Skip to content

Commit 142e5de

Browse files
iliapoloiliapolo
authored
Merge branch 'main' into epolon/cdklabs-analytics
2 parents 164549a + 262d8c7 commit 142e5de

42 files changed

Lines changed: 1321 additions & 56 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎CONTRIBUTING.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -329,6 +329,11 @@ $ yarn watch & # runs in the background
329329
[conventionalcommits](https://www.conventionalcommits.org).
330330
* The title must begin with `feat(module): title`, `fix(module): title`, `refactor(module): title` or
331331
`chore(module): title`.
332+
* `feat`: indicates a feature added (requires tests and README updates in principle, but can be suppressed)
333+
* `fix`: indicates a bug fixes (requires tests in principle, but can be suppressed)
334+
* `docs`: indicates updated documentation (docstrings or Markdown files)
335+
* `refactor`: indicates a feature-preserving refactoring
336+
* `chore`: something without directly visible user benefit (does not end up in the CHANGELOG). Typically used for build scripts, config, or changes so minor they don't warrant showing up the CHANGELOG.
332337
* Titles for `feat` and `fix` PRs end up in the change log. Think about what makes most sense for users reading the changelog while writing them.
333338
* `feat`: describe the feature (not the action of creating the commit or PR, for example, avoid words like "added" or "changed")
334339
* `fix`: describe the bug (not the solution)

‎docs/DESIGN_GUIDELINES.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -754,10 +754,10 @@ interface IFoo extends IConstruct {
754754
class Foo extends Construct implements IFoo {
755755
public bar() { }
756756

757-
/** @mutating */
757+
@config
758758
public goo() { }
759759

760-
public mutateMe() { } // ERROR! missing "@mutating" or missing on IFoo
760+
public mutateMe() { } // ERROR! missing "@config" or missing on IFoo
761761
}
762762
```
763763

‎packages/@aws-cdk/aws-batch/README.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,23 @@ new batch.JobDefinition(this, 'job-def', {
300300
});
301301
```
302302

303+
### Using the secret on secrets manager
304+
305+
You can set the environment variables from secrets manager.
306+
307+
```ts
308+
const dbSecret = new secretsmanager.Secret(this, 'secret');
309+
310+
new batch.JobDefinition(this, 'batch-job-def-secrets', {
311+
container: {
312+
image: ecs.EcrImage.fromRegistry('docker/whalesay'),
313+
secrets: {
314+
PASSWORD: ecs.Secret.fromSecretsManager(dbSecret, 'password'),
315+
},
316+
},
317+
});
318+
```
319+
303320
### Importing an existing Job Definition
304321

305322
#### From ARN

‎packages/@aws-cdk/aws-batch/lib/job-definition.ts‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,13 @@ export interface JobDefinitionContainer {
112112
*/
113113
readonly environment?: { [key: string]: string };
114114

115+
/**
116+
* The environment variables from secrets manager or ssm parameter store
117+
*
118+
* @default none
119+
*/
120+
readonly secrets?: { [key: string]: ecs.Secret };
121+
115122
/**
116123
* The image used to start a container.
117124
*/
@@ -453,6 +460,14 @@ export class JobDefinition extends Resource implements IJobDefinition {
453460
platformCapabilities: props.platformCapabilities ?? [PlatformCapabilities.EC2],
454461
});
455462

463+
// add read secrets permission to execution role
464+
if ( props.container.secrets && props.container.executionRole ) {
465+
const executionRole = props.container.executionRole;
466+
Object.values(props.container.secrets).forEach((secret) => {
467+
secret.grantRead(executionRole);
468+
});
469+
}
470+
456471
this.jobDefinitionArn = this.getResourceArnAttribute(jobDef.ref, {
457472
service: 'batch',
458473
resource: 'job-definition',
@@ -507,6 +522,14 @@ export class JobDefinition extends Resource implements IJobDefinition {
507522
return {
508523
command: container.command,
509524
environment: this.deserializeEnvVariables(container.environment),
525+
secrets: container.secrets
526+
? Object.entries(container.secrets).map(([key, value]) => {
527+
return {
528+
name: key,
529+
valueFrom: value.arn,
530+
};
531+
})
532+
: undefined,
510533
image: this.imageConfig.imageName,
511534
instanceType: container.instanceType && container.instanceType.toString(),
512535
jobRoleArn: container.jobRole && container.jobRole.roleArn,

‎packages/@aws-cdk/aws-batch/rosetta/default.ts-fixture‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import { Stack } from '@aws-cdk/core';
44
import * as ec2 from '@aws-cdk/aws-ec2';
55
import * as batch from '@aws-cdk/aws-batch';
66
import * as ecs from '@aws-cdk/aws-ecs';
7+
import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
78

