Skip to content

Commit 2b3e9ce

Browse files
mergify[bot]mergify[bot]
authored
Merge branch 'main' into merge-back/2.34.2
2 parents 7abcbc6 + 00a3388 commit 2b3e9ce

77 files changed

Lines changed: 5822 additions & 84 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -408,7 +408,7 @@ export class UserPoolClient extends Resource implements IUserPoolClient {
408408
}
409409

410410
private configureAuthFlows(props: UserPoolClientProps): string[] | undefined {
411-
if (!props.authFlows) return undefined;
411+
if (!props.authFlows || Object.keys(props.authFlows).length === 0) return undefined;
412412

413413
const authFlows: string[] = [];
414414
if (props.authFlows.userPassword) { authFlows.push('ALLOW_USER_PASSWORD_AUTH'); }
@@ -417,13 +417,8 @@ export class UserPoolClient extends Resource implements IUserPoolClient {
417417
if (props.authFlows.userSrp) { authFlows.push('ALLOW_USER_SRP_AUTH'); }
418418

419419
// refreshToken should always be allowed if authFlows are present
420-
if (authFlows.length > 0) {
421-
authFlows.push('ALLOW_REFRESH_TOKEN_AUTH');
422-
}
420+
authFlows.push('ALLOW_REFRESH_TOKEN_AUTH');
423421

424-
if (authFlows.length === 0) {
425-
return undefined;
426-
}
427422
return authFlows;
428423
}
429424

‎packages/@aws-cdk/aws-cognito/test/user-pool-client.test.ts‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,43 @@ describe('User Pool Client', () => {
9393
});
9494
});
9595

96+
test('ExplicitAuthFlows makes only refreshToken true when all options are false', () => {
97+
// GIVEN
98+
const stack = new Stack();
99+
const pool = new UserPool(stack, 'Pool');
100+
101+
// WHEN
102+
pool.addClient('Client', {
103+
authFlows: {
104+
adminUserPassword: false,
105+
custom: false,
106+
userPassword: false,
107+
userSrp: false,
108+
},
109+
});
110+
111+
Template.fromStack(stack).hasResourceProperties('AWS::Cognito::UserPoolClient', {
112+
ExplicitAuthFlows: [
113+
'ALLOW_REFRESH_TOKEN_AUTH',
114+
],
115+
});
116+
});
117+
118+
test('ExplicitAuthFlows is absent when authFlows is empty', () => {
119+
// GIVEN
120+
const stack = new Stack();
121+
const pool = new UserPool(stack, 'Pool');
122+
123+
// WHEN
124+
pool.addClient('Client', {
125+
authFlows: {},
126+
});
127+
128+
Template.fromStack(stack).hasResourceProperties('AWS::Cognito::UserPoolClient', {
129+
ExplicitAuthFlows: Match.absent(),
130+
});
131+
});
132+
96133
test('ExplicitAuthFlows makes refreshToken true by default', () => {
97134
// GIVEN
98135
const stack = new Stack();

‎packages/@aws-cdk/aws-config/lib/rule.ts‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -783,6 +783,16 @@ export class ManagedRuleIdentifiers {
783783
* @see https://docs.aws.amazon.com/config/latest/developerguide/ec2-imdsv2-check.html
784784
*/
785785
public static readonly EC2_IMDSV2_CHECK = 'EC2_IMDSV2_CHECK';
786+
/**
787+
* Checks if an Amazon Elastic Kubernetes Service (EKS) cluster is running the oldest supported version.
788+
* @see https://docs.aws.amazon.com/config/latest/developerguide/eks-cluster-oldest-supported-version.html
789+
*/
790+
public static readonly EKS_CLUSTER_OLDEST_SUPPORTED_VERSION = 'EKS_CLUSTER_OLDEST_SUPPORTED_VERSION';
791+
/**
792+
* Checks if an Amazon Elastic Kubernetes Service (EKS) cluster is running a supported Kubernetes version.
793+
* @see https://docs.aws.amazon.com/config/latest/developerguide/eks-cluster-supported-version.html
794+
*/
795+
public static readonly EKS_CLUSTER_SUPPORTED_VERSION = 'EKS_CLUSTER_SUPPORTED_VERSION';
786796
/**
787797
* Checks whether Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible.
788798
* @see https://docs.aws.amazon.com/config/latest/developerguide/eks-endpoint-no-public-access.html
@@ -1322,6 +1332,8 @@ export class ResourceType {
13221332
public static readonly EC2_VPC_ENDPOINT_SERVICE = new ResourceType('AWS::EC2::VPCEndpointService');
13231333
/** EC2 VPC peering connection */
13241334
public static readonly EC2_VPC_PEERING_CONNECTION = new ResourceType('AWS::EC2::VPCPeeringConnection');
1335+
/** Amazon Elastic Kubernetes Service cluster */
1336+
public static readonly EKS_CLUSTER = new ResourceType('AWS::EKS::Cluster');
13251337
/** Amazon ElasticSearch domain */
13261338
public static readonly ELASTICSEARCH_DOMAIN = new ResourceType('AWS::Elasticsearch::Domain');
13271339
/** Amazon QLDB ledger */

