Skip to content

Commit 9d71bef

Browse files
mergify[bot]mergify[bot]
authored
Merge branch 'master' into master
2 parents d7f5ff3 + a2eb092 commit 9d71bef

230 files changed

Lines changed: 1554 additions & 420 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎packages/@aws-cdk/aws-cloudfront/lib/distribution.ts‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -430,10 +430,7 @@ export class Distribution extends Resource implements IDistribution {
430430
throw new Error('Explicitly disabled logging but provided a logging bucket.');
431431
}
432432

433-
const bucket = props.logBucket ?? new s3.Bucket(this, 'LoggingBucket', {
434-
encryption: s3.BucketEncryption.S3_MANAGED,
435-
enforceSSL: true,
436-
});
433+
const bucket = props.logBucket ?? new s3.Bucket(this, 'LoggingBucket');
437434
return {
438435
bucket: bucket.bucketRegionalDomainName,
439436
includeCookies: props.logIncludesCookies,

‎packages/@aws-cdk/aws-cloudfront/lib/web-distribution.ts‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -954,10 +954,7 @@ export class CloudFrontWebDistribution extends cdk.Resource implements IDistribu
954954
}
955955

956956
if (props.loggingConfig) {
957-
this.loggingBucket = props.loggingConfig.bucket || new s3.Bucket(this, 'LoggingBucket', {
958-
encryption: s3.BucketEncryption.S3_MANAGED,
959-
enforceSSL: true,
960-
});
957+
this.loggingBucket = props.loggingConfig.bucket || new s3.Bucket(this, 'LoggingBucket');
961958
distributionConfig = {
962959
...distributionConfig,
963960
logging: {

‎packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-bucket-logging.expected.json‎

Lines changed: 0 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -75,67 +75,9 @@
7575
},
7676
"AnAmazingWebsiteProbably2LoggingBucket222F7CE9": {
7777
"Type": "AWS::S3::Bucket",
78-
"Properties": {
79-
"BucketEncryption": {
80-
"ServerSideEncryptionConfiguration": [
81-
{
82-
"ServerSideEncryptionByDefault": {
83-
"SSEAlgorithm": "AES256"
84-
}
85-
}
86-
]
87-
}
88-
},
8978
"UpdateReplacePolicy": "Retain",
9079
"DeletionPolicy": "Retain"
9180
},
92-
"AnAmazingWebsiteProbably2LoggingBucketPolicyE298B456": {
93-
"Type": "AWS::S3::BucketPolicy",
94-
"Properties": {
95-
"Bucket": {
96-
"Ref": "AnAmazingWebsiteProbably2LoggingBucket222F7CE9"
97-
},
98-
"PolicyDocument": {
99-
"Statement": [
100-
{
101-
"Action": "s3:*",
102-
"Condition": {
103-
"Bool": {
104-
"aws:SecureTransport": "false"
105-
}
106-
},
107-
"Effect": "Deny",
108-
"Principal": {
109-
"AWS": "*"
110-
},
111-
"Resource": [
112-
{
113-
"Fn::GetAtt": [
114-
"AnAmazingWebsiteProbably2LoggingBucket222F7CE9",
115-
"Arn"
116-
]
117-
},
118-
{
119-
"Fn::Join": [
120-
"",
121-
[
122-
{
123-
"Fn::GetAtt": [
124-
"AnAmazingWebsiteProbably2LoggingBucket222F7CE9",
125-
"Arn"
126-
]
127-
},
128-
"/*"
129-
]
130-
]
131-
}
132-
]
133-
}
134-
],
135-
"Version": "2012-10-17"
136-
}
137-
}
138-
},
13981
"AnAmazingWebsiteProbably2CFDistribution7C1CCD12": {
14082
"Type": "AWS::CloudFront::Distribution",
14183
"Properties": {

‎packages/@aws-cdk/aws-cloudfront/test/integ.distribution-extensive.expected.json‎

Lines changed: 0 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -2,67 +2,9 @@
22
"Resources": {
33
"MyDistLoggingBucket9B8976BC": {
44
"Type": "AWS::S3::Bucket",
5-
"Properties": {
6-
"BucketEncryption": {
7-
"ServerSideEncryptionConfiguration": [
8-
{
9-
"ServerSideEncryptionByDefault": {
10-
"SSEAlgorithm": "AES256"
11-
}
12-
}
13-
]
14-
}
15-
},
165
"UpdateReplacePolicy": "Retain",
176
"DeletionPolicy": "Retain"
187
},
19-
"MyDistLoggingBucketPolicy847D8D11": {
20-
"Type": "AWS::S3::BucketPolicy",
21-
"Properties": {
22-
"Bucket": {
23-
"Ref": "MyDistLoggingBucket9B8976BC"
24-
},
25-
"PolicyDocument": {
26-
"Statement": [
27-
{
28-
"Action": "s3:*",
29-
"Condition": {
30-
"Bool": {
31-
"aws:SecureTransport": "false"
32-
}
33-
},
34-
"Effect": "Deny",
35-
"Principal": {
36-
"AWS": "*"
37-
},
38-
"Resource": [
39-
{
40-
"Fn::GetAtt": [
41-
"MyDistLoggingBucket9B8976BC",
42-
"Arn"
43-
]
44-
},
45-
{
46-
"Fn::Join": [
47-
"",
48-
[
49-
{
50-
"Fn::GetAtt": [
51-
"MyDistLoggingBucket9B8976BC",
52-
"Arn"
53-
]
54-
},
55-
"/*"
56-
]
57-
]
58-
}
59-
]
60-
}
61-
],
62-
"Version": "2012-10-17"
63-
}
64-
}
65-
},
668
"MyDistDB88FD9A": {
679
"Type": "AWS::CloudFront::Distribution",
6810
"Properties": {

