"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.RoleGrants=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var grant_1=()=>{var tmp=require("./grant");return grant_1=()=>tmp,tmp},principals_1=()=>{var tmp=require("./principals");return principals_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};class RoleGrants{role;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_iam.RoleGrants",version:"2.256.1"};static fromRole(role){try{jsiiDeprecationWarnings().aws_cdk_lib_interfaces_aws_iam_IRoleRef(role)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromRole),error}return new RoleGrants(role)}constructor(role){this.role=role}assumeRole(identity){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_iam_IPrincipal(identity)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.assumeRole),error}if(identity instanceof principals_1().ServicePrincipal||identity instanceof principals_1().AccountPrincipal)throw new(core_1()).ValidationError((0,literal_string_1().lit)`CannotServiceAccountPrincipalGrant`,"Cannot use a service or account principal with grantAssumeRole, use assumeRolePolicy instead.",this.role);return grant_1().Grant.addToPrincipal({grantee:identity,actions:["sts:AssumeRole"],resourceArns:[this.role.roleRef.roleArn]})}passRole(identity){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_iam_IPrincipal(identity)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.passRole),error}return grant_1().Grant.addToPrincipal({grantee:identity,actions:["iam:PassRole"],resourceArns:[this.role.roleRef.roleArn]})}}exports.RoleGrants=RoleGrants;
