chore(release): 1.49.0 (#8860)

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/bump/1.49.0/CHANGELOG.md)

CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.49.0](https://github.com/aws/aws-cdk/compare/v1.48.0...v1.49.0) (2020-07-02)
+
+
+### Features
+
+* **core:** improved docker bundling performance on mac os ([#8766](https://github.com/aws/aws-cdk/issues/8766)) ([99c12f5](https://github.com/aws/aws-cdk/commit/99c12f5de61ac328e9198c83398852c7a4f90628)), closes [#8544](https://github.com/aws/aws-cdk/issues/8544)
+* **eks:** document how to define dependencies for resources and charts ([#8780](https://github.com/aws/aws-cdk/issues/8780)) ([e38b692](https://github.com/aws/aws-cdk/commit/e38b692233c509a1ca36864e2d5f28bc90d465d3)), closes [#7592](https://github.com/aws/aws-cdk/issues/7592) [#6806](https://github.com/aws/aws-cdk/issues/6806)
+* **rds:** database proxy ([#8476](https://github.com/aws/aws-cdk/issues/8476)) ([e0e5e03](https://github.com/aws/aws-cdk/commit/e0e5e034a198425ec9c55c219398df0e71b10815)), closes [#8475](https://github.com/aws/aws-cdk/issues/8475)
+
+
+### Bug Fixes
+
+* **apigateway:** permission error in lambda integration when function name is modified ([#8813](https://github.com/aws/aws-cdk/issues/8813)) ([f1b37ef](https://github.com/aws/aws-cdk/commit/f1b37ef8c75d055efea9b2f862555e9dd64634ff)), closes [#5306](https://github.com/aws/aws-cdk/issues/5306)
+* **codebuild:** project didn't have permissions to retrieve secret of image with credentials ([#8845](https://github.com/aws/aws-cdk/issues/8845)) ([4326f24](https://github.com/aws/aws-cdk/commit/4326f245e0d89f6ec250334a74a254fbfb742ee1))
+* **elasticloadbalancingv2:** dualstack ALB missing default IPv6 ingress rule ([#8798](https://github.com/aws/aws-cdk/issues/8798)) ([66f9634](https://github.com/aws/aws-cdk/commit/66f963494fc10db61cd61e36550de813821561e4)), closes [#7043](https://github.com/aws/aws-cdk/issues/7043)
+* **lambda-nodejs:** parcel build cannot find target ([#8838](https://github.com/aws/aws-cdk/issues/8838)) ([ce7a015](https://github.com/aws/aws-cdk/commit/ce7a015a973d4936e9456ff98d5f1bef58642730)), closes [#8837](https://github.com/aws/aws-cdk/issues/8837)
+
 ## [1.48.0](https://github.com/aws/aws-cdk/compare/v1.47.1...v1.48.0) (2020-07-01)
 
 

lerna.json

@@ -10,5 +10,5 @@
     "tools/*"
   ],
   "rejectCycles": "true",
-  "version": "1.48.0"
+  "version": "1.49.0"
 }

packages/@aws-cdk/aws-apigateway/lib/integration.ts

@@ -134,6 +134,20 @@ export interface IntegrationProps {
   readonly options?: IntegrationOptions;
 }
 
+/**
+ * Result of binding an Integration to the Method
+ */
+export interface IntegrationConfig {
+  /**
+   * This value is included in computing the Deployment's fingerprint. When the fingerprint
+   * changes, a new deployment is triggered.
+   * This property should contain values associated with the Integration that upon changing
+   * should trigger a fresh the Deployment needs to be refreshed.
+   * @default undefined deployments are not triggered for any change to this integration.
+   */
+  readonly deploymentToken?: string;
+}
+
 /**
  * Base class for backend integrations for an API Gateway method.
  *
@@ -156,7 +170,7 @@ export class Integration {
    * Can be overridden by subclasses to allow the integration to interact with the method
    * being integrated, access the REST API object, method ARNs, etc.
    */
-  public bind(_method: Method) {
+  public bind(_method: Method): IntegrationConfig | undefined {
     return;
   }
 }

packages/@aws-cdk/aws-apigateway/lib/integrations/aws.ts

@@ -1,5 +1,5 @@
 import * as cdk from '@aws-cdk/core';
-import { Integration, IntegrationOptions, IntegrationType } from '../integration';
+import { Integration, IntegrationConfig, IntegrationOptions, IntegrationType } from '../integration';
 import { Method } from '../method';
 import { parseAwsApiCall } from '../util';
 
