Skip to content

Commit

Permalink
feat: future flags 'core:enableStackNameDuplicates', 'aws-secretsmana…
Browse files Browse the repository at this point in the history 
…ger:parseOwnedSecretName' and 'aws-kms:defaultKeyPolicies' are no longer supported (#12644)

The following feature flags have been marked as expired -

* @aws-cdk/core:enableStackNameDuplicates
* @aws-cdk/aws-secretsmanager:parseOwnedSecretName
* @aws-cdk/aws-kms:defaultKeyPolicies

These flags will be unavailable in CDKv2 and setting this flag in the context
will result in an error.

Most of the changes here are related to the feature flag
'@aws-cdk/aws-kms:defaultKeyPolicies' which changes the KMS
permissions. Since KMS is a fundamental AWS service, used by almost all
downstream services, there is a significant change to all snapshots.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
  • Loading branch information
Niranjan Jayakar authored Feb 15, 2021
1 parent 5ae60bd commit 7554246
Show file tree
Hide file tree
Showing 33 changed files with 56 additions and 1,792 deletions.
90 changes: 2 additions & 88 deletions ...ges/@aws-cdk/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,23 +12,7 @@
"KeyPolicy": {
"Statement": [
{
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion",
"kms:GenerateDataKey",
"kms:TagResource",
"kms:UntagResource"
],
"Action": "kms:*",
"Effect": "Allow",
"Principal": {
"AWS": {
Expand All @@ -49,76 +33,6 @@
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineRoleD68726F7",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineSourceCodePipelineActionRoleC6F9E7F5",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineDeployPrepareChangesRoleD28C853C",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineDeployPrepareChangesCodePipelineActionRole41931444",
"Arn"
]
}
},
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -878,4 +792,4 @@
}
}
}
}
}
181 changes: 1 addition & 180 deletions ...ws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,23 +6,7 @@
"KeyPolicy": {
"Statement": [
{
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion",
"kms:GenerateDataKey",
"kms:TagResource",
"kms:UntagResource"
],
"Action": "kms:*",
"Effect": "Allow",
"Principal": {
"AWS": {
Expand All @@ -43,169 +27,6 @@
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineRoleD68726F7",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineSourceCdkCodeSourceCodePipelineActionRole237947B8",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineSourceLambdaCodeSourceCodePipelineActionRole4E89EF60",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"CdkBuildProjectRoleE0B6FEB0",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"CdkBuildProjectRoleE0B6FEB0",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"LambdaBuildProjectRoleD0C4F982",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"LambdaBuildProjectRoleD0C4F982",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineDeployLambdaCFNDeployRole89CA1043",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineDeployLambdaCFNDeployCodePipelineActionRoleF8A74488",
"Arn"
]
}
},
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
57 changes: 2 additions & 55 deletions packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-pipeline.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,23 +6,7 @@
"KeyPolicy": {
"Statement": [
{
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion",
"kms:GenerateDataKey",
"kms:TagResource",
"kms:UntagResource"
],
"Action": "kms:*",
"Effect": "Allow",
"Principal": {
"AWS": {
Expand All @@ -43,43 +27,6 @@
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineRoleD68726F7",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:Decrypt"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineSourceCodePipelineActionRoleC6F9E7F5",
"Arn"
]
}
},
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -841,4 +788,4 @@
]
}
}
}
}
Loading

0 comments on commit 7554246

Please sign in to comment.