89
class Fixture extends Stack {
910
constructor(scope: Construct, id: string) {

‎packages/@aws-cdk/aws-batch/test/batch.integ.snapshot/batch-stack.assets.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "20.0.0",
3+
"files": {
4+
"d3685c79f9ec67f5dd6fda839a136b079f201b3d72695fe0ea3b3788c3471cc8": {
5+
"source": {
6+
"path": "batch-stack.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "d3685c79f9ec67f5dd6fda839a136b079f201b3d72695fe0ea3b3788c3471cc8.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-batch/test/batch.integ.snapshot/batch-stack.template.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1365,6 +1365,14 @@
13651365
"UpdateReplacePolicy": "Retain",
13661366
"DeletionPolicy": "Retain"
13671367
},
1368+
"batchsecret7CD5E4C6": {
1369+
"Type": "AWS::SecretsManager::Secret",
1370+
"Properties": {
1371+
"GenerateSecretString": {}
1372+
},
1373+
"UpdateReplacePolicy": "Delete",
1374+
"DeletionPolicy": "Delete"
1375+
},
13681376
"batchjobdeffromecrE0E30DAD": {
13691377
"Type": "AWS::Batch::JobDefinition",
13701378
"Properties": {
@@ -1486,6 +1494,32 @@
14861494
}
14871495
}
14881496
},
1497+
"executionroleDefaultPolicy497F11A3": {
1498+
"Type": "AWS::IAM::Policy",
1499+
"Properties": {
1500+
"PolicyDocument": {
1501+
"Statement": [
1502+
{
1503+
"Action": [
1504+
"secretsmanager:DescribeSecret",
1505+
"secretsmanager:GetSecretValue"
1506+
],
1507+
"Effect": "Allow",
1508+
"Resource": {
1509+
"Ref": "batchsecret7CD5E4C6"
1510+
}
1511+
}
1512+
],
1513+
"Version": "2012-10-17"
1514+
},
1515+
"PolicyName": "executionroleDefaultPolicy497F11A3",
1516+
"Roles": [
1517+
{
1518+
"Ref": "executionroleD9A39BE6"
1519+
}
1520+
]
1521+
}
1522+
},
14891523
"batchjobdeffargate7FE30059": {
14901524
"Type": "AWS::Batch::JobDefinition",
14911525
"Properties": {
@@ -1509,6 +1543,14 @@
15091543
"Type": "MEMORY",
15101544
"Value": "512"
15111545
}
1546+
],
1547+
"Secrets": [
1548+
{
1549+
"Name": "SECRET",
1550+
"ValueFrom": {
1551+
"Ref": "batchsecret7CD5E4C6"
1552+
}
1553+
}
15121554
]
15131555
},
15141556
"PlatformCapabilities": [

‎packages/@aws-cdk/aws-batch/test/batch.integ.snapshot/cdk.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"17.0.0"}
1+
{"version":"20.0.0"}

‎packages/@aws-cdk/aws-batch/test/batch.integ.snapshot/integ.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
2-
"version": "18.0.0",
2+
"version": "20.0.0",
33
"testCases": {
4-
"aws-batch/test/integ.batch": {
4+
"integ.batch": {
55
"stacks": [
66
"batch-stack"
77
],

‎packages/@aws-cdk/aws-batch/test/batch.integ.snapshot/manifest.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "17.0.0",
2+
"version": "20.0.0",
33
"artifacts": {
44
"Tree": {
55
"type": "cdk:tree",
@@ -285,6 +285,12 @@
285285
"data": "batchjobrepo4C508C51"
286286
}
287287
],
288+
"/batch-stack/batch-secret/Resource": [
289+
{
290+
"type": "aws:cdk:logicalId",
291+
"data": "batchsecret7CD5E4C6"
292+
}
293+
],
288294
"/batch-stack/batch-job-def-from-ecr/Resource": [
289295
{
290296
"type": "aws:cdk:logicalId",
@@ -303,6 +309,12 @@
303309
"data": "executionroleD9A39BE6"
304310
}
305311
],
312+
"/batch-stack/execution-role/DefaultPolicy/Resource": [
313+
{
314+
"type": "aws:cdk:logicalId",
315+
"data": "executionroleDefaultPolicy497F11A3"
316+
}
317+
],
306318
"/batch-stack/batch-job-def-fargate/Resource": [
307319
{
308320
"type": "aws:cdk:logicalId",

0 commit comments

Comments
 (0)