feat(aws-s3): add the option to not poll to the CodePipeline Action. (#…

…1260)
aws · Jan 25, 2019 · 876b26d · 876b26d
1 parent 77fe077
commit 876b26d
Show file tree

Hide file tree

Showing 15 changed files with 431 additions and 34 deletions.
diff --git a/packages/@aws-cdk/aws-cloudtrail/README.md b/packages/@aws-cdk/aws-cloudtrail/README.md
@@ -31,25 +31,29 @@ For example, to log to CloudWatch Logs
 import cloudtrail = require('@aws-cdk/aws-cloudtrail');
 
 const trail = new cloudtrail.CloudTrail(stack, 'CloudTrail', {
-  sendToCloudWatchLogs: true
+ sendToCloudWatchLogs: true
 });
 ```
 
-This creates the same setup as above - but also logs events to a created CloudWatch Log stream. By default, the created log group has a retention period of 365 Days, but this is also configurable.
+This creates the same setup as above - but also logs events to a created CloudWatch Log stream.
+By default, the created log group has a retention period of 365 Days, but this is also configurable.
 
-
-For using CloudTrail event selector to log specific S3 events, you can use the `CloudTrailProps` configuration object
-
-For example - this logs all ReadWriteEvents for the `magic-bucket` bucket:
+For using CloudTrail event selector to log specific S3 events,
+you can use the `CloudTrailProps` configuration object.
+Example:
 
 ```ts
 import cloudtrail = require('@aws-cdk/aws-cloudtrail');
 
-const trail = new cloudtrail.CloudTrail(stack, 'MyAmazingCloudTrail')
+const trail = new cloudtrail.CloudTrail(stack, 'MyAmazingCloudTrail');
 
-trail.addS3Filter("arn:aws:s3:::magic-bucket/"); // Adds an event selector to the bucket magic-bucket. By default, this includes management events and all operations (Read + Write)
+// Adds an event selector to the bucket magic-bucket.
+// By default, this includes management events and all operations (Read + Write)
+trail.addS3EventSelector(["arn:aws:s3:::magic-bucket/"]); 
 
