feat(apigatewayv2): websocket api: grant manage connections #16872

tmokmss · 2021-10-08T10:26:21Z

By this PR, we can allow access to management API by the following code.

    const api = new WebSocketApi(stack, 'Api');
    const defaultStage = new WebSocketStage(stack, 'Stage', {
      webSocketApi: api,
      stageName: 'dev',
    });
    const principal = new User(stack, 'User');

    api.grantManagementApiAccess(principal); // allow access to the management API for all the stage
    defaultStage.grantManagementApiAccess(principal); // allow access to the management API for a specific stage

We use WebSocket API Management API to send messages to a WebSocket API. (doc) To use the API, we must set IAM statement as below (doc):

    {
      "Effect": "Allow",
      "Action": [
        "execute-api:ManageConnections"           
      ],
      "Resource": [
        "arn:aws:execute-api:us-east-1:account-id:api-id/stage-name/POST/@connections/*"
      ]
    }

We need /* at the end of resource ARN because there will be arbitrary strings (connectionId).
i.e. {apiArn}/{stageName}/POST/@connections/{connectionId}

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

gitpod-io · 2021-10-08T10:26:23Z

the resource should be apiArn/stage-name/POST/@connections/{connectionId} adding /* suffix

nija-at

Thanks for the PR @tmokmss. See my comments below.

Please add a few sentences to the README describing this new API.

nija-at · 2021-10-28T14:16:37Z

packages/@aws-cdk/aws-apigatewayv2/lib/websocket/api.ts

+  /**
+   * The ARN of the WebSocket API.
+   *
+   * @attribute
+   */
+  readonly apiArn: string;


Remove this from here. The Arn is not attribute of IApi.

OK, thanks. Instead we might want to create some API like arnForExecuteApi as in apigateway.RestApi.

Yes, makes sense.

I'll add this API for both httpApi and webSocketApi in a future PR.

packages/@aws-cdk/aws-apigatewayv2/lib/websocket/api.ts

packages/@aws-cdk/aws-apigatewayv2/test/websocket/api.test.ts

packages/@aws-cdk/aws-apigatewayv2/lib/websocket/stage.ts

Pull request has been modified.

tmokmss · 2021-10-29T00:33:21Z

@nija-at thank you for the review! now ready for a new review:)

nija-at

Looks much better. See some comments below.

packages/@aws-cdk/aws-apigatewayv2/README.md

packages/@aws-cdk/aws-apigatewayv2/test/websocket/api.test.ts

nija-at · 2021-10-29T08:51:37Z

packages/@aws-cdk/aws-apigatewayv2/lib/websocket/api.ts

+   *
+   * @param identity The principal
+   */
+  public grantManageConnections(identity: IGrantable): Grant {


Consider adding this method to IWebsocketApi. Then, this feature will be available to imported APIs as well.

This would mean creating a new base class and moving this implementation to it.

class WebsocketApiBase extends ApiBase { // ... public grantManageConnections(...) { // ... } }

The same applies to Stage.

This is strictly not necessary for this PR if you prefer to not do this now.

yes I prefer to do this in another PR. I think we can create a new issue to support importing a webSocketApi and refactor them in a corresponding PR.

Pull request has been modified.

tmokmss · 2021-10-29T23:50:51Z

@nija-at ready for a new review again :)

mergify · 2021-11-05T12:41:19Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Pull request has been modified.

mergify · 2021-11-09T12:04:45Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2021-11-09T13:15:56Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
Commit ID: 2a1c12a
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2021-11-09T13:16:28Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

closes aws#14828 By this PR, we can allow access to management API by the following code. ```ts const api = new WebSocketApi(stack, 'Api'); const defaultStage = new WebSocketStage(stack, 'Stage', { webSocketApi: api, stageName: 'dev', }); const principal = new User(stack, 'User'); api.grantManagementApiAccess(principal); // allow access to the management API for all the stage defaultStage.grantManagementApiAccess(principal); // allow access to the management API for a specific stage ``` We use WebSocket API Management API to send messages to a WebSocket API. [(doc)](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-how-to-call-websocket-api-connections.html) To use the API, we must set IAM statement as below [(doc)](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-control-access-iam.html): ```json { "Effect": "Allow", "Action": [ "execute-api:ManageConnections" ], "Resource": [ "arn:aws:execute-api:us-east-1:account-id:api-id/stage-name/POST/@connections/*" ] } ``` We need `/*` at the end of resource ARN because there will be arbitrary strings (`connectionId`). i.e. `{apiArn}/{stageName}/POST/@connections/{connectionId}` ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

