-
Notifications
You must be signed in to change notification settings - Fork 4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(events-targets): circular dependency when adding a KMS-encrypted SQS queue #14638
Conversation
…eue encrypted with KMS as a target of an AWS Events Rule fixes aws#11158
I discussed with @njlynch offline about this issue and he recommended this solution. Thank you, Nick! :) I want to callout that this change both removes the Condition in the Key Policy and the Queue Policy. In this example that was generated prior to the change in this PR (this template would fail to deploy because of the circular dependency MyKey -> MyRule and MyRule -> MyQueue -> MyKey), the change in this PR would remove the condition
from both the Key policy and the Queue policy, because both of these policies are modified in https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-sqs/lib/queue-base.ts#L202-L213 Full example:
@rix0rrr, Let me know if you think we should try to only remove the condition on the Key policy. I think that would require a bigger change. |
@madeline-k - ACK that this will impact both the queue and key policies. I personally think that's acceptable, although I'm open to contrary arguments. I'd proceed with this implementation. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, with one nitpick and one kinda nitpick.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎉 Looks good to me!
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
commit 35a6202 Author: Ben Chaimberg <chaimber@amazon.com> Date: Tue May 18 10:18:39 2021 -0700 move supported conditions to function-base and minor name changes commit 7c6c217 Author: Ben Chaimberg <chaimber@amazon.com> Date: Mon May 17 20:23:55 2021 -0700 remove extraneous whitespace commit 02cf427 Author: Ben Chaimberg <chaimber@amazon.com> Date: Mon May 17 17:31:01 2021 -0700 add conditions snippet to README commit 8ebf049 Author: Ben Chaimberg <chaimber@amazon.com> Date: Mon May 17 17:22:25 2021 -0700 format README commit af2be84 Merge: ea53bcc 8856482 Author: Ben Chaimberg <chaimber@amazon.com> Date: Mon May 17 17:19:14 2021 -0700 Merge branch 'master' of github.com:aws/aws-cdk into chaimber/lambda_perm_cond commit ea53bcc Merge: 988b66c 1a695e2 Author: Ben Chaimberg <chaimber@amazon.com> Date: Mon May 17 17:16:10 2021 -0700 Merge branch 'chaimber/lambda_perm_cond' of github.com:aws/aws-cdk into chaimber/lambda_perm_cond commit 988b66c Author: Ben Chaimberg <chaimber@amazon.com> Date: Mon May 17 17:10:48 2021 -0700 add documentation for Permission to README commit 8856482 Author: Elad Ben-Israel <benisrae@amazon.com> Date: Mon May 17 23:19:30 2021 +0300 chore: set license of eslint-plugin-cdk (#14720) Fixes #14594 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit b70a5fa Author: Carter Van Deuren <carterv@users.noreply.github.com> Date: Mon May 17 11:29:47 2021 -0700 docs(kinesis): correct grantRead and grantWrite comments (#14707) This commit swaps the comments for `grantRead` and `grantWrite` so that the comments match the permissions being granted. No extra verification was done for this change, as it only effects comments. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit f65d826 Author: Jared Short <jaredlshort@gmail.com> Date: Mon May 17 13:38:57 2021 -0400 docs(stepfunctions-tasks): fix integration patterns of step-function-task docs (#14722) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 50d486a Author: Adam Wong <55506708+wong-a@users.noreply.github.com> Date: Mon May 17 10:12:49 2021 -0700 feat(stepfunctions): Add support for ResultSelector (#14648) ### Description Adds support for `ResultSelector`. [ResultSelector](https://docs.aws.amazon.com/step-functions/latest/dg/input-output-inputpath-params.html#input-output-resultselector) was added to ASL in August 2020 and is currently missing coverage in CDK. This change exposes a new `resultSelector` field to Task, Map, and Parallel state props. This is a JSON object that functions similarly to `Parameters` but where `$` refers to the state's raw result instead of the state input. This allows you to reshape the result without using extra Pass states. The implementation mimics what exists for Parameters. I'm not convinced we need extra types here. #### Example ```ts new tasks.LambdaInvoke(this, 'Invoke Handler', { lambdaFunction: fn, resultSelector: { lambdaOutput: sfn.JsonPath.stringAt('$.Payload'), invokeRequestId: sfn.JsonPath.stringAt('$.SdkResponseMetadata.RequestId'), staticValue: 'foo', }, }) ``` Which produces the following ASL: ```json { "Type": "Task", "Resource": "arn:aws:states:::lambda:invoke", "Parameters": { "FunctionName": ${functionName}, "Payload.$": "$" }, "ResultSelector": { "lambdaOutput.$": "$.Payload", "invokeRequestId.$": "$.SdkResponseMetadata.RequestId", "staticValue": "foo", }, "Next": ${nextState} } ``` ### Testing * Unit tests for Map, Task, and Parallel states to include `resultSelector` * Unit test with ResultSelector for `LambdaInvoke` state updated to include `resultSelector` * Updated LambdaInvoke integ test to use ResultSelector for one of the states. Executed state machine manually through the AWS console to ensure the example actually works too. Closes #9904 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 4da78f6 Author: Kyle Roach <kroach.work@gmail.com> Date: Mon May 17 12:45:39 2021 -0400 feat(apigatewayv2): http api - lambda authorizer (#13181) Second part of #10534 Had to make small changes to `authorizerType` that route expects, since Route and Authorizer enums are not the same. See #10534 (comment). ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 49d18ab Author: Austin Yattoni <austinyattoni@gmail.com> Date: Mon May 17 11:18:49 2021 -0500 fix(lambda): unable to access SingletonFunction vpc connections (#14533) fixes #6261 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 8154e91 Author: Nick Lynch <nlynch@amazon.com> Date: Mon May 17 15:29:02 2021 +0100 chore: skip Go proxy for lambda-go integ tests (#14727) Privacy-conscious users and/or organizations may choose to skip sending all package requests to the Google proxy (as is default). Some corporate environments may block network access to proxy.golang.org altogether. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 3bca822 Author: Nick Lynch <nlynch@amazon.com> Date: Mon May 17 11:47:57 2021 +0100 chore(msk): add ignore-assets pragma to cluster integ test (#14725) The MSK module relies on custom resources, which in turn create a Lambda function with assets. The way the current (lerna/yarn) build works includes the .ts file (as well as the .d.ts and .js) files in the asset bundle. Using the new `nozem` build (correctly) only includes the .d.ts and .js files, leading to a different asset hash. Since we don't care about the actual hash anyway, adding the ignore-assets pragma so this test can pass with either build tool. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit fb0977a Merge: 1effc9f df89694 Author: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> Date: Sat May 15 00:59:26 2021 +0000 chore(merge-back): 1.104.0 (#14708) See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/1.104.0/CHANGELOG.md) commit df89694 Merge: 44d3383 1effc9f Author: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> Date: Sat May 15 00:33:23 2021 +0000 Merge branch 'master' into merge-back/1.104.0 commit 1effc9f Author: Hsing-Hui Hsu <hsinghui@amazon.com> Date: Fri May 14 15:18:14 2021 -0700 docs(ecs): add contributing guide (#14672) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 44d3383 Merge: bc13a66 aaa0d05 Author: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> Date: Fri May 14 21:59:31 2021 +0000 chore(release): 1.104.0 (#14706) See [CHANGELOG](https://github.com/aws/aws-cdk/blob/bump/1.104.0/CHANGELOG.md) commit aaa0d05 Author: Neta Nir <neta1nir@gmail.com> Date: Fri May 14 14:33:52 2021 -0700 Update CHANGELOG.md commit 0328b03 Author: AWS CDK Team <aws-cdk@amazon.com> Date: Fri May 14 21:30:07 2021 +0000 chore(release): 1.104.0 commit 348e11e Author: Madeline Kusters <80541297+madeline-k@users.noreply.github.com> Date: Fri May 14 14:27:19 2021 -0700 fix(ecs): Classes FargateService and Ec2Service have no defaultChild (#14691) * fix(ecs): Class FargateService has no defaultChild fixes #14665 * update unit tests commit 1a695e2 Merge: 84045fd d82de05 Author: Ben Chaimberg <chaimber@amazon.com> Date: Fri May 14 11:45:50 2021 -0700 Merge branch 'master' into chaimber/lambda_perm_cond commit d82de05 Author: Bryan Pan <bryanpan342@gmail.com> Date: Thu May 13 08:48:46 2021 -0700 chore(appsync): rds data source service integration with grantDataApi (#14671) Utilize the `grantDataApi` from RDS to complete service integration. Fixes: #13189 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 8296623 Author: Hsing-Hui Hsu <hsinghui@amazon.com> Date: Thu May 13 08:22:23 2021 -0700 test(ecs-patterns): update l3 fargate integ tests (#14668) This adds integ tests for NLB fargate services -- previously, there were duplicate ALB fargate services being spun up. Also gives integ test stacks unique names. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit b240f6e Author: Nick Lynch <nlynch@amazon.com> Date: Thu May 13 14:21:05 2021 +0100 feat(cloudwatch): GraphWidget supports period and statistic (#14679) Dashboard metric widgets support overridding/setting both period and stat on the widget as a whole. This is often useful in combination with `MathExpression` metrics. Reference: https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/CloudWatch-Dashboard-Body-Structure.html#CloudWatch-Dashboard-Properties-Metric-Widget-Object ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 3063818 Author: Madeline Kusters <80541297+madeline-k@users.noreply.github.com> Date: Thu May 13 02:29:45 2021 -0700 fix(events-targets): circular dependency when adding a KMS-encrypted SQS queue (#14638) fixes #11158 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 9d97b7d Author: Mitchell Valine <valinm@amazon.com> Date: Thu May 13 02:01:08 2021 -0700 chore: init templates use node jest environment (#14632) Remove usage of the `jsdom` test environment in init templates to speed up unit testing by default. Testing: ran cdk init --language=(typescript|javascript) against local build of CLI then ran yarn test to verify that the testing config was valid and jest correctly used the node environment. fix: #14630 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 282d242 Author: Adam Ruka <adamruka@amazon.com> Date: Thu May 13 00:37:33 2021 -0700 chore(custom-resources): import the AWSLambda package explicitly (#14643) When linking the aws-cdk repository to a CDK app using the `link-all.sh` script, if the app uses `ts-node`, the Lambda code in the @aws-cdk/custom-resources package gets picked up by the TypeScript compiler. That code relied on the `aws-lambda` package being implicitly available, but that would cause `ts-node` to fail. Add an explicit import of it in the code - I checked the only difference in the generated JS code is the sourceMappingUrl, so it shouldn't make a difference at runtime, but allows `ts-node` to load that file successfully. Fixes #11627 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* commit 9a4d624 Author: Oliver Bowman <oliverbowman@protonmail.com> Date: Thu May 13 07:40:55 2021 +0100 docs(lambda-nodejs): Example for esbuild missing comma in property (#13520) ---- Example under esbuild appears to be missing comma. *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
fixes #11158
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license