-
Notifications
You must be signed in to change notification settings - Fork 4.3k
feat: Add support for hierarchical ARNs in Arn utility #34988
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
aws-cdk-automation
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The pull request linter fails with the following errors:
❌ Features must contain a change to a README file.
❌ Features must contain a change to an integration test file and the resulting snapshot.
❌ The first word of the pull request title should not be capitalized. If the title starts with a CDK construct, it should be in backticks "``".
If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.
| if (!resourceName) { | ||
| resourceName = ''; | ||
| resource = resourceParts[targetIndex]; | ||
| resourceName = resourceParts[targetIndex + 1]; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think there are gaps here for arns like
Fixed prefix and multi-slash resourceType values: https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotgreengrass.html#awsiotgreengrass-resources-for-iam-policies
Fixed Prefix: arn:${Partition}:aws-marketplace::${Account}:${Catalog}/ReportingData/${FactTable}/Dashboard/${DashboardName} where ${Catalog} is a prefix. - https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacesellerreporting.html#awsmarketplacesellerreporting-resources-for-iam-policies
Another gap in coverage would be for https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsorganizations.html#awsorganizations-resources-for-iam-policies
Other possibilities: https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutforequipment.html#amazonlookoutforequipment-resources-for-iam-policies
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. Note that PRs with failing linting check or builds are not reviewed, please ensure your build is passing To prevent automatic closure:
This PR will automatically close in 14 days if no action is taken. |
|
This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error. |
|
Comments on closed issues and PRs are hard for our team to see. |
Reason for this change
Some AWS services are beginning to provide hierarchical arns for finer grained resource permissions management. AWS PCS is one of those services.
Description of changes
The Arn utility has been updated to support properly resolving the
resourceandresourceNamefor hierarchical ARNs. Previously, using the slash ARN support, it would return the parent resource type forresourceandresourceNamewould include the entire rest of the ARN string.I attempted to make this as minimal a change as possible. I followed TS best practices adding an optional "options" argument to the
Splitmethod in order to support hierarchical ARN depth configuration.Describe any new or updated permissions being added
None
Description of how you validated changes
Added unit tests for the hierarchical ARN support, and existing unit tests continue to pass.
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license