add grantManagementApiAccess method

3ee305d

tmokmss changed the title ~~feat(apigatewayv2): grant permissions for sending messages to a WebSocket~~ fix(apigatewayv2): grant permissions for sending messages to a WebSocket Oct 8, 2021

tmokmss and others added 6 commits October 8, 2021 23:12

fix

e57b89d

fix

02e3b4f

add stage support

b3b67e3

Merge branch 'master' into add_websocket_grant_managementapi_acccess

b37f567

fix

bc0ee0e

the resource should be apiArn/stage-name/POST/@connections/{connectionId} adding /* suffix

Merge branch 'master' into add_websocket_grant_managementapi_acccess

f95ae75

peterwoodworth changed the title ~~fix(apigatewayv2): grant permissions for sending messages to a WebSocket~~ fix(apigatewayv2): grant permissions for sending messages to a WebSocket Oct 21, 2021

github-actions bot added the @aws-cdk/aws-apigatewayv2 Related to Amazon API Gateway v2 label Oct 21, 2021

github-actions bot assigned nija-at Oct 21, 2021

nija-at previously requested changes Oct 28, 2021

View reviewed changes

nija-at changed the title ~~fix(apigatewayv2): grant permissions for sending messages to a WebSocket~~ feat(apigatewayv2): websocket api: grant manage connections Oct 28, 2021

fix

7085f48

Update README.md

adbb0f4

nija-at previously requested changes Oct 29, 2021

View reviewed changes

fix

c6fb742

nija-at previously approved these changes Nov 5, 2021

View reviewed changes

mergify bot and others added 2 commits November 5, 2021 14:58

Merge branch 'master' into add_websocket_grant_managementapi_acccess

fc3119e

Merge branch 'master' into add_websocket_grant_managementapi_acccess

77939f6

nija-at approved these changes Nov 9, 2021

View reviewed changes

Merge branch 'master' into add_websocket_grant_managementapi_acccess

2a1c12a

mergify bot merged commit 10dfa60 into aws:master Nov 9, 2021

tmokmss deleted the add_websocket_grant_managementapi_acccess branch November 9, 2021 23:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(apigatewayv2): websocket api: grant manage connections #16872

feat(apigatewayv2): websocket api: grant manage connections #16872

tmokmss commented Oct 8, 2021 •

edited

Loading

gitpod-io bot commented Oct 8, 2021

nija-at left a comment

nija-at Oct 28, 2021

tmokmss Oct 28, 2021

nija-at Oct 29, 2021

tmokmss Oct 29, 2021

tmokmss commented Oct 29, 2021

nija-at left a comment

nija-at Oct 29, 2021

tmokmss Oct 29, 2021

tmokmss commented Oct 29, 2021

mergify bot commented Nov 5, 2021

mergify bot commented Nov 9, 2021

aws-cdk-automation commented Nov 9, 2021

mergify bot commented Nov 9, 2021

feat(apigatewayv2): websocket api: grant manage connections #16872

feat(apigatewayv2): websocket api: grant manage connections #16872

Conversation

tmokmss commented Oct 8, 2021 • edited Loading

gitpod-io bot commented Oct 8, 2021

nija-at left a comment

Choose a reason for hiding this comment

nija-at Oct 28, 2021

Choose a reason for hiding this comment

tmokmss Oct 28, 2021

Choose a reason for hiding this comment

nija-at Oct 29, 2021

Choose a reason for hiding this comment

tmokmss Oct 29, 2021

Choose a reason for hiding this comment

tmokmss commented Oct 29, 2021

nija-at left a comment

Choose a reason for hiding this comment

nija-at Oct 29, 2021

Choose a reason for hiding this comment

tmokmss Oct 29, 2021

Choose a reason for hiding this comment

tmokmss commented Oct 29, 2021

mergify bot commented Nov 5, 2021

mergify bot commented Nov 9, 2021

aws-cdk-automation commented Nov 9, 2021

AWS CodeBuild CI Report

mergify bot commented Nov 9, 2021

tmokmss commented Oct 8, 2021 •

edited

Loading