fix(custom-resources): incorrect IAM prefix generated for CloudWatch actions #33078

samson-keung · 2025-01-22T22:44:53Z

Issue # (if applicable)

Reason for this change

The mapping to look up the IAM prefix from a given service has a incorrect entry for Cloudwatch. It says Cloudwatch uses monitoring as the prefix but it is actually cloudwatch instead.

I cannot find any service that uses monitoring as prefix so I think it is safe to assume that nothing relies on the monitoring value. Therefore, there is no feature flag used in this PR.

Description of changes

Updated the IAM prefix mapping.

Describe any new or updated permissions being added

Updated the mapping to use correct IAM prefix.

Description of how you validated changes

Updated unit tests to use AwsCustomResource with a Cloudwatch call.

Added integ test to use AwsCustomResource with a Cloudwatch call to tag an alarm and verify the tag is indeed added successfully.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

codecov · 2025-01-22T23:02:27Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.78%. Comparing base (ab9dd0a) to head (49d8f41).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33078   +/-   ##
=======================================
  Coverage   80.78%   80.78%           
=======================================
  Files         232      232           
  Lines       14111    14111           
  Branches     2453     2453           
=======================================
  Hits        11400    11400           
  Misses       2431     2431           
  Partials      280      280

Flag	Coverage Δ
suite.unit	`80.78% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`79.51% <ø> (ø)`
packages/aws-cdk-lib/core	`82.17% <ø> (ø)`

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

GavinZZ · 2025-01-24T19:55:29Z

I want to understand this more. Have you tested on existing stack that uses AwsCustomResource with the monitoring iam prefix stack? Is this deployable or would it fail to deploy with monitoring as part of the iam statement?

samson-keung · 2025-01-24T20:11:01Z

Is this deployable or would it fail to deploy with monitoring as part of the iam statement?

It is deployable. I don't think IAM blocks users from using wrong permission. This is observable from the IAM console as well. I was able to create a policy with the monitoring:* action but the console does warn me that monitoring is a unrecognized service.

GavinZZ

Changes look good, just one minor comment.

GavinZZ · 2025-01-27T20:45:35Z

packages/aws-cdk-lib/custom-resources/test/aws-custom-resource/aws-custom-resource.test.ts

    onDelete: {
-      service: 'CloudWatchLogs',
-      action: 'deleteRetentionPolicy',
+      service: 'CloudWatch',
+      action: 'tagResource',
      parameters: {
-        logGroupName: '/aws/lambda/loggroup',
+        ResourceARN: 'dummy',
+        Tags: [{ Key: 'Name', Value: 'prod' }],
      },
+      physicalResourceId: PhysicalResourceId.of('add_tag'),


Should we add a new test instead of modifying this one so that we can continue testing cloudwatch-logs?

I did this because the onCreate is already testing service: 'CloudWatchLogs' (on line 19 above). So my thinking is, rather than testing the same thing via onDelete, I can change the onDelete to test service: 'CloudWatch'.

GavinZZ · 2025-01-27T21:21:41Z

@samson-keung this PR is 3 times the GetFunction custom resource PR.. This worries me a bit.

samson-keung · 2025-01-27T22:44:39Z

@samson-keung this PR is 3 times the GetFunction custom resource PR.. This worries me a bit.

That one was 700 files. This is way smaller. I had some trouble making the big one. This one was good, no trouble.

GavinZZ · 2025-01-28T02:22:49Z

@samson-keung this PR is 3 times the GetFunction custom resource PR.. This worries me a bit.

That one was 700 files. This is way smaller. I had some trouble making the big one. This one was good, no trouble.

OK cool, I was looking at the lines changed and this one is much bigger.

mergify · 2025-01-28T02:24:11Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-01-28T02:29:06Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-01-28T03:13:52Z

This pull request has been removed from the queue for the following reason: checks failed.

The merge conditions cannot be satisfied due to failing checks:

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.

If you want to requeue this pull request, you need to post a comment with the text: @mergifyio requeue

mergify · 2025-01-28T17:41:10Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-01-28T18:11:55Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 49d8f41
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-01-28T18:12:23Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-01-28T18:12:44Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

aws-cdk-automation requested a review from a team January 22, 2025 22:45

github-actions bot added the p2 label Jan 22, 2025

mergify bot added the contribution/core This is a PR that came from AWS. label Jan 22, 2025

aws-cdk-automation previously requested changes Jan 22, 2025

View reviewed changes

github-actions bot added bug This issue is a bug. effort/small Small work item – less than a day of effort p1 and removed p2 labels Jan 23, 2025

samson-keung force-pushed the fix-cw-iam-prefix branch from f64d0b2 to 3f74d79 Compare January 23, 2025 19:06

samson-keung marked this pull request as ready for review January 23, 2025 21:21

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 23, 2025

QuantumNeuralCoder assigned GavinZZ Jan 27, 2025

GavinZZ reviewed Jan 27, 2025

View reviewed changes

GavinZZ approved these changes Jan 28, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 28, 2025

samson-keung added 4 commits January 27, 2025 21:31

fix cloudwatch iam prefix

e870cea

snapshot asset hash updates

831f4ce

update unit tests and integ tests

2ce5308

snapshot update

b259882

samson-keung force-pushed the fix-cw-iam-prefix branch from 83a15f1 to b259882 Compare January 28, 2025 05:31

snapshot update

561712c

Merge branch 'main' into fix-cw-iam-prefix

49d8f41

mergify bot merged commit c76f668 into aws:main Jan 28, 2025
19 of 20 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Jan 28, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(custom-resources): incorrect IAM prefix generated for CloudWatch actions #33078

fix(custom-resources): incorrect IAM prefix generated for CloudWatch actions #33078

samson-keung commented Jan 22, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Jan 22, 2025 •

edited

Loading

GavinZZ commented Jan 24, 2025

samson-keung commented Jan 24, 2025

GavinZZ left a comment

GavinZZ Jan 27, 2025

samson-keung Jan 27, 2025

GavinZZ commented Jan 27, 2025

samson-keung commented Jan 27, 2025

GavinZZ commented Jan 28, 2025

mergify bot commented Jan 28, 2025

mergify bot commented Jan 28, 2025

mergify bot commented Jan 28, 2025

mergify bot commented Jan 28, 2025

aws-cdk-automation commented Jan 28, 2025

mergify bot commented Jan 28, 2025

github-actions bot commented Jan 28, 2025

fix(custom-resources): incorrect IAM prefix generated for CloudWatch actions #33078

fix(custom-resources): incorrect IAM prefix generated for CloudWatch actions #33078

Conversation

samson-keung commented Jan 22, 2025 • edited Loading

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

codecov bot commented Jan 22, 2025 • edited Loading

Codecov Report

GavinZZ commented Jan 24, 2025

samson-keung commented Jan 24, 2025

GavinZZ left a comment

Choose a reason for hiding this comment

GavinZZ Jan 27, 2025

Choose a reason for hiding this comment

samson-keung Jan 27, 2025

Choose a reason for hiding this comment

GavinZZ commented Jan 27, 2025

samson-keung commented Jan 27, 2025

GavinZZ commented Jan 28, 2025

mergify bot commented Jan 28, 2025

mergify bot commented Jan 28, 2025

mergify bot commented Jan 28, 2025

The merge conditions cannot be satisfied due to failing checks:

mergify bot commented Jan 28, 2025

aws-cdk-automation commented Jan 28, 2025

AWS CodeBuild CI Report

mergify bot commented Jan 28, 2025

github-actions bot commented Jan 28, 2025

samson-keung commented Jan 22, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Jan 22, 2025 •

edited

Loading