‎packages/@aws-cdk/aws-config/test/rule.test.ts‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,4 +264,38 @@ describe('rule', () => {
264264
},
265265
});
266266
});
267+
268+
test('Add EKS Cluster check to ManagedRule', () => {
269+
// GIVEN
270+
const stack1 = new cdk.Stack();
271+
const stack2 = new cdk.Stack();
272+
273+
// WHEN
274+
new config.ManagedRule(stack1, 'RuleEksClusterOldest', {
275+
identifier: config.ManagedRuleIdentifiers.EKS_CLUSTER_OLDEST_SUPPORTED_VERSION,
276+
ruleScope: config.RuleScope.fromResource(config.ResourceType.EKS_CLUSTER),
277+
});
278+
new config.ManagedRule(stack2, 'RuleEksClusterVersion', {
279+
identifier: config.ManagedRuleIdentifiers.EKS_CLUSTER_SUPPORTED_VERSION,
280+
ruleScope: config.RuleScope.fromResources([config.ResourceType.EKS_CLUSTER]),
281+
});
282+
283+
// THEN
284+
Template.fromStack(stack1).hasResourceProperties('AWS::Config::ConfigRule', {
285+
Source: {
286+
SourceIdentifier: 'EKS_CLUSTER_OLDEST_SUPPORTED_VERSION',
287+
},
288+
Scope: {
289+
ComplianceResourceTypes: ['AWS::EKS::Cluster'],
290+
},
291+
});
292+
Template.fromStack(stack2).hasResourceProperties('AWS::Config::ConfigRule', {
293+
Source: {
294+
SourceIdentifier: 'EKS_CLUSTER_SUPPORTED_VERSION',
295+
},
296+
Scope: {
297+
ComplianceResourceTypes: ['AWS::EKS::Cluster'],
298+
},
299+
});
300+
});
267301
});

‎packages/@aws-cdk/aws-dynamodb/lib/table.ts‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ export interface TableOptions extends SchemaOptions {
188188
*
189189
* This property cannot be set if `encryption` and/or `encryptionKey` is set.
190190
*
191-
* @default - server-side encryption is enabled with an AWS owned customer master key
191+
* @default - The table is encrypted with an encryption key managed by DynamoDB, and you are not charged any fee for using it.
192192
*
193193
* @deprecated This property is deprecated. In order to obtain the same behavior as
194194
* enabling this, set the `encryption` property to `TableEncryption.AWS_MANAGED` instead.
@@ -213,7 +213,7 @@ export interface TableOptions extends SchemaOptions {
213213
* > using CDKv1, make sure the feature flag
214214
* > `@aws-cdk/aws-kms:defaultKeyPolicies` is set to `true` in your `cdk.json`.
215215
*
216-
* @default - server-side encryption is enabled with an AWS owned customer master key
216+
* @default - The table is encrypted with an encryption key managed by DynamoDB, and you are not charged any fee for using it.
217217
*/
218218
readonly encryption?: TableEncryption;
219219