@@ -92,7 +92,8 @@ export class AwsIntegration extends Integration {
     });
   }
 
-  public bind(method: Method) {
+  public bind(method: Method): IntegrationConfig | undefined {
     this.scope = method;
+    return;
   }
 }

packages/@aws-cdk/aws-apigateway/lib/integrations/lambda.ts

@@ -1,7 +1,7 @@
 import * as iam from '@aws-cdk/aws-iam';
 import * as lambda from '@aws-cdk/aws-lambda';
-import { Lazy } from '@aws-cdk/core';
-import { IntegrationOptions } from '../integration';
+import { Lazy, Token } from '@aws-cdk/core';
+import { IntegrationConfig, IntegrationOptions } from '../integration';
 import { Method } from '../method';
 import { AwsIntegration } from './aws';
 
@@ -52,7 +52,7 @@ export class LambdaIntegration extends AwsIntegration {
     this.enableTest = options.allowTestInvoke === undefined ? true : false;
   }
 
-  public bind(method: Method) {
+  public bind(method: Method): IntegrationConfig | undefined {
     super.bind(method);
     const principal = new iam.ServicePrincipal('apigateway.amazonaws.com');
 
@@ -72,5 +72,14 @@ export class LambdaIntegration extends AwsIntegration {
         sourceArn: method.testMethodArn,
       });
     }
+
+    const cfnFunction = this.handler.node.defaultChild as lambda.CfnFunction;
+    let deploymentToken;
+    if (!Token.isUnresolved(cfnFunction.functionName)) {
+      deploymentToken = JSON.stringify({ functionName: cfnFunction.functionName });
+    }
+    return {
+      deploymentToken,
+    };
   }
 }

packages/@aws-cdk/aws-apigateway/lib/method.ts

@@ -192,6 +192,9 @@ export class Method extends Resource {
       authorizer._attachToApi(this.api);
     }
 
+    const integration = props.integration ?? this.resource.defaultIntegration ?? new MockIntegration();
+    const bindResult = integration.bind(this);
+
     const methodProps: CfnMethodProps = {
       resourceId: props.resource.resourceId,
       restApiId: this.api.restApiId,
@@ -201,7 +204,7 @@ export class Method extends Resource {
       authorizationType,
       authorizerId,
       requestParameters: options.requestParameters || defaultMethodOptions.requestParameters,
-      integration: this.renderIntegration(props.integration),
+      integration: this.renderIntegration(integration),
       methodResponses: this.renderMethodResponses(options.methodResponses),
       requestModels: this.renderRequestModels(options.requestModels),
       requestValidatorId: this.requestValidatorId(options),
@@ -219,7 +222,12 @@ export class Method extends Resource {
     const deployment = props.resource.api.latestDeployment;
     if (deployment) {
       deployment.node.addDependency(resource);
-      deployment.addToLogicalId({ method: methodProps });
+      deployment.addToLogicalId({
+        method: {
+          ...methodProps,
+          integrationToken: bindResult?.deploymentToken,
+        },
+      });
     }
   }
 
@@ -255,19 +263,7 @@ export class Method extends Resource {
     return this.api.arnForExecuteApi(this.httpMethod, pathForArn(this.resource.path), 'test-invoke-stage');
   }
 
