Skip to content

Commit cac2964

Browse files
mergify[bot]mergify[bot]
authored
Merge branch 'main' into merge-back/2.149.0
2 parents c8e5924 + 4af3685 commit cac2964

26 files changed

Lines changed: 538 additions & 1276 deletions

File tree

‎packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/glue/integ.glue-task.js.snapshot/aws-stepfunctions-integ.template.json‎

Lines changed: 233 additions & 233 deletions
Large diffs are not rendered by default.

‎packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/glue/integ.start-job-run.js.snapshot/aws-stepfunctions-integ.template.json‎

Lines changed: 233 additions & 233 deletions
Large diffs are not rendered by default.

‎packages/@aws-cdk/aws-pipes-enrichments-alpha/test/__snapshots__/stepfunctions.test.ts.snap‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,7 @@ exports[`stepfunctions should grant pipe role invoke access 1`] = `
1010
"Action": "sts:AssumeRole",
1111
"Effect": "Allow",
1212
"Principal": {
13-
"Service": {
14-
"Fn::FindInMap": [
15-
"ServiceprincipalMap",
16-
{
17-
"Ref": "AWS::Region",
18-
},
19-
"states",
20-
],
21-
},
13+
"Service": "states.amazonaws.com",
2214
},
2315
},
2416
],

‎packages/@aws-cdk/aws-pipes-targets-alpha/test/__snapshots__/stepfunctions.test.ts.snap‎

Lines changed: 3 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -27,15 +27,7 @@ exports[`step-function should grant pipe role push access (StartAsyncExecution)
2727
"Action": "sts:AssumeRole",
2828
"Effect": "Allow",
2929
"Principal": {
30-
"Service": {
31-
"Fn::FindInMap": [
32-
"ServiceprincipalMap",
33-
{
34-
"Ref": "AWS::Region",
35-
},
36-
"states",
37-
],
38-
},
30+
"Service": "states.amazonaws.com",
3931
},
4032
},
4133
],
@@ -74,15 +66,7 @@ exports[`step-function should grant pipe role push access (StartAsyncExecution)
7466
"Action": "sts:AssumeRole",
7567
"Effect": "Allow",
7668
"Principal": {
77-
"Service": {
78-
"Fn::FindInMap": [
79-
"ServiceprincipalMap",
80-
{
81-
"Ref": "AWS::Region",
82-
},
83-
"states",
84-
],
85-
},
69+
"Service": "states.amazonaws.com",
8670
},
8771
},
8872
],
@@ -121,15 +105,7 @@ exports[`step-function should grant pipe role push access (StartSyncExecution) w
121105
"Action": "sts:AssumeRole",
122106
"Effect": "Allow",
123107
"Principal": {
124-
"Service": {
125-
"Fn::FindInMap": [
126-
"ServiceprincipalMap",
127-
{
128-
"Ref": "AWS::Region",
129-
},
130-
"states",
131-
],
132-
},
108+
"Service": "states.amazonaws.com",
133109
},
134110
},
135111
],