@@ -224,6 +224,8 @@ export interface TableOptions extends SchemaOptions {
224224
*
225225
* @default - If `encryption` is set to `TableEncryption.CUSTOMER_MANAGED` and this
226226
* property is undefined, a new KMS key will be created and associated with this table.
227+
* If `encryption` and this property are both undefined, then the table is encrypted with
228+
* an encryption key managed by DynamoDB, and you are not charged any fee for using it.
227229
*/
228230
readonly encryptionKey?: kms.IKey;
229231

‎packages/@aws-cdk/aws-ecs-patterns/README.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -637,6 +637,22 @@ const loadBalancedFargateService = new ecsPatterns.ApplicationLoadBalancedFargat
637637
});
638638
```
639639

640+
### Select idleTimeout for ApplicationLoadBalancedFargateService
641+
642+
```ts
643+
declare const cluster: ecs.Cluster;
644+
const loadBalancedFargateService = new ecsPatterns.ApplicationLoadBalancedFargateService(this, 'Service', {
645+
cluster,
646+
memoryLimitMiB: 1024,
647+
desiredCount: 1,
648+
cpu: 512,
649+
taskImageOptions: {
650+
image: ecs.ContainerImage.fromRegistry("amazon/amazon-ecs-sample"),
651+
},
652+
idleTimeout: Duration.seconds(120),
653+
});
654+
```
655+
640656
### Set PlatformVersion for ScheduledFargateTask
641657

642658
```ts

‎packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import { IRole } from '@aws-cdk/aws-iam';
1212
import { ARecord, IHostedZone, RecordTarget, CnameRecord } from '@aws-cdk/aws-route53';
1313
import { LoadBalancerTarget } from '@aws-cdk/aws-route53-targets';
1414
import * as cdk from '@aws-cdk/core';
15+
import { Duration } from '@aws-cdk/core';
1516
import { Construct } from 'constructs';
1617

1718
/**
@@ -269,6 +270,13 @@ export interface ApplicationLoadBalancedServiceBaseProps {
269270
* @default - false
270271
*/
271272
readonly enableExecuteCommand?: boolean;
273+
274+
/**
275+
* The load balancer idle timeout, in seconds
276+
*
277+
* @default - CloudFormation sets idle timeout to 60 seconds
278+
*/
279+
readonly idleTimeout?: Duration;
272280
}
273281

274282
export interface ApplicationLoadBalancedTaskImageOptions {
@@ -434,10 +442,17 @@ export abstract class ApplicationLoadBalancedServiceBase extends Construct {
434442

435443
const internetFacing = props.publicLoadBalancer ?? true;
436444

445+
if (props.idleTimeout) {
446+
if (props.idleTimeout > Duration.seconds(4000) || props.idleTimeout < Duration.seconds(1)) {
447+
throw new Error('Load balancer idle timeout must be between 1 and 4000 seconds.');
448+
}
449+
}
450+
437451
const lbProps = {
438452
vpc: this.cluster.vpc,
439453
loadBalancerName: props.loadBalancerName,
440454
internetFacing,
455+
idleTimeout: props.idleTimeout,
441456
};
442457

443458
const loadBalancer = props.loadBalancer ?? new ApplicationLoadBalancer(this, 'LB', lbProps);

‎packages/@aws-cdk/aws-ecs-patterns/test/ec2/l3s.test.ts‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import { PublicHostedZone } from '@aws-cdk/aws-route53';
1010
import * as cloudmap from '@aws-cdk/aws-servicediscovery';
1111
import { testLegacyBehavior } from '@aws-cdk/cdk-build-tools';
1212
import * as cdk from '@aws-cdk/core';
13+
import { Duration } from '@aws-cdk/core';
1314
import * as cxapi from '@aws-cdk/cx-api';
1415
import * as ecsPatterns from '../../lib';
1516

@@ -811,6 +812,121 @@ test('errors when setting HTTPS protocol but not domain name', () => {
811812
}).toThrow();
812813
});
813814

