PERMISSIONS	Creating the target app's AWS::Logs::LogGroup.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.MONITORING_PERMISSIONS	AlarmFactory/SecurityMonitoringFactory's Alarm/ Metric/Topic constructs -- CloudWatch alarms and their SNS notification target, one category since neither is useful without the other here (every alarm this platform creates wires an SnsAction).
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.ROUTE53_PERMISSIONS	DomainFactory's HostedZone L2 construct.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.S3_APP_BUCKET_PERMISSIONS	S3WebsiteTopologyConfiguration's Bucket L2 construct (a static-site origin) — distinct from ManagerOperatorIamSupport's own S3 grants, which are scoped to Manager's own fixed-prefix template/CDK-asset buckets, never an arbitrary bucket a deployed app's own template declares.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.SCALING_PERMISSIONS	ScalingFactory's Fargate service scaleOnCpuUtilization/EnableScalingProps and Ec2Factory's AutoScalingGroup#scaleOnCpuUtilization -- two distinct AWS services (Application Auto Scaling registers the ECS service as a scalable target; EC2 Auto Scaling owns the ASG directly), kept as one category rather than two small ones.
static final Map<IAMProfile, List<String>>	OperatorProvisioningPermissionMatrix.VPC_PERMISSIONS	VpcFactory's Vpc L2 construct: every EC2 networking resource type it can synthesize.

Methods in com.cloudforgeci.api.core.iam that return IAMProfile

Modifier and Type	Method	Description
IAMProfile	ExtendedIAMConfiguration.kind()
IAMProfile	MinimalIAMConfiguration.kind()
IAMProfile	StandardIAMConfiguration.kind()

Methods in com.cloudforgeci.api.core.iam with parameters of type IAMProfile

Modifier and Type	Method	Description
static List<String>	OperatorProvisioningPermissionMatrix.getComputeAndDataPermissions(IAMProfile tier, boolean includeCompliance)	See OperatorProvisioningPermissionMatrix.getNetworkPermissions(IAMProfile) -- the other half of the same split.
static List<String>	OperatorProvisioningPermissionMatrix.getNetworkPermissions(IAMProfile tier)	The "network" half of OperatorProvisioningPermissionMatrix.getRequiredPermissions(IAMProfile, boolean): VPC, EFS, ALB, ACM, ACM PCA, Route 53, CloudFront, and app S3 bucket actions.
static List<String>	OperatorProvisioningPermissionMatrix.getRequiredPermissions(IAMProfile tier, boolean includeCompliance)	All actions needed at or below the given tier, across every provisioning category, for a single flat action list -- mirrors PermissionMatrix.getRequiredPermissions(TopologyType, RuntimeType, IAMProfile)' additive-tier shape (STANDARD includes MINIMAL, EXTENDED includes STANDARD).
static List<String>	PermissionMatrix.getRequiredPermissions(TopologyType topology, RuntimeType runtime, IAMProfile iamProfile)	Gets the required permissions for a specific topology/runtime/iam combination.
static PermissionMatrix.ValidationResult	PermissionMatrix.validatePermissions(TopologyType topology, RuntimeType runtime, IAMProfile iamProfile, List<String> providedPermissions)	Validates that the provided permissions are appropriate for the given combination.

Uses of IAMProfile in com.cloudforgeci.api.interfaces

Methods in com.cloudforgeci.api.interfaces that return IAMProfile

Modifier and Type	Method	Description
IAMProfile	IAMConfiguration.kind()	Returns the IAM profile type for this configuration.

Uses of IAMProfile in com.cloudforgeci.api.launch

Constructors in com.cloudforgeci.api.launch with parameters of type IAMProfile

Modifier	Constructor	Description
	ApplicationEc2Stack(software.constructs.Construct scope, String id, software.amazon.awscdk.StackProps props, SecurityProfile security, IAMProfile iamProfile, ApplicationSpec applicationSpec)
	ApplicationEc2Stack(software.constructs.Construct scope, String id, software.amazon.awscdk.StackProps props, SecurityProfile security, IAMProfile iamProfile, ApplicationSpec applicationSpec, MarketplaceVariant marketplaceVariant)	Same as the six-arg constructor, with an explicit Marketplace-mode switch -- see CloudForgeSynthesizer.synthesizeForMarketplace(DeploymentConfig, Path), the only intended caller with a non-null marketplaceVariant.
	ApplicationFargateStack(software.constructs.Construct scope, String id, software.amazon.awscdk.StackProps props, SecurityProfile security, IAMProfile iamProfile, ApplicationSpec applicationSpec)
	ApplicationFargateStack(software.constructs.Construct scope, String id, software.amazon.awscdk.StackProps props, SecurityProfile security, IAMProfile iamProfile, ApplicationSpec applicationSpec, MarketplaceVariant marketplaceVariant)	Same as the six-arg constructor, with an explicit Marketplace-mode switch -- see CloudForgeSynthesizer.synthesizeForMarketplace(DeploymentConfig, Path), the only intended caller with a non-null marketplaceVariant.