‎packages/@aws-cdk/cx-api/FEATURE_FLAGS.md‎

Lines changed: 2 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ Flags come in three types:
3838
| [@aws-cdk/core:enablePartitionLiterals](#aws-cdkcoreenablepartitionliterals) | Make ARNs concrete if AWS partition is known | 2.38.0 | (fix) |
3939
| [@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker](#aws-cdkaws-ecsdisableexplicitdeploymentcontrollerforcircuitbreaker) | Avoid setting the "ECS" deployment controller when adding a circuit breaker | 2.51.0 | (fix) |
4040
| [@aws-cdk/aws-events:eventsTargetQueueSameAccount](#aws-cdkaws-eventseventstargetqueuesameaccount) | Event Rules may only push to encrypted SQS queues in the same account | 2.51.0 | (fix) |
41-
| [@aws-cdk/aws-iam:standardizedServicePrincipals](#aws-cdkaws-iamstandardizedserviceprincipals) | Use standardized (global) service principals everywhere | 2.51.0 | (fix) |
4241
| [@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName](#aws-cdkaws-iamimportedrolestacksafedefaultpolicyname) | Enable this feature to by default create default policy names for imported roles that depend on the stack the role is in. | 2.60.0 | (fix) |
4342
| [@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy](#aws-cdkaws-s3serveraccesslogsusebucketpolicy) | Use S3 Bucket Policy instead of ACLs for Server Access Logging | 2.60.0 | (fix) |
4443
| [@aws-cdk/customresources:installLatestAwsSdkDefault](#aws-cdkcustomresourcesinstalllatestawssdkdefault) | Whether to install the latest SDK by default in AwsCustomResource | 2.60.0 | (default) |
@@ -72,7 +71,7 @@ Flags come in three types:
7271
| [@aws-cdk/pipelines:reduceAssetRoleTrustScope](#aws-cdkpipelinesreduceassetroletrustscope) | Remove the root account principal from PipelineAssetsFileRole trust policy | 2.141.0 | (default) |
7372
| [@aws-cdk/aws-ecs:removeDefaultDeploymentAlarm](#aws-cdkaws-ecsremovedefaultdeploymentalarm) | When enabled, remove default deployment alarm settings | 2.143.0 | (default) |
7473
| [@aws-cdk/custom-resources:logApiResponseDataPropertyTrueDefault](#aws-cdkcustom-resourceslogapiresponsedatapropertytruedefault) | When enabled, the custom resource used for `AwsCustomResource` will configure the `logApiResponseData` property as true by default | 2.145.0 | (fix) |
75-
| [@aws-cdk/aws-stepfunctions-tasks:ecsReduceRunTaskPermissions](#aws-cdkaws-stepfunctions-tasksecsreduceruntaskpermissions) | When enabled, IAM Policy created to run tasks won't include the task definition ARN, only the revision ARN. | V2NEXT | (fix) |
74+
| [@aws-cdk/aws-stepfunctions-tasks:ecsReduceRunTaskPermissions](#aws-cdkaws-stepfunctions-tasksecsreduceruntaskpermissions) | When enabled, IAM Policy created to run tasks won't include the task definition ARN, only the revision ARN. | 2.148.0 | (fix) |
7675

7776
<!-- END table -->
7877

@@ -101,7 +100,6 @@ The following json shows the current recommended set of flags, as `cdk init` wou
101100
"@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
102101
"@aws-cdk/core:enablePartitionLiterals": true,
103102
"@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
104-
"@aws-cdk/aws-iam:standardizedServicePrincipals": true,
105103
"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
106104
"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
107105
"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
@@ -748,22 +746,6 @@ always apply, regardless of the value of this flag.
748746
| 2.51.0 | `false` | `true` |
749747

750748

751-
### @aws-cdk/aws-iam:standardizedServicePrincipals
752-
753-
*Use standardized (global) service principals everywhere* (fix)
754-
755-
We used to maintain a database of exceptions to Service Principal names in various regions. This database
756-
is no longer necessary: all service principals names have been standardized to their global form (`SERVICE.amazonaws.com`).
757-
758-
This flag disables use of that exceptions database and always uses the global service principal.
759-
760-
761-
| Since | Default | Recommended |
762-
| ----- | ----- | ----- |
763-
| (not in v1) | | |
764-
| 2.51.0 | `false` | `true` |
765-
766-
767749
### @aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName
768750

769751
*Enable this feature to by default create default policy names for imported roles that depend on the stack the role is in.* (fix)
@@ -1370,7 +1352,7 @@ for more details.
13701352
| Since | Default | Recommended |
13711353
| ----- | ----- | ----- |
13721354
| (not in v1) | | |
1373-
| V2NEXT | `false` | `true` |
1355+
| 2.148.0 | `false` | `true` |
13741356

13751357

13761358
<!-- END details -->

‎packages/aws-cdk-lib/aws-codedeploy/test/ecs/deployment-group.test.ts‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -140,15 +140,7 @@ describe('CodeDeploy ECS DeploymentGroup', () => {
140140
Action: 'sts:AssumeRole',
141141
Effect: 'Allow',
142142
Principal: {
143-
Service: {
144-
'Fn::FindInMap': [
145-
'ServiceprincipalMap',
146-
{
147-
Ref: 'AWS::Region',
148-
},
149-
'codedeploy',
150-
],
151-
},
143+
Service: 'codedeploy.amazonaws.com',
152144
},
153145
}],
154146
Version: '2012-10-17',

