Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(s3): Reduce notifications handler permissions (#5925) #27274

Closed
wants to merge 1 commit into from
Closed

feat(s3): Reduce notifications handler permissions (#5925) #27274

wants to merge 1 commit into from

Conversation

faridnsh
Copy link

@faridnsh faridnsh commented Sep 25, 2023 •
edited
Loading

This restricts them to resources only the buckets that is required. To ensure permissions don't get too large minimize is also enabled on the policy.

Closes #5925

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@github-actions github-actions bot added the beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK label Sep 25, 2023
@aws-cdk-automation aws-cdk-automation requested a review from a team September 25, 2023 13:03
@github-actions github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p1 labels Sep 25, 2023
@faridnsh faridnsh force-pushed the s3-notifications-permissions branch from 75976a6 to 05663d2 Compare September 25, 2023 13:03
@faridnsh faridnsh mentioned this pull request Sep 25, 2023
Open
aws-cdk-automation
aws-cdk-automation requested changes Sep 25, 2023
View reviewed changes
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

feat(s3): Reduce notifications handler permissions (aws#5925)
f245a22 
This restricts them to resources only the buckets that is required. To
ensure permissions don't get too large minmize is also enabled on the
policy.

Closes aws#5925
@faridnsh faridnsh force-pushed the s3-notifications-permissions branch from 05663d2 to f245a22 Compare September 25, 2023 13:13
@faridnsh faridnsh changed the title fix(s3): Reduce notifications handler permissions (#5925) feat(s3): Reduce notifications handler permissions (#5925) Sep 25, 2023
@faridnsh
Copy link
Author

faridnsh commented Sep 25, 2023 •
edited
Loading

Clarification Request: I'm not sure if this falls as a feature or a bugfix. In either case no changes to readme or integration tests are required as there's no changes to end users and there isn't any changes in how the resource interactions, otherwise just security slightly tightened.

@aws-cdk-automation aws-cdk-automation added the pr/reviewer-clarification-requested The contributor has requested clarification on feedback, a failing build, or a failing PR Linter run label Sep 25, 2023
@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: f245a22
  • Result: FAILED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@github-actions github-actions bot mentioned this pull request Oct 1, 2023
Closed
vinayak-kukreja
vinayak-kukreja requested changes Oct 10, 2023
View reviewed changes
Copy link
Contributor

@vinayak-kukreja vinayak-kukreja left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey, I see the build is failing right now. We would not be able to prioritize review for this PR till the build succeeds.

This could be a high impact PR since it is modifying permissions. I am not sure if this can be merged in. It looks like the integration tests were not run with this change. Could you run those?

packages/aws-cdk-lib/aws-s3/lib/notifications-resource/notifications-resource-handler.ts
*/
public readonly role: iam.IRole;
private readonly policy: iam.Policy;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is breaking. A user could be using this property which now would become private

@vinayak-kukreja vinayak-kukreja removed the pr/reviewer-clarification-requested The contributor has requested clarification on feedback, a failing build, or a failing PR Linter run label Oct 10, 2023
@aws-cdk-automation
Copy link
Collaborator

This PR has been in the BUILD FAILING state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

@aws-cdk-automation
Copy link
Collaborator

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

@aws-cdk-automation aws-cdk-automation added the closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. label Oct 25, 2023
@aws-cdk-automation
Copy link
Collaborator

The pull request linter fails with the following errors:

❌ Features must contain a change to a README file.
❌ Features must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

@faridnsh
Copy link
Author

Hi @vinayak-kukreja, Thanks for the review. I had a busy week but now I'm happy to make the PR again, while adding back the role as public to make sure it's not breaking. In the meantime, other than locally running the integration tests, what needs to be done here?

Could you also let me know whether this should a bugfix or feature and what kind of change I can put in the README and also integration test file?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vinayak-kukreja vinayak-kukreja vinayak-kukreja requested changes

@aws-cdk-automation aws-cdk-automation aws-cdk-automation requested changes

Assignees
No one assigned
Labels
beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p1
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

s3 bucket notifications creates IAM policy that has no resource boundary
3 participants
@faridnsh @aws-cdk-automation @vinayak-kukreja