‎packages/@aws-cdk/aws-ec2/README.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1051,6 +1051,37 @@ new ec2.Instance(this, 'Instance', {
10511051

10521052
```
10531053

1054+
It is also possible to encrypt the block devices. In this example we will create an customer managed key encrypted EBS-backed root device:
1055+
1056+
```ts
1057+
import { Key } from '@aws-cdk/aws-kms';
1058+
1059+
declare const vpc: ec2.Vpc;
1060+
declare const instanceType: ec2.InstanceType;
1061+
declare const machineImage: ec2.IMachineImage;
1062+
1063+
const kmsKey = new Key(this, 'KmsKey')
1064+
1065+
new ec2.Instance(this, 'Instance', {
1066+
vpc,
1067+
instanceType,
1068+
machineImage,
1069+
1070+
// ...
1071+
1072+
blockDevices: [
1073+
{
1074+
deviceName: '/dev/sda1',
1075+
volume: ec2.BlockDeviceVolume.ebs(50, {
1076+
encrypted: true,
1077+
kmsKey: kmsKey,
1078+
}),
1079+
},
1080+
],
1081+
});
1082+
1083+
```
1084+
10541085
### Volumes
10551086

10561087
Whereas a `BlockDeviceVolume` is an EBS volume that is created and destroyed as part of the creation and destruction of a specific instance. A `Volume` is for when you want an EBS volume separate from any particular instance. A `Volume` is an EBS block device that can be attached to, or detached from, any instance at any time. Some types of `Volume`s can also be attached to multiple instances at the same time to allow you to have shared storage between those instances.

‎packages/@aws-cdk/aws-ec2/lib/private/ebs-util.ts‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,11 @@ function synthesizeBlockDeviceMappings<RT, NDT>(construct: Construct, blockDevic
2424
return blockDevices.map<RT>(({ deviceName, volume, mappingEnabled }): RT => {
2525
const { virtualName, ebsDevice: ebs } = volume;
2626

27+
let finalEbs: CfnLaunchTemplate.EbsProperty | CfnInstance.EbsProperty | undefined;
28+
2729
if (ebs) {
28-
const { iops, volumeType } = ebs;
30+
31+
const { iops, volumeType, kmsKey, ...rest } = ebs;
2932

3033
if (!iops) {
3134
if (volumeType === EbsDeviceVolumeType.IO1) {
@@ -34,9 +37,25 @@ function synthesizeBlockDeviceMappings<RT, NDT>(construct: Construct, blockDevic
3437
} else if (volumeType !== EbsDeviceVolumeType.IO1) {
3538
Annotations.of(construct).addWarning('iops will be ignored without volumeType: EbsDeviceVolumeType.IO1');
3639
}
40+
41+
/**
42+
* Because the Ebs properties of the L2 Constructs do not match the Ebs properties of the Cfn Constructs,
43+
* we have to do some transformation and handle all destructed properties
44+
*/
45+
46+
finalEbs = {
47+
...rest,
48+
iops,
49+
volumeType,
50+
kmsKeyId: kmsKey?.keyArn,
51+
};
52+
53+
} else {
54+
finalEbs = undefined;
3755
}
3856

57+
3958
const noDevice = mappingEnabled === false ? noDeviceValue : undefined;
40-
return { deviceName, ebs, virtualName, noDevice } as any;
59+
return { deviceName, ebs: finalEbs, virtualName, noDevice } as any;
4160
});
4261
}

‎packages/@aws-cdk/aws-ec2/lib/volume.ts‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,17 @@ export interface EbsDeviceOptions extends EbsDeviceOptionsBase {
8989
* @default false
9090
*/
9191
readonly encrypted?: boolean;
92+
93+
/**
94+
* The ARN of the AWS Key Management Service (AWS KMS) CMK used for encryption.
95+
*
96+
* You have to ensure that the KMS CMK has the correct permissions to be used by the service launching the ec2 instances.
97+
*
98+
* @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#ebs-encryption-requirements
99+
*
100+
* @default - If encrypted is true, the default aws/ebs KMS key will be used.
