Skip to content

Conversation

@otaviomacedo
Copy link
Contributor

The ScheduleGroup.grant*() methods are delegating to the methods in the auto-generated ScheduleGroupGrants class. This class is generating policies with an incorrect ARN. Instead of:

arn:aws:scheduler:<region>:xxx:schedule/my-group-name/*

it is generating:

arn:aws:scheduler:<region>:xxx:schedule-group/my-group-name/*

Since the code generation mechanism doesn't provide any way of specifying a custom logic for the ARN generation, replace the auto-generated ScheduleGroupGrants with hand-written one, in which the ARN is computed by:

private arnForScheduleInGroup(scheduleName: string): string {
  return Arn.format({
    region: this.resource.env.region,
    account: this.resource.env.account,
    partition: Aws.PARTITION,
    service: 'scheduler',
    resource: 'schedule',
    resourceName: this.resource.scheduleGroupRef.scheduleGroupName + '/' + scheduleName,
  });
}

Fixes #36165.


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@aws-cdk-automation aws-cdk-automation requested a review from a team November 24, 2025 14:58
@github-actions github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p0 labels Nov 24, 2025
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Nov 24, 2025
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(This review is outdated)

@otaviomacedo otaviomacedo added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Nov 24, 2025
@aws-cdk-automation aws-cdk-automation dismissed their stale review November 24, 2025 15:00

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@aws-cdk-automation aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Nov 24, 2025
@mergify
Copy link
Contributor

mergify bot commented Nov 24, 2025

Merge Queue Status Beta

✅ The pull request has been merged

This pull request spent 5 seconds in the queue, with no time waiting for CI.
The checks were run in-place.

Required conditions to merge

@mergify
Copy link
Contributor

mergify bot commented Nov 24, 2025

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot merged commit eae8838 into main Nov 24, 2025
47 of 48 checks passed
@mergify mergify bot deleted the otaviom/schedule-group-grants branch November 24, 2025 15:39
@github-actions
Copy link
Contributor

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 24, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

bug This issue is a bug. contribution/core This is a PR that came from AWS. effort/medium Medium work item – several days of effort p0 pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. pr-linter/exempt-integ-test The PR linter will not require integ test changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

(aws-scheduler): Broken ARNs in IAM permissions granted

3 participants