-const configuration = { includeManagementEvents = false, readWriteType = ReadWriteType.All };
-trail.addS3Filter(["arn:aws:s3:::foo"], configuration ); // Adds an event selector to the bucket foo, with a specific configuration
+// Adds an event selector to the bucket foo, with a specific configuration
+trail.addS3EventSelector(["arn:aws:s3:::foo"], { 
+ includeManagementEvents: false,
+ readWriteType: ReadWriteType.All,
 });
 ```
diff --git a/packages/@aws-cdk/aws-codepipeline/package.json b/packages/@aws-cdk/aws-codepipeline/package.json
@@ -62,6 +62,7 @@
  "devDependencies": {
  "@aws-cdk/assert": "^0.22.0",
  "@aws-cdk/aws-cloudformation": "^0.22.0",
+ "@aws-cdk/aws-cloudtrail": "^0.22.0",
  "@aws-cdk/aws-codebuild": "^0.22.0",
  "@aws-cdk/aws-codecommit": "^0.22.0",
  "@aws-cdk/aws-codedeploy": "^0.22.0",
@@ -98,4 +99,4 @@
  "construct-ctor:@aws-cdk/aws-codepipeline.CrossRegionScaffoldStack.<initializer>.params[1]"
  ]
  }
-}
+}
diff --git a/packages/@aws-cdk/aws-codepipeline/test/integ.lambda-pipeline.expected.json b/packages/@aws-cdk/aws-codepipeline/test/integ.lambda-pipeline.expected.json
@@ -145,7 +145,7 @@
  "Ref": "PipelineBucketB967BD35"
  },
  "S3ObjectKey": "key",
- "PollForSourceChanges": true
+ "PollForSourceChanges": false
  },
  "InputArtifacts": [],
  "Name": "Source",
@@ -188,6 +188,66 @@
  "PipelineRoleDefaultPolicyC7A05455"
  ]
  },
+ "PipelineEventsRole46BEEA7C": {
+ "Type": "AWS::IAM::Role",
+ "Properties": {
+ "AssumeRolePolicyDocument": {
+ "Statement": [
+ {
+ "Action": "sts:AssumeRole",
+ "Effect": "Allow",
+ "Principal": {
+ "Service": "events.amazonaws.com"
+ }
+ }
+ ],
+ "Version": "2012-10-17"
+ }
+ }
+ },
+ "PipelineEventsRoleDefaultPolicyFF4FCCE0": {
+ "Type": "AWS::IAM::Policy",
+ "Properties": {
+ "PolicyDocument": {
+ "Statement": [
+ {
+ "Action": "codepipeline:StartPipelineExecution",
+ "Effect": "Allow",
+ "Resource": {
+ "Fn::Join": [
+ "",
+ [
+ "arn:",
+ {
+ "Ref": "AWS::Partition"
+ },
+ ":codepipeline:",
+ {
+ "Ref": "AWS::Region"
+ },
+ ":",
+ {
+ "Ref": "AWS::AccountId"
+ },
+ ":",
+ {
+ "Ref": "PipelineC660917D"
+ }
+ ]
+ ]
+ }
+ }
+ ],
+ "Version": "2012-10-17"
+ },
+ "PolicyName": "PipelineEventsRoleDefaultPolicyFF4FCCE0",
+ "Roles": [
+ {
+ "Ref": "PipelineEventsRole46BEEA7C"
+ }
+ ]
+ }
+ },
  "PipelineBucketB967BD35": {
  "Type": "AWS::S3::Bucket",
  "Properties": {
@@ -196,6 +256,182 @@
  }
  }
  },
+ "PipelineBucketawscdkcodepipelinelambdaPipeline87A4B3D3SourceEventRuleCE4D4505": {
+ "Type": "AWS::Events::Rule",
+ "Properties": {
+ "EventPattern": {
+ "source": [
+ "aws.s3"
+ ],
+ "detail-type": [
+ "AWS API Call via CloudTrail"
+ ],
+ "detail": {
+ "eventSource": [
+ "s3.amazonaws.com"
+ ],
+ "eventName": [
+ "PutObject"
+ ],
+ "resources": {
+ "ARN": [
+ {
+ "Fn::Join": [
+ "",
+ [
+ {
+ "Fn::GetAtt": [
+ "PipelineBucketB967BD35",
+ "Arn"
+ ]
+ },
+ "/key"
+ ]
+ ]
+ }
+ ]
+ }
+ }
+ },
+ "State": "ENABLED",
+ "Targets": [
+ {
+ "Arn": {
+ "Fn::Join": [
+ "",
+ [
+ "arn:",
+ {
+ "Ref": "AWS::Partition"
+ },
+ ":codepipeline:",
+ {
+ "Ref": "AWS::Region"
+ },
+ ":",
+ {
+ "Ref": "AWS::AccountId"
+ },
+ ":",
+ {
+ "Ref": "PipelineC660917D"
+ }
+ ]
+ ]
+ },
+ "Id": "Pipeline",
+ "RoleArn": {
+ "Fn::GetAtt": [
+ "PipelineEventsRole46BEEA7C",
+ "Arn"
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "CloudTrailS310CD22F2": {
+ "Type": "AWS::S3::Bucket",
+ "DeletionPolicy": "Retain"
+ },
+ "CloudTrailS3PolicyEA49A03E": {
+ "Type": "AWS::S3::BucketPolicy",
+ "Properties": {
+ "Bucket": {
+ "Ref": "CloudTrailS310CD22F2"
+ },
+ "PolicyDocument": {
+ "Statement": [
+ {
+ "Action": "s3:GetBucketAcl",
+ "Effect": "Allow",
+ "Principal": {
+ "Service": "cloudtrail.amazonaws.com"
+ },
+ "Resource": {
+ "Fn::GetAtt": [
+ "CloudTrailS310CD22F2",
+ "Arn"
+ ]
