feat: add notification option for secrets

src/index.ts

@@ -17,10 +17,13 @@ import {
   Grant,
   PolicyStatement,
   AddToResourcePolicyResult,
+  Role,
+  ServicePrincipal,
 } from 'aws-cdk-lib/aws-iam';
 import { IKey, Key } from 'aws-cdk-lib/aws-kms';
 import { Code, Runtime, SingletonFunction } from 'aws-cdk-lib/aws-lambda';
 import { Asset } from 'aws-cdk-lib/aws-s3-assets';
+import { CfnSchedule } from 'aws-cdk-lib/aws-scheduler';
 import {
   ISecret,
   ISecretAttachmentTarget,
@@ -29,6 +32,7 @@ import {
   Secret,
   SecretProps,
 } from 'aws-cdk-lib/aws-secretsmanager';
+import { Subscription, SubscriptionProtocol, Topic } from 'aws-cdk-lib/aws-sns';
 import { Construct } from 'constructs';
 
 export enum UploadType {
@@ -119,6 +123,25 @@ export interface SopsSyncProps extends SopsSyncOptions {
   readonly secret: ISecret;
 }
 
+/**
+ * The configuration options for ExpireNotification
+ */
+export interface ExpireNotificationProps {
+  /**
+   * To which mail address should the notification be sent?
+   */
+  readonly mail: string;
+  /**
+   * The expire date of the secret
+   */
+  readonly expireDate: Date;
+  /**
+   * When should the notification be sent?
+   * @default - 7 days before expire
+   */
+  readonly notifyBeforeExpire?: Duration;
+}
+
 /**
  * The custom resource, that is syncing the content from a sops file to a secret.
  */
@@ -398,4 +421,37 @@ export class SopsSecret extends Construct implements ISecret {
   public get secretValue(): SecretValue {
     return this.secretValueFromJson('');
   }
+
+  public addExpireNotification(id: string, props: ExpireNotificationProps) {
+    const topic = new Topic(this, `Notification${id}`, {
+      displayName: `SopsSecretExpireNotification ${id} for ${this.secretName}`,
+      topicName: `${this.secretName}-${id}`,
+    });
+
+    new Subscription(this, 'subscription', {
+      protocol: SubscriptionProtocol.EMAIL,
+      topic,
+      endpoint: props.mail,
+    });
+
+    const duration = props.notifyBeforeExpire ?? Duration.days(7);
+    const schedule = new Date(
+      props.expireDate.getTime() - duration.toMilliseconds(),
+    );
+
+    const notificationRole = new Role(this, 'notificationRole', {
+      assumedBy: new ServicePrincipal('scheduler.amazonaws.com'),
+    });
+    new CfnSchedule(this, 'schedule', {
+      flexibleTimeWindow: {
+        mode: 'OFF',
+      },
+      scheduleExpression: `at(${schedule.toISOString().split('.')[0]})`,
+      target: {
+        arn: topic.topicArn,
+        roleArn: notificationRole.roleArn,
+        input: 'Secret will expire soon',
+      },
+    });
+  }
 }

test/secret-asset.integ.snapshot/SecretIntegrationAsset.assets.json

@@ -1,28 +1,28 @@
 {
-  "version": "15.0.0",
+  "version": "36.0.0",
   "files": {
-    "971390b71924b03c2695df8e192ac30e706db615a12cb6f3f7f85d94ef827df6": {
+    "19c55285c15d2eb1b0e48c9ec3e97033dae693fa3326f74b0dbed127741e6245": {
       "source": {
-        "path": "asset.971390b71924b03c2695df8e192ac30e706db615a12cb6f3f7f85d94ef827df6.zip",
+        "path": "asset.19c55285c15d2eb1b0e48c9ec3e97033dae693fa3326f74b0dbed127741e6245.zip",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "971390b71924b03c2695df8e192ac30e706db615a12cb6f3f7f85d94ef827df6.zip",
+          "objectKey": "19c55285c15d2eb1b0e48c9ec3e97033dae693fa3326f74b0dbed127741e6245.zip",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
     },
-    "e209a4ac0664360bb5f347796bcf25bcda9889a1f4c3c1b55cbe0b459647bbe3": {
+    "4c388bb67a4d564f05d223626c551e2a1cb75fce51680e92350d4b6aeed19437": {
       "source": {
         "path": "SecretIntegrationAsset.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "e209a4ac0664360bb5f347796bcf25bcda9889a1f4c3c1b55cbe0b459647bbe3.json",
+          "objectKey": "4c388bb67a4d564f05d223626c551e2a1cb75fce51680e92350d4b6aeed19437.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }