Identity

An Identity represents a human or service identity with assigned roles. On AWS this is an IAM User, on GCP a Service Account. Hetzner and DigitalOcean do not have equivalent identity resources.

Config

Property	Type	Required	Description
name	string	yes	Unique resource name
id	string	no	Explicit ID (auto-generated UUID if omitted)
provider	string	no	Provider label for multi-provider configs
tags	Record<string, string>	no	Arbitrary key-value metadata
roles	(Role | string)[]	yes	Roles attached to this identity

Example

import { Role, Identity } from '@kykucloud/types'

const adminRole = new Role({ name: 'admin', permissions: ['compute:admin', 'storage:admin'] })

const deployer = new Identity({
  name: 'deployer',
  roles: [adminRole],
})

Provider Support

Provider	Supported	Backend
AWS	✅	IAM User
GCP	✅	Service Account
Hetzner	❌	Not available
DigitalOcean	❌	Not available

Notes

• AWS IAM users require policy cleanup before deletion — destroy() must detach managed policies and delete inline policies before DeleteUserCommand. Catch NoSuchEntity on each cleanup step.
• GCP Service Accounts use the IAM API base (iam.googleapis.com). Service accounts are created via POST /v1/projects/{project}/serviceAccounts.
• Roles can be assigned by name or by reference. You can use built-in (AWS-managed) roles by passing role names as strings.
• AWS identity names are immutable (rename is a separate operation).