101+
*/
102+
readonly kmsKey?: IKey;
92103
}
93104

94105
/**
@@ -108,7 +119,7 @@ export interface EbsDeviceSnapshotOptions extends EbsDeviceOptionsBase {
108119
/**
109120
* Properties of an EBS block device
110121
*/
111-
export interface EbsDeviceProps extends EbsDeviceSnapshotOptions {
122+
export interface EbsDeviceProps extends EbsDeviceSnapshotOptions, EbsDeviceOptions {
112123
/**
113124
* The snapshot ID of the volume to use
114125
*

‎packages/@aws-cdk/aws-ec2/lib/vpc-flow-logs.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,6 @@ class S3Destination extends FlowLogDestination {
198198
if (this.props.s3Bucket === undefined) {
199199
s3Bucket = new s3.Bucket(scope, 'Bucket', {
200200
encryption: s3.BucketEncryption.UNENCRYPTED,
201-
enforceSSL: true,
202201
removalPolicy: RemovalPolicy.RETAIN,
203202
});
204203
} else {

‎packages/@aws-cdk/aws-ec2/test/instance.test.ts‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import * as path from 'path';
22
import { Match, Template } from '@aws-cdk/assertions';
3+
import { Key } from '@aws-cdk/aws-kms';
34
import { Asset } from '@aws-cdk/aws-s3-assets';
45
import { StringParameter } from '@aws-cdk/aws-ssm';
56
import * as cxschema from '@aws-cdk/cloud-assembly-schema';
@@ -184,6 +185,7 @@ describe('instance', () => {
184185
describe('blockDeviceMappings', () => {
185186
test('can set blockDeviceMappings', () => {
186187
// WHEN
188+
const kmsKey = new Key(stack, 'EbsKey');
187189
new Instance(stack, 'Instance', {
188190
vpc,
189191
machineImage: new AmazonLinuxImage(),
@@ -197,6 +199,16 @@ describe('instance', () => {
197199
volumeType: EbsDeviceVolumeType.IO1,
198200
iops: 5000,
199201
}),
202+
}, {
203+
deviceName: 'ebs-cmk',
204+
mappingEnabled: true,
205+
volume: BlockDeviceVolume.ebs(15, {
206+
deleteOnTermination: true,
207+
encrypted: true,
208+
kmsKey: kmsKey,
209+
volumeType: EbsDeviceVolumeType.IO1,
210+
iops: 5000,
211+
}),
200212
}, {
201213
deviceName: 'ebs-snapshot',
202214
mappingEnabled: false,
@@ -224,6 +236,22 @@ describe('instance', () => {
224236
VolumeType: 'io1',
225237
},
226238
},
239+
{
240+
DeviceName: 'ebs-cmk',
241+
Ebs: {
242+
DeleteOnTermination: true,
243+
Encrypted: true,
244+
KmsKeyId: {
245+
'Fn::GetAtt': [
246+
'EbsKeyD3FEE551',
247+
'Arn',
248+
],
249+
},
250+
Iops: 5000,
251+
VolumeSize: 15,
252+
VolumeType: 'io1',
253+
},
254+
},
227255
{
228256
DeviceName: 'ebs-snapshot',
229257
Ebs: {

‎packages/@aws-cdk/aws-ec2/test/integ.vpc-flow-logs.expected.json‎

Lines changed: 0 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -527,53 +527,6 @@
527527
"UpdateReplacePolicy": "Retain",
528528
"DeletionPolicy": "Retain"
529529
},
530-
"VPCFlowLogsS3BucketPolicyB2C2A045": {
531-
"Type": "AWS::S3::BucketPolicy",
532-
"Properties": {
533-
"Bucket": {
534-
"Ref": "VPCFlowLogsS3BucketFB7DC2BE"
535-
},
536-
"PolicyDocument": {
537-
"Statement": [
538-
{
539-
"Action": "s3:*",
540-
"Condition": {
541-
"Bool": {
542-
"aws:SecureTransport": "false"
543-
}
544-
},
545-
"Effect": "Deny",
546-
"Principal": {
547-
"AWS": "*"
548-
},
549-
"Resource": [
550-
{
551-
"Fn::GetAtt": [
552-
"VPCFlowLogsS3BucketFB7DC2BE",
553-
"Arn"
554-
]
555-
},
556-
{
557-
"Fn::Join": [
558-
"",
559-
[
560-
{
561-
"Fn::GetAtt": [
562-
"VPCFlowLogsS3BucketFB7DC2BE",
563-
"Arn"
564-
]
565-
},
566-
"/*"
567-
]
568-
]
569-
}
570-
]
571-
}
572-
],
573-
"Version": "2012-10-17"
574-
}
575-
}
576-
},
577530
"VPCFlowLogsS3FlowLogB5256CFF": {
578531
"Type": "AWS::EC2::FlowLog",
579532
"Properties": {

0 commit comments

Comments
 (0)