-  private renderIntegration(integration?: Integration): CfnMethod.IntegrationProperty {
-    if (!integration) {
-      // use defaultIntegration from API if defined
-      if (this.resource.defaultIntegration) {
-        return this.renderIntegration(this.resource.defaultIntegration);
-      }
-
-      // fallback to mock
-      return this.renderIntegration(new MockIntegration());
-    }
-
-    integration.bind(this);
-
+  private renderIntegration(integration: Integration): CfnMethod.IntegrationProperty {
     const options = integration._props.options || { };
 
     let credentials;

packages/@aws-cdk/aws-apigateway/test/integ.restapi.multistack.expected.json

@@ -120,7 +120,7 @@
           "BooksApi60AC975F"
         ]
       },
-      "BooksApiDeployment86CA39AF7e6c771d47a1a3777eba99bffc037822": {
+      "BooksApiDeployment86CA39AFc1570c78b1ea90526c0309cd74b7b8d0": {
         "Type": "AWS::ApiGateway::Deployment",
         "Properties": {
           "RestApiId": {
@@ -141,7 +141,7 @@
             "Ref": "BooksApi60AC975F"
           },
           "DeploymentId": {
-            "Ref": "BooksApiDeployment86CA39AF7e6c771d47a1a3777eba99bffc037822"
+            "Ref": "BooksApiDeployment86CA39AFc1570c78b1ea90526c0309cd74b7b8d0"
           },
           "StageName": "prod"
         }

packages/@aws-cdk/aws-apigateway/test/test.lambda.ts

@@ -215,4 +215,48 @@ export = {
 
     test.done();
   },
+
+  'fingerprint is computed when functionName is specified'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const restapi = new apigateway.RestApi(stack, 'RestApi');
+    const method = restapi.root.addMethod('ANY');
+    const handler = new lambda.Function(stack, 'MyFunc', {
+      functionName: 'ThisFunction',
+      runtime: lambda.Runtime.NODEJS_10_X,
+      handler: 'index.handler',
+      code: lambda.Code.fromInline('loo'),
+    });
+    const integration = new apigateway.LambdaIntegration(handler);
+
+    // WHEN
+    const bindResult = integration.bind(method);
+
+    // THEN
+    test.ok(bindResult?.deploymentToken);
+    test.deepEqual(bindResult!.deploymentToken, '{"functionName":"ThisFunction"}');
+
+    test.done();
+  },
+
+  'fingerprint is not computed when functionName is not specified'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const restapi = new apigateway.RestApi(stack, 'RestApi');
+    const method = restapi.root.addMethod('ANY');
+    const handler = new lambda.Function(stack, 'MyFunc', {
+      runtime: lambda.Runtime.NODEJS_10_X,
+      handler: 'index.handler',
+      code: lambda.Code.fromInline('loo'),
+    });
+    const integration = new apigateway.LambdaIntegration(handler);
+
+    // WHEN
+    const bindResult = integration.bind(method);
+
+    // THEN
+    test.equals(bindResult?.deploymentToken, undefined);
+
+    test.done();
+  },
 };

packages/@aws-cdk/aws-cloudfront/package.json

@@ -64,7 +64,7 @@
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
     "@types/nodeunit": "^0.0.31",
-    "aws-sdk": "^2.708.0",
+    "aws-sdk": "^2.709.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",

packages/@aws-cdk/aws-cloudtrail/package.json

@@ -64,7 +64,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
-    "aws-sdk": "^2.708.0",
+    "aws-sdk": "^2.709.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",

packages/@aws-cdk/aws-codebuild/lib/project.ts

@@ -940,6 +940,9 @@ export class Project extends ProjectBase {
         this.buildImage.repository.addToResourcePolicy(statement);
       }
     }
+    if (imagePullPrincipalType === ImagePullPrincipalType.SERVICE_ROLE) {
+      this.buildImage.secretsManagerCredentials?.grantRead(this);
+    }
 
     return {
       type: this.buildImage.type,

packages/@aws-cdk/aws-codebuild/package.json

@@ -70,7 +70,7 @@
     "@aws-cdk/aws-sns": "0.0.0",
     "@aws-cdk/aws-sqs": "0.0.0",
     "@types/nodeunit": "^0.0.31",
-    "aws-sdk": "^2.708.0",
+    "aws-sdk": "^2.709.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",

