fix(codepipeline): grant missing permisisons to the CloudFormationExe…

…cuteChangeSetAction. (#3178) Fixes #3160
aws · Jul 2, 2019 · 958acc2 · 958acc2
1 parent cd1b16f
commit 958acc2
Show file tree

Hide file tree

Showing 4 changed files with 25 additions and 9 deletions.
diff --git a/packages/@aws-cdk/app-delivery/test/integ.cicd.expected.json b/packages/@aws-cdk/app-delivery/test/integ.cicd.expected.json
@@ -251,9 +251,13 @@
  "PolicyDocument": {
  "Statement": [
  {
- "Action": "cloudformation:ExecuteChangeSet",
+ "Action": [
+ "cloudformation:DescribeChangeSet",
+ "cloudformation:DescribeStacks",
+ "cloudformation:ExecuteChangeSet"
+ ],
  "Condition": {
- "StringEquals": {
+ "StringEqualsIfExists": {
  "cloudformation:ChangeSetName": "CICD-ChangeSet"
  }
  },

diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/cloudformation/pipeline-actions.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/cloudformation/pipeline-actions.ts
@@ -494,8 +494,12 @@ class SingletonPolicy extends cdk.Construct implements iam.IGrantable {
 
  public grantExecuteChangeSet(props: { stackName: string, changeSetName: string, region?: string }): void {
  this.statementFor({
- actions: ['cloudformation:ExecuteChangeSet'],
- conditions: { StringEquals: { 'cloudformation:ChangeSetName': props.changeSetName } },
+ actions: [
+ 'cloudformation:DescribeStacks',
+ 'cloudformation:DescribeChangeSet',
+ 'cloudformation:ExecuteChangeSet',
+ ],
+ conditions: { StringEqualsIfExists: { 'cloudformation:ChangeSetName': props.changeSetName } },
  }).addResources(this.stackArnFromProps(props));
  }
 

diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/cloudformation/test.pipeline-actions.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/cloudformation/test.pipeline-actions.ts
@@ -123,7 +123,7 @@ export = nodeunit.testCase({
 
  const stackArn = _stackArn('MyStack', stack);
  _assertPermissionGranted(test, pipelineRole.statements, 'cloudformation:ExecuteChangeSet', stackArn,
- { StringEquals: { 'cloudformation:ChangeSetName': 'MyChangeSet' } });
+ { StringEqualsIfExists: { 'cloudformation:ChangeSetName': 'MyChangeSet' } });
 
  _assertActionMatches(test, stage.actions, 'CloudFormation', 'Deploy', {
  ActionMode: 'CHANGE_SET_EXECUTE',
@@ -157,8 +157,12 @@ export = nodeunit.testCase({
  stack.resolve(pipelineRole.statements.map(s => s.toStatementJson())),
  [
  {
- Action: 'cloudformation:ExecuteChangeSet',
- Condition: { StringEquals: { 'cloudformation:ChangeSetName': 'MyChangeSet' } },
+ Action: [
+ 'cloudformation:DescribeChangeSet',
+ 'cloudformation:DescribeStacks',
+ 'cloudformation:ExecuteChangeSet',
+ ],
+ Condition: { StringEqualsIfExists: { 'cloudformation:ChangeSetName': 'MyChangeSet' } },
  Effect: 'Allow',
  Resource: [
  // tslint:disable-next-line:max-line-length

diff --git a/...ges/@aws-cdk/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.expected.json b/...ges/@aws-cdk/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.expected.json
@@ -770,9 +770,13 @@
  "PolicyDocument": {
  "Statement": [
  {
- "Action": "cloudformation:ExecuteChangeSet",
+ "Action": [
+ "cloudformation:DescribeChangeSet",
+ "cloudformation:DescribeStacks",
+ "cloudformation:ExecuteChangeSet"
+ ],
  "Condition": {
- "StringEquals": {
+ "StringEqualsIfExists": {
  "cloudformation:ChangeSetName": "StagedChangeSet"
  }
  },