Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(dynamodb): add missing permission for read stream data #5074

Merged
merged 7 commits into from
Nov 29, 2019
Merged

fix(dynamodb): add missing permission for read stream data #5074

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
aa371d5
Incorporate review comments
sayboras Nov 18, 2019
34ad2ca
Refactor the code
sayboras Nov 20, 2019
c12d802
Incorporate review comments
sayboras Nov 25, 2019
98e16c7
Incorporate review comments
sayboras Nov 25, 2019
bb176c2
Incorporate review comments
sayboras Nov 27, 2019
3ac0a8b
Incorporate review comment
sayboras Nov 29, 2019
b1dcd87
Merge branch 'master' into bugfix/dynamodb-list-stream
mergify[bot] Nov 29, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 23 additions & 3 deletions packages/@aws-cdk/aws-dynamodb/lib/table.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,7 @@ export interface LocalSecondaryIndexProps extends SecondaryIndexProps {
export class Table extends Resource {
/**
* Permits an IAM Principal to list all DynamoDB Streams.
* @deprecated Use {@link #grantTableListStreams} for more granular permission
* @param grantee The principal (no-op if undefined)
*/
public static grantListStreams(grantee: iam.IGrantable): iam.Grant {
Expand Down Expand Up @@ -451,7 +452,7 @@ export class Table extends Resource {
* @param grantee The principal (no-op if undefined)
* @param actions The set of actions to allow (i.e. "dynamodb:DescribeStream", "dynamodb:GetRecords", ...)
*/
public grantStream(grantee: iam.IGrantable, ...actions: string[]) {
public grantStream(grantee: iam.IGrantable, ...actions: string[]): iam.Grant {
if (!this.tableStreamArn) {
throw new Error(`DynamoDB Streams must be enabled on the table ${this.node.path}`);
}
Expand All @@ -474,12 +475,31 @@ export class Table extends Resource {
}

/**
* Permis an IAM principal all stream data read operations for this
* Permits an IAM Principal to list streams attached to current dynamodb table.
*
* @param grantee The principal (no-op if undefined)
sayboras marked this conversation as resolved.
Show resolved Hide resolved
*/
public grantTableListStreams(grantee: iam.IGrantable): iam.Grant {
if (!this.tableStreamArn) {
throw new Error(`DynamoDB Streams must be enabled on the table ${this.node.path}`);
}
return iam.Grant.addToPrincipal({
grantee,
actions: ['dynamodb:ListStreams'],
resourceArns: [
Lazy.stringValue({ produce: () => `${this.tableArn}/stream/*`})
],
});
}

/**
* Permits an IAM principal all stream data read operations for this
* table's stream:
* DescribeStream, GetRecords, GetShardIterator, ListStreams.
* @param grantee The principal to grant access to
*/
public grantStreamRead(grantee: iam.IGrantable) {
public grantStreamRead(grantee: iam.IGrantable): iam.Grant {
this.grantTableListStreams(grantee);
return this.grantStream(grantee, ...READ_STREAM_DATA_ACTIONS);
}

Expand Down
54 changes: 54 additions & 0 deletions packages/@aws-cdk/aws-dynamodb/test/test.dynamodb.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1184,6 +1184,55 @@ export = {
test.done();
},

'"grantTableListStreams" should fail if streaming is not enabled on table"'(test: Test) {
// GIVEN
const stack = new Stack();
const table = new Table(stack, 'my-table', {
partitionKey: {
name: 'id',
type: AttributeType.STRING
}
});
const user = new iam.User(stack, 'user');

// WHEN
test.throws(() => table.grantTableListStreams(user), /DynamoDB Streams must be enabled on the table my-table/);

test.done();
},

'"grantTableListStreams" allows principal to list all streams for this table'(test: Test) {
// GIVEN
const stack = new Stack();
const table = new Table(stack, 'my-table', {
partitionKey: {
name: 'id',
type: AttributeType.STRING
},
stream: StreamViewType.NEW_IMAGE
});
const user = new iam.User(stack, 'user');

// WHEN
table.grantTableListStreams(user);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please, leave this test as it is. Since we're deprecating grantListStreams, not removing it, we still need it. Also, the description is now incorrect.

I see you added an assertion to a grantStreamRead test below about dynamodb:ListStreams, that's enough.


// THEN
expect(stack).to(haveResource('AWS::IAM::Policy', {
"PolicyDocument": {
"Statement": [
{
"Action": "dynamodb:ListStreams",
"Effect": "Allow",
"Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "mytable0324D45C", "Arn" ] }, "/stream/*" ] ] }
}
],
"Version": "2012-10-17"
},
"Users": [ { "Ref": "user2C2B57AE" } ]
}));
test.done();
},

'"grantStreamRead" should fail if streaming is not enabled on table"'(test: Test) {
// GIVEN
const stack = new Stack();
Expand Down Expand Up @@ -1220,6 +1269,11 @@ export = {
expect(stack).to(haveResource('AWS::IAM::Policy', {
"PolicyDocument": {
"Statement": [
{
"Action": "dynamodb:ListStreams",
"Effect": "Allow",
"Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "mytable0324D45C", "Arn" ] }, "/stream/*" ] ] }
},
{
"Action": [
"dynamodb:DescribeStream",
Expand Down
1 change: 0 additions & 1 deletion packages/@aws-cdk/aws-lambda-event-sources/lib/dynamodb.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,5 @@ export class DynamoEventSource extends StreamEventSource {
);

this.table.grantStreamRead(target);
dynamodb.Table.grantListStreams(target);
}
}
23 changes: 18 additions & 5 deletions packages/@aws-cdk/aws-lambda-event-sources/test/integ.dynamodb.expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,24 @@
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": "dynamodb:ListStreams",
"Effect": "Allow",
"Resource": {
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"TD925BC7E",
"Arn"
]
},
"/stream/*"
]
]
}
},
{
"Action": [
"dynamodb:DescribeStream",
Expand All @@ -49,11 +67,6 @@
"StreamArn"
]
}
},
{
"Action": "dynamodb:ListStreams",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
10 changes: 5 additions & 5 deletions packages/@aws-cdk/aws-lambda-event-sources/test/test.dynamo.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,11 @@ export = {
expect(stack).to(haveResource('AWS::IAM::Policy', {
"PolicyDocument": {
"Statement": [
{
"Action": "dynamodb:ListStreams",
"Effect": "Allow",
"Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "TD925BC7E", "Arn" ] }, "/stream/*" ] ] }
},
{
"Action": [
"dynamodb:DescribeStream",
Expand All @@ -43,11 +48,6 @@ export = {
"StreamArn"
]
}
},
{
"Action": "dynamodb:ListStreams",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
23 changes: 18 additions & 5 deletions packages/decdk/test/__snapshots__/synth.test.js.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1083,6 +1083,24 @@ Object {
"Properties": Object {
"PolicyDocument": Object {
"Statement": Array [
Object {
"Action": "dynamodb:ListStreams",
"Effect": "Allow",
"Resource": Object {
"Fn::Join": Array [
"",
Array [
Object {
"Fn::GetAtt": Array [
"TableCD117FA1",
"Arn",
],
},
"/stream/*",
],
],
},
},
Object {
"Action": Array [
"dynamodb:DescribeStream",
Expand All @@ -1097,11 +1115,6 @@ Object {
],
},
},
Object {
"Action": "dynamodb:ListStreams",
"Effect": "Allow",
"Resource": "*",
},
],
"Version": "2012-10-17",
},
Expand Down