Skip to content

Commit

Permalink
Merge branch 'main' into rix0rrr-patch-1
Browse files Browse the repository at this point in the history
  • Loading branch information
mergify[bot] authored Oct 20, 2023
2 parents e3801f5 + df24d22 commit f220d58
Show file tree
Hide file tree
Showing 11 changed files with 359 additions and 11 deletions.
26 changes: 25 additions & 1 deletion packages/@aws-cdk/aws-scheduler-alpha/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,31 @@ Executing cross-account and cross-region targets are not supported yet.

### Specifying Encryption key

TODO: Not yet implemented. See section in [L2 Event Bridge Scheduler RFC](https://github.com/aws/aws-cdk-rfcs/blob/master/text/0474-event-bridge-scheduler-l2.md)
EventBridge Scheduler integrates with AWS Key Management Service (AWS KMS) to encrypt and decrypt your data using an AWS KMS key.
EventBridge Scheduler supports two types of KMS keys: AWS owned keys, and customer managed keys.

By default, all events in Scheduler are encrypted with a key that AWS owns and manages.
If you wish you can also provide a customer managed key to encrypt and decrypt the payload that your schedule delivers to its target using the `key` property.
Target classes will automatically add AWS KMS Decrypt permission to your schedule's execution role permissions policy.

```ts
declare const key: kms.Key;
declare const fn: lambda.Function;

const target = new targets.LambdaInvoke(fn, {
input: ScheduleTargetInput.fromObject({
payload: 'useful',
}),
});

const schedule = new Schedule(this, 'Schedule', {
schedule: ScheduleExpression.rate(Duration.minutes(10)),
target,
key,
});
```

> Visit [Data protection in Amazon EventBridge Scheduler](https://docs.aws.amazon.com/scheduler/latest/UserGuide/data-protection.html) for more details.
## Error-handling

Expand Down
24 changes: 24 additions & 0 deletions packages/@aws-cdk/aws-scheduler-alpha/lib/schedule.ts
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
import { IResource, Resource } from 'aws-cdk-lib';
import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
import * as kms from 'aws-cdk-lib/aws-kms';
import { CfnSchedule } from 'aws-cdk-lib/aws-scheduler';
import { Construct } from 'constructs';
import { IGroup } from './group';
Expand All @@ -22,6 +23,11 @@ export interface ISchedule extends IResource {
* The arn of the schedule.
*/
readonly scheduleArn: string;

/**
* The customer managed KMS key that EventBridge Scheduler will use to encrypt and decrypt your data.
*/
readonly key?: kms.IKey;
}

/**
Expand Down Expand Up @@ -67,6 +73,13 @@ export interface ScheduleProps {
* @default true
*/
readonly enabled?: boolean;

/**
* The customer managed KMS key that EventBridge Scheduler will use to encrypt and decrypt your data.
*
* @default - All events in Scheduler are encrypted with a key that AWS owns and manages.
*/
readonly key?: kms.IKey;
}

/**
Expand Down Expand Up @@ -179,6 +192,11 @@ export class Schedule extends Resource implements ISchedule {
*/
public readonly scheduleName: string;

/**
* The customer managed KMS key that EventBridge Scheduler will use to encrypt and decrypt your data.
*/
readonly key?: kms.IKey;

constructor(scope: Construct, id: string, props: ScheduleProps) {
super(scope, id, {
physicalName: props.scheduleName,
Expand All @@ -188,13 +206,19 @@ export class Schedule extends Resource implements ISchedule {

const targetConfig = props.target.bind(this);

this.key = props.key;
if (this.key) {
this.key.grantEncryptDecrypt(targetConfig.role);
}

const resource = new CfnSchedule(this, 'Resource', {
name: this.physicalName,
flexibleTimeWindow: { mode: 'OFF' },
scheduleExpression: props.schedule.expressionString,
scheduleExpressionTimezone: props.schedule.timeZone?.timezoneName,
groupName: this.group?.groupName,
state: (props.enabled ?? true) ? 'ENABLED' : 'DISABLED',
kmsKeyArn: this.key?.keyArn,
target: {
arn: targetConfig.arn,
roleArn: targetConfig.role.roleArn,
Expand Down

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,37 @@
}
}
},
"RoleDefaultPolicy5FFB7DAB": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey*",
"kms:ReEncrypt*"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"ScheduleKey7E6B3A92",
"Arn"
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "RoleDefaultPolicy5FFB7DAB",
"Roles": [
{
"Ref": "Role1ABCC5F0"
}
]
}
},
"DefaultSchedule597B0B2C": {
"Type": "AWS::Scheduler::Schedule",
"Properties": {
Expand Down Expand Up @@ -128,6 +159,72 @@
"Statistic": "Sum",
"Threshold": 1
}
},
"ScheduleKey7E6B3A92": {
"Type": "AWS::KMS::Key",
"Properties": {
"KeyPolicy": {
"Statement": [
{
"Action": "kms:*",
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::",
{
"Ref": "AWS::AccountId"
},
":root"
]
]
}
},
"Resource": "*"
}
],
"Version": "2012-10-17"
}
},
"UpdateReplacePolicy": "Retain",
"DeletionPolicy": "Retain"
},
"CustomerKmsSchedule12B1FEFE": {
"Type": "AWS::Scheduler::Schedule",
"Properties": {
"FlexibleTimeWindow": {
"Mode": "OFF"
},
"KmsKeyArn": {
"Fn::GetAtt": [
"ScheduleKey7E6B3A92",
"Arn"
]
},
"ScheduleExpression": "rate(12 hours)",
"ScheduleExpressionTimezone": "Etc/UTC",
"State": "ENABLED",
"Target": {
"Arn": {
"Fn::GetAtt": [
"Function76856677",
"Arn"
]
},
"RoleArn": {
"Fn::GetAtt": [
"Role1ABCC5F0",
"Arn"
]
}
}
}
}
},
"Parameters": {
Expand Down

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

0 comments on commit f220d58

Please sign in to comment.