+ }
+ },
+ {
+ "Action": "s3:PutObject",
+ "Condition": {
+ "StringEquals": {
+ "s3:x-amz-acl": "bucket-owner-full-control"
+ }
+ },
+ "Effect": "Allow",
+ "Principal": {
+ "Service": "cloudtrail.amazonaws.com"
+ },
+ "Resource": {
+ "Fn::Join": [
+ "",
+ [
+ {
+ "Fn::GetAtt": [
+ "CloudTrailS310CD22F2",
+ "Arn"
+ ]
+ },
+ "/AWSLogs/",
+ {
+ "Ref": "AWS::AccountId"
+ },
+ "/*"
+ ]
+ ]
+ }
+ }
+ ],
+ "Version": "2012-10-17"
+ }
+ }
+ },
+ "CloudTrailA62D711D": {
+ "Type": "AWS::CloudTrail::Trail",
+ "Properties": {
+ "IsLogging": true,
+ "S3BucketName": {
+ "Ref": "CloudTrailS310CD22F2"
+ },
+ "EnableLogFileValidation": true,
+ "EventSelectors": [
+ {
+ "DataResources": [
+ {
+ "Type": "AWS::S3::Object",
+ "Values": [
+ {
+ "Fn::Join": [
+ "",
+ [
+ {
+ "Fn::GetAtt": [
+ "PipelineBucketB967BD35",
+ "Arn"
+ ]
+ },
+ "/key"
+ ]
+ ]
+ }
+ ]
+ }
+ ],
+ "IncludeManagementEvents": false,
+ "ReadWriteType": "WriteOnly"
+ }
+ ],
+ "IncludeGlobalServiceEvents": true,
+ "IsMultiRegionTrail": true
+ },
+ "DependsOn": [
+ "CloudTrailS3PolicyEA49A03E"
+ ]
+ },
  "LambdaFunServiceRoleF0979767": {
  "Type": "AWS::IAM::Role",
  "Properties": {
@@ -272,4 +508,4 @@
  ]
  }
  }
-}
+}
diff --git a/packages/@aws-cdk/aws-codepipeline/test/integ.lambda-pipeline.ts b/packages/@aws-cdk/aws-codepipeline/test/integ.lambda-pipeline.ts
@@ -1,3 +1,4 @@
+import cloudtrail = require('@aws-cdk/aws-cloudtrail');
 import lambda = require('@aws-cdk/aws-lambda');
 import s3 = require('@aws-cdk/aws-s3');
 import cdk = require('@aws-cdk/cdk');
@@ -14,11 +15,15 @@ const bucket = new s3.Bucket(stack, 'PipelineBucket', {
  versioned: true,
  removalPolicy: cdk.RemovalPolicy.Destroy,
 });
+const key = 'key';
+const trail = new cloudtrail.CloudTrail(stack, 'CloudTrail');
+trail.addS3EventSelector([bucket.arnForObjects(key)], cloudtrail.ReadWriteType.WriteOnly);
 new s3.PipelineSourceAction(stack, 'Source', {
  stage: sourceStage,
  outputArtifactName: 'SourceArtifact',
  bucket,
- bucketKey: 'key',
+ bucketKey: key,
+ pollForSourceChanges: false,
 });
 
 const lambdaFun = new lambda.Function(stack, 'LambdaFun', {

diff --git a/packages/@aws-cdk/aws-codepipeline/test/integ.pipeline-cfn-cross-region.expected.json b/packages/@aws-cdk/aws-codepipeline/test/integ.pipeline-cfn-cross-region.expected.json
@@ -161,8 +161,7 @@
  "S3Bucket": {
  "Ref": "MyBucketF68F3FF0"
  },
- "S3ObjectKey": "some/path",
- "PollForSourceChanges": true
+ "S3ObjectKey": "some/path"
  },
  "InputArtifacts": [],
  "Name": "S3",
@@ -245,4 +244,4 @@
  }
  }
  }
-}
+}
diff --git a/packages/@aws-cdk/aws-codepipeline/test/integ.pipeline-cfn.expected.json b/packages/@aws-cdk/aws-codepipeline/test/integ.pipeline-cfn.expected.json
@@ -173,8 +173,7 @@
  "S3Bucket": {
  "Ref": "PipelineBucketB967BD35"
  },
- "S3ObjectKey": "key",
- "PollForSourceChanges": true
+ "S3ObjectKey": "key"
  },
  "InputArtifacts": [],
  "Name": "Source",

diff --git a/...cdk/aws-codepipeline/test/integ.pipeline-code-build-multiple-inputs-outputs.expected.json b/...cdk/aws-codepipeline/test/integ.pipeline-code-build-multiple-inputs-outputs.expected.json
@@ -275,8 +275,7 @@
  "S3Bucket": {
  "Ref": "MyBucketF68F3FF0"
  },
- "S3ObjectKey": "some/path",
- "PollForSourceChanges": true
+ "S3ObjectKey": "some/path"
  },
  "InputArtifacts": [],
  "Name": "Source2",

diff --git a/packages/@aws-cdk/aws-codepipeline/test/integ.pipeline-code-deploy.expected.json b/packages/@aws-cdk/aws-codepipeline/test/integ.pipeline-code-deploy.expected.json
@@ -284,8 +284,7 @@
  "S3Bucket": {
  "Ref": "CodeDeployPipelineIntegTest9F618D61"
  },
- "S3ObjectKey": "application.zip",
- "PollForSourceChanges": true
+ "S3ObjectKey": "application.zip"
  },
  "InputArtifacts": [],
  "Name": "S3Source",
@@ -336,4 +335,4 @@
  ]
  }
  }
-}
+}