Indicates the IAM role Proxylity assumes. On a destination, the role grants access to the destination resource and any enabled metrics or logs. At the listener level, the role grants access only to listener observability resources; it does not replace destination roles.
To declare this entity in your AWS CloudFormation template, use the following syntax:
{
"Arn" : String,
"Duration" : String
}
Arn: String
Duration: String
The ARN of the AWS::IAM::Role for proxylity to assume.
Use the property name Arn, not RoleArn. The role's trust policy must allow
Proxylity to assume it; see Access & Permissions.
A destination role's policy must grant permissions appropriate for the destination service type.
At either level, enabling MetricsEnabled requires cloudwatch:PutMetricData.
Setting LogGroupName requires logs:CreateLogStream and
logs:PutLogEvents permissions on that group's log streams.
See the metrics IAM example for a namespace-scoped policy.
Required: Yes, when a Role object is supplied.
Type: String
Update requires: No interruption
The time an STS session requested by proxylity will be allowed to be valid. The value specified can range from 900 seconds (15 minutes) up to the maximum session duration set for the role (up to 12 hours). The format of the duration may be a single number of hours "h", hours and minutes "hh:mm" or hours, minutes and seconds "hh:mm:ss".
Required: No
Type: String
Update requires: No interruption