packages/@aws-cdk/aws-codebuild/test/integ.docker-registry.lit.expected.json

@@ -22,6 +22,29 @@
       "Properties": {
         "PolicyDocument": {
           "Statement": [
+            {
+              "Action": [
+                "secretsmanager:GetSecretValue",
+                "secretsmanager:DescribeSecret"
+              ],
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::Join": [
+                  "",
+                  [
+                    "arn:aws:secretsmanager:",
+                    {
+                      "Ref": "AWS::Region"
+                    },
+                    ":",
+                    {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":secret:my-secrets-123456"
+                  ]
+                ]
+              }
+            },
             {
               "Action": [
                 "logs:CreateLogGroup",
@@ -135,4 +158,4 @@
       }
     }
   }
-}
+}

packages/@aws-cdk/aws-codecommit/package.json

@@ -70,7 +70,7 @@
     "@aws-cdk/assert": "0.0.0",
     "@aws-cdk/aws-sns": "0.0.0",
     "@types/nodeunit": "^0.0.31",
-    "aws-sdk": "^2.708.0",
+    "aws-sdk": "^2.709.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",

packages/@aws-cdk/aws-dynamodb/package.json

@@ -65,7 +65,7 @@
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
     "@types/jest": "^26.0.3",
-    "aws-sdk": "^2.708.0",
+    "aws-sdk": "^2.709.0",
     "aws-sdk-mock": "^5.1.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",

packages/@aws-cdk/aws-eks/README.md

@@ -341,6 +341,38 @@ CDK. This means that if the resource is deleted from your code (or the stack is
 deleted), the next `cdk deploy` will issue a `kubectl delete` command and the
 Kubernetes resources will be deleted.
 
+#### Dependencies
+
+There are cases where Kubernetes resources must be deployed in a specific order.
+For example, you cannot define a resource in a Kubernetes namespace before the
+namespace was created.
+
+You can represent dependencies between `KubernetesResource`s using
+`resource.node.addDependency()`:
+
+```ts
+const namespace = cluster.addResource('my-namespace', {
+  apiVersion: 'v1',
+  kind: 'Namespace',
+  metadata: { name: 'my-app' }
+});
+
+const service = cluster.addResource('my-service', {
+  metadata: {
+    name: 'myservice',
+    namespace: 'my-app'
+  },
+  spec: // ...
+});
+
+service.node.addDependency(namespace); // will apply `my-namespace` before `my-service`.
+```
+
+NOTE: when a `KubernetesResource` includes multiple resources (either directly
+or through `cluster.addResource()`) (e.g. `cluster.addResource('foo', r1, r2,
+r3,...))`), these resources will be applied as a single manifest via `kubectl`
+and will be applied sequentially (the standard behavior in `kubectl`).
+
 ### Patching Kubernetes Resources
 
 The KubernetesPatch construct can be used to update existing kubernetes
@@ -524,8 +556,20 @@ deleted), the next `cdk deploy` will issue a `helm uninstall` command and the
 Helm chart will be deleted.
 
 When there is no `release` defined, the chart will be installed using the `node.uniqueId`,
-which will be lower cassed and truncated to the last 63 characters.
+which will be lower cased and truncated to the last 63 characters.
 
+By default, all Helm charts will be installed concurrently. In some cases, this
+could cause race conditions where two Helm charts attempt to deploy the same
+resource or if Helm charts depend on each other. You can use
+`chart.node.addDependency()` in order to declare a dependency order between
+charts:
+
+```ts
+const chart1 = cluster.addChart(...);
+const chart2 = cluster.addChart(...);
+
+chart2.node.addDependency(chart1);
+```
 
 ### Bottlerocket
 

packages/@aws-cdk/aws-eks/package.json

@@ -65,7 +65,7 @@
     "@aws-cdk/assert": "0.0.0",
     "@types/nodeunit": "^0.0.31",
     "@types/yaml": "1.2.0",
-    "aws-sdk": "^2.708.0",
+    "aws-sdk": "^2.709.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",