815+
test('errors when idleTimeout is over 4000 seconds', () => {
816+
// GIVEN
817+
const stack = new cdk.Stack();
818+
const vpc = new ec2.Vpc(stack, 'VPC');
819+
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });
820+
821+
// THEN
822+
expect(() => {
823+
new ecsPatterns.ApplicationLoadBalancedFargateService(stack, 'Service', {
824+
cluster,
825+
taskImageOptions: {
826+
image: ecs.ContainerImage.fromRegistry('test'),
827+
enableLogging: false,
828+
environment: {
829+
TEST_ENVIRONMENT_VARIABLE1: 'test environment variable 1 value',
830+
TEST_ENVIRONMENT_VARIABLE2: 'test environment variable 2 value',
831+
},
832+
logDriver: new ecs.AwsLogDriver({
833+
streamPrefix: 'TestStream',
834+
}),
835+
},
836+
idleTimeout: Duration.seconds(5000),
837+
desiredCount: 2,
838+
});
839+
}).toThrowError();
840+
});
841+
842+
test('errors when idleTimeout is under 1 seconds', () => {
843+
// GIVEN
844+
const stack = new cdk.Stack();
845+
const vpc = new ec2.Vpc(stack, 'VPC');
846+
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });
847+
848+
// THEN
849+
expect(() => {
850+
new ecsPatterns.ApplicationLoadBalancedFargateService(stack, 'Service', {
851+
cluster,
852+
taskImageOptions: {
853+
image: ecs.ContainerImage.fromRegistry('test'),
854+
enableLogging: false,
855+
environment: {
856+
TEST_ENVIRONMENT_VARIABLE1: 'test environment variable 1 value',
857+
TEST_ENVIRONMENT_VARIABLE2: 'test environment variable 2 value',
858+
},
859+
logDriver: new ecs.AwsLogDriver({
860+
streamPrefix: 'TestStream',
861+
}),
862+
},
863+
idleTimeout: Duration.seconds(0),
864+
desiredCount: 2,
865+
});
866+
}).toThrowError();
867+
});
868+
869+
test('passes when idleTimeout is between 1 and 4000 seconds', () => {
870+
// GIVEN
871+
const stack = new cdk.Stack();
872+
const vpc = new ec2.Vpc(stack, 'VPC');
873+
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });
874+
875+
// THEN
876+
expect(() => {
877+
new ecsPatterns.ApplicationLoadBalancedFargateService(stack, 'Service', {
878+
cluster,
879+
taskImageOptions: {
880+
image: ecs.ContainerImage.fromRegistry('test'),
881+
enableLogging: false,
882+
environment: {
883+
TEST_ENVIRONMENT_VARIABLE1: 'test environment variable 1 value',
884+
TEST_ENVIRONMENT_VARIABLE2: 'test environment variable 2 value',
885+
},
886+
logDriver: new ecs.AwsLogDriver({
887+
streamPrefix: 'TestStream',
888+
}),
889+
},
890+
idleTimeout: Duration.seconds(120),
891+
desiredCount: 2,
892+
});
893+
}).toBeTruthy();
894+
});
895+
896+
test('idletime is undefined when not set', () => {
897+
// GIVEN
898+
const stack = new cdk.Stack();
899+
const vpc = new ec2.Vpc(stack, 'VPC');
900+
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });
901+
902+
// WHEN
903+
new ecsPatterns.ApplicationLoadBalancedFargateService(stack, 'Service', {
904+
cluster,
905+
taskImageOptions: {
906+
image: ecs.ContainerImage.fromRegistry('test'),
907+
enableLogging: false,
908+
environment: {
909+
TEST_ENVIRONMENT_VARIABLE1: 'test environment variable 1 value',
910+
TEST_ENVIRONMENT_VARIABLE2: 'test environment variable 2 value',
911+
},
912+
logDriver: new ecs.AwsLogDriver({
913+
streamPrefix: 'TestStream',
914+
}),
915+
},
916+
desiredCount: 2,
917+
});
918+
919+
// THEN - stack contains default LoadBalancer Attributes
920+
Template.fromStack(stack).hasResourceProperties('AWS::ElasticLoadBalancingV2::LoadBalancer', {
921+
LoadBalancerAttributes: [
922+
{
923+
Key: 'deletion_protection.enabled',
924+
Value: 'false',
925+
},
926+
],
927+
});
928+
});
929+
814930
test('test Fargate loadbalanced construct with optional log driver input', () => {
815931
// GIVEN
816932
const stack = new cdk.Stack();

0 commit comments

Comments
 (0)