fix(appsync): fully qualify service principal

In aws#22819, a feature flag was added to use standardized service principal names instead of using a database lookup. This reference wasn't updated which causes failures in new CDK applications that try to create AppSync resources. This change passes the fully qualified service principal when creating a service role for a new data source. fixes aws#23035
jpignata · Nov 23, 2022 · b2fb4d0 · b2fb4d0
1 parent 6f4dcfd
commit b2fb4d0
Show file tree

Hide file tree

Showing 17 changed files with 25 additions and 23 deletions.
diff --git a/packages/@aws-cdk/aws-appsync/lib/data-source.ts b/packages/@aws-cdk/aws-appsync/lib/data-source.ts
@@ -113,7 +113,9 @@ export abstract class BaseDataSource extends Construct {
     super(scope, id);
 
     if (extended.type !== 'NONE') {
-      this.serviceRole = props.serviceRole || new Role(this, 'ServiceRole', { assumedBy: new ServicePrincipal('appsync') });
+      this.serviceRole = props.serviceRole || new Role(this, 'ServiceRole', {
+        assumedBy: new ServicePrincipal('appsync.amazonaws.com'),
+      });
     }
     // Replace unsupported characters from DataSource name. The only allowed pattern is: {[_A-Za-z][_0-9A-Za-z]*}
     const name = (props.name ?? id);

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.api-import.js.snapshot/stack.template.json b/packages/@aws-cdk/aws-appsync/test/integ.api-import.js.snapshot/stack.template.json
@@ -9,7 +9,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync.amazonaws.com"
+        "Service": "appsync"
        }
       }
      ],

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.api-import.js.snapshot/tree.json b/packages/@aws-cdk/aws-appsync/test/integ.api-import.js.snapshot/tree.json
@@ -132,7 +132,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync.amazonaws.com"
+                                    "Service": "appsync"
                                   }
                                 }
                               ],

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.appsync-lambda.js.snapshot/stack.template.json b/packages/@aws-cdk/aws-appsync/test/integ.appsync-lambda.js.snapshot/stack.template.json
@@ -42,7 +42,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync.amazonaws.com"
+        "Service": "appsync"
        }
       }
      ],

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.appsync-lambda.js.snapshot/tree.json b/packages/@aws-cdk/aws-appsync/test/integ.appsync-lambda.js.snapshot/tree.json
@@ -94,7 +94,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync.amazonaws.com"
+                                    "Service": "appsync"
                                   }
                                 }
                               ],

diff --git a/...s/@aws-cdk/aws-appsync/test/integ.auth-apikey.js.snapshot/aws-appsync-integ.template.json b/...s/@aws-cdk/aws-appsync/test/integ.auth-apikey.js.snapshot/aws-appsync-integ.template.json
@@ -42,7 +42,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync"
+        "Service": "appsync.amazonaws.com"
        }
       }
      ],

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.auth-apikey.js.snapshot/tree.json b/packages/@aws-cdk/aws-appsync/test/integ.auth-apikey.js.snapshot/tree.json
@@ -94,7 +94,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync"
+                                    "Service": "appsync.amazonaws.com"
                                   }
                                 }
                               ],

diff --git a/...-appsync/test/integ.graphql-elasticsearch.js.snapshot/appsync-elasticsearch.template.json b/...-appsync/test/integ.graphql-elasticsearch.js.snapshot/appsync-elasticsearch.template.json
@@ -90,7 +90,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync"
+        "Service": "appsync.amazonaws.com"
        }
       }
      ],

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.graphql-elasticsearch.js.snapshot/tree.json b/packages/@aws-cdk/aws-appsync/test/integ.graphql-elasticsearch.js.snapshot/tree.json
@@ -177,7 +177,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync"
+                                    "Service": "appsync.amazonaws.com"
                                   }
                                 }
                               ],

diff --git a/...s/@aws-cdk/aws-appsync/test/integ.graphql-iam.js.snapshot/aws-appsync-integ.template.json b/...s/@aws-cdk/aws-appsync/test/integ.graphql-iam.js.snapshot/aws-appsync-integ.template.json
@@ -74,7 +74,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync"
+        "Service": "appsync.amazonaws.com"
        }
       }
      ],

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.graphql-iam.js.snapshot/tree.json b/packages/@aws-cdk/aws-appsync/test/integ.graphql-iam.js.snapshot/tree.json
@@ -137,7 +137,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync"
+                                    "Service": "appsync.amazonaws.com"
                                   }
                                 }
                               ],

diff --git a/...dk/aws-appsync/test/integ.graphql-opensearch.js.snapshot/appsync-opensearch.template.json b/...dk/aws-appsync/test/integ.graphql-opensearch.js.snapshot/appsync-opensearch.template.json
@@ -87,7 +87,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync"
+        "Service": "appsync.amazonaws.com"
        }
       }
      ],

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.js.snapshot/tree.json b/packages/@aws-cdk/aws-appsync/test/integ.graphql-opensearch.js.snapshot/tree.json
@@ -174,7 +174,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync"
+                                    "Service": "appsync.amazonaws.com"
                                   }
                                 }
                               ],

diff --git a/...aws-cdk/aws-appsync/test/integ.graphql-schema.js.snapshot/code-first-schema.template.json b/...aws-cdk/aws-appsync/test/integ.graphql-schema.js.snapshot/code-first-schema.template.json
@@ -42,7 +42,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync"
+        "Service": "appsync.amazonaws.com"
        }
       }
      ],

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.graphql-schema.js.snapshot/tree.json b/packages/@aws-cdk/aws-appsync/test/integ.graphql-schema.js.snapshot/tree.json
@@ -94,7 +94,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync"
+                                    "Service": "appsync.amazonaws.com"
                                   }
                                 }
                               ],

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.graphql.js.snapshot/aws-appsync-integ.template.json b/packages/@aws-cdk/aws-appsync/test/integ.graphql.js.snapshot/aws-appsync-integ.template.json
@@ -122,7 +122,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync"
+        "Service": "appsync.amazonaws.com"
        }
       }
      ],
@@ -420,7 +420,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync"
+        "Service": "appsync.amazonaws.com"
        }
       }
      ],
@@ -1233,7 +1233,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync"
+        "Service": "appsync.amazonaws.com"
        }
       }
      ],
@@ -1396,7 +1396,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "appsync"
+        "Service": "appsync.amazonaws.com"
        }
       }
      ],

diff --git a/packages/@aws-cdk/aws-appsync/test/integ.graphql.js.snapshot/tree.json b/packages/@aws-cdk/aws-appsync/test/integ.graphql.js.snapshot/tree.json
@@ -222,7 +222,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync"
+                                    "Service": "appsync.amazonaws.com"
                                   }
                                 }
                               ],
@@ -714,7 +714,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync"
+                                    "Service": "appsync.amazonaws.com"
                                   }
                                 }
                               ],
@@ -2057,7 +2057,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync"
+                                    "Service": "appsync.amazonaws.com"
                                   }
                                 }
                               ],
@@ -2316,7 +2316,7 @@
                                   "Action": "sts:AssumeRole",
                                   "Effect": "Allow",
                                   "Principal": {
-                                    "Service": "appsync"
+                                    "Service": "appsync.amazonaws.com"
                                   }
                                 }
                               ],