‎packages/aws-cdk-lib/aws-codedeploy/test/lambda/deployment-group.test.ts‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -94,15 +94,7 @@ describe('CodeDeploy Lambda DeploymentGroup', () => {
9494
Action: 'sts:AssumeRole',
9595
Effect: 'Allow',
9696
Principal: {
97-
Service: {
98-
'Fn::FindInMap': [
99-
'ServiceprincipalMap',
100-
{
101-
Ref: 'AWS::Region',
102-
},
103-
'codedeploy',
104-
],
105-
},
97+
Service: 'codedeploy.amazonaws.com',
10698
},
10799
}],
108100
Version: '2012-10-17',

‎packages/aws-cdk-lib/aws-ec2/lib/vpc-endpoint-service.ts‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import { Construct } from 'constructs';
22
import { CfnVPCEndpointService, CfnVPCEndpointServicePermissions } from './ec2.generated';
33
import { ArnPrincipal } from '../../aws-iam';
44
import { Aws, Fn, IResource, Resource, Stack, Token } from '../../core';
5-
import { Default, RegionInfo } from '../../region-info';
5+
import { RegionInfo } from '../../region-info';
66

77
/**
88
* A load balancer that can host a VPC Endpoint Service
@@ -46,6 +46,13 @@ export interface IVpcEndpointService extends IResource {
4646
*/
4747
export class VpcEndpointService extends Resource implements IVpcEndpointService {
4848

49+
/**
50+
* The default value for a VPC Endpoint Service name prefix, useful if you do
51+
* not have a synthesize-time region literal available (all you have is
52+
* `{ "Ref": "AWS::Region" }`)
53+
*/
54+
public static readonly DEFAULT_PREFIX = 'com.amazonaws.vpce';
55+
4956
/**
5057
* One or more network load balancers to host the service.
5158
* @attribute
@@ -119,8 +126,8 @@ export class VpcEndpointService extends Resource implements IVpcEndpointService
119126

120127
const { region } = Stack.of(this);
121128
const serviceNamePrefix = !Token.isUnresolved(region) ?
122-
(RegionInfo.get(region).vpcEndpointServiceNamePrefix ?? Default.VPC_ENDPOINT_SERVICE_NAME_PREFIX) :
123-
Default.VPC_ENDPOINT_SERVICE_NAME_PREFIX;
129+
(RegionInfo.get(region).vpcEndpointServiceNamePrefix ?? VpcEndpointService.DEFAULT_PREFIX) :
130+
VpcEndpointService.DEFAULT_PREFIX;
124131

125132
this.vpcEndpointServiceName = Fn.join('.', [serviceNamePrefix, Aws.REGION, this.vpcEndpointServiceId]);
126133
if (this.allowedPrincipals.length > 0) {

‎packages/aws-cdk-lib/aws-iam/lib/principals.ts‎

Lines changed: 16 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@ import { defaultAddPrincipalToAssumeRole } from './private/assume-role-policy';
66
import { LITERAL_STRING_KEY, mergePrincipal } from './private/util';
77
import { ISamlProvider } from './saml-provider';
88
import * as cdk from '../../core';
9-
import * as cxapi from '../../cx-api';
10-
import { Default, FactName, RegionInfo } from '../../region-info';
9+
import { RegionInfo } from '../../region-info';
1110

1211
/**
1312
* Any object that has an associated principal that a permission can be granted to
@@ -541,11 +540,13 @@ export class ServicePrincipal extends PrincipalBase {
541540
* These days all service principal names are standardized, and they are all
542541
* of the form `<servicename>.amazonaws.com`.
543542
*
544-
* If the feature flag `@aws-cdk/aws-iam:standardizedServicePrincipals` is set, this
545-
* method will always return its input. If this feature flag is not set, this
546-
* method will perform the legacy behavior, which appends the region-specific
547-
* domain suffix for some select services (for example, it would append `.cn`
548-
* to some service principal names).
543+
* To avoid breaking changes, handling is provided for services added with the formats below,
544+
* however, no additional handling will be added for new regions or partitions.
545+
* - s3
546+
* - s3.amazonaws.com
547+
* - s3.amazonaws.com.cn
548+
* - s3.c2s.ic.gov
549+
* - s3.sc2s.sgov.gov
549550
*
550551
* @example
551552
* const principalName = iam.ServicePrincipal.servicePrincipalName('ec2.amazonaws.com');
@@ -942,44 +943,28 @@ class ServicePrincipalToken implements cdk.IResolvable {
942943
}
943944

944945
public resolve(ctx: cdk.IResolveContext) {
945-
return cdk.FeatureFlags.of(ctx.scope).isEnabled(cxapi.IAM_STANDARDIZED_SERVICE_PRINCIPALS)
946-
? this.newStandardizedBehavior(ctx)
947-
: this.legacyBehavior(ctx);
948-
949-
// The correct behavior is to always use the global service principal
946+
return this.newStandardizedBehavior(ctx);
950947
}
951948

952949
/**
953950
* Return the global (original) service principal, and a second one if region is given and points to an opt-in region
954951
*/
955952
private newStandardizedBehavior(ctx: cdk.IResolveContext) {
956953
const stack = cdk.Stack.of(ctx.scope);
954+
955+
// If the user had previously set the feature flag to `false` we would allow them to provide only the service name instead of the
956+
// entire service principal. We can't break them so now everyone gets to do it!
957+
const match = this.service.match(/^([^.]+)(?:(?:\.amazonaws\.com(?:\.cn)?)|(?:\.c2s\.ic\.gov)|(?:\.sc2s\.sgov\.gov))?$/);
958+
const service = match ? `${match[1]}.amazonaws.com` : this.service;
957959
if (
958960
this.opts.region &&
959961
!cdk.Token.isUnresolved(this.opts.region) &&
960962
stack.region !== this.opts.region &&
961963
RegionInfo.get(this.opts.region).isOptInRegion
962964
) {
963-
return this.service.replace(/\.amazonaws\.com$/, `.${this.opts.region}.amazonaws.com`);
964-
}
965-
return this.service;
966-
}
967-
968-
/**
969-
* Do a single lookup
970-
*/
971-
private legacyBehavior(ctx: cdk.IResolveContext) {
972-
if (this.opts.region) {
973-
// Special case, handle it separately to not break legacy behavior.
974-
return RegionInfo.get(this.opts.region).servicePrincipal(this.service) ??
975-
Default.servicePrincipal(this.service, this.opts.region, cdk.Aws.URL_SUFFIX);
965+
return service.replace(/\.amazonaws\.com$/, `.${this.opts.region}.amazonaws.com`);
976966
}
977-
978-
const stack = cdk.Stack.of(ctx.scope);
979-
return stack.regionalFact(
980-
FactName.servicePrincipal(this.service),
981-
Default.servicePrincipal(this.service, stack.region, cdk.Aws.URL_SUFFIX),
982-
);
967+
return service;
983968
}
984969

985970
public toString() {

‎packages/aws-cdk-lib/aws-iam/test/policy-document.test.ts‎

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
import { testDeprecated } from '@aws-cdk/cdk-build-tools';
21
import { Template } from '../../assertions';
32
import { Lazy, Stack, Token } from '../../core';
43
import {
@@ -464,21 +463,7 @@ describe('IAM policy document', () => {
464463
expect(stack.resolve(s.toStatementJson())).toEqual({
465464
Effect: 'Allow',
466465
Action: 'test:Action',
467-
Principal: { Service: 'codedeploy.cn-north-1.amazonaws.com.cn' },
468-
});
469-
});
470-
471-
// Deprecated: 'region' parameter to ServicePrincipal shouldn't be used.
472-
testDeprecated('regional service principals resolve appropriately (with user-set region)', () => {
473-
const stack = new Stack(undefined, undefined, { env: { region: 'cn-northeast-1' } });
474-
const s = new PolicyStatement();
475-
s.addActions('test:Action');
476-
s.addServicePrincipal('codedeploy.amazonaws.com', { region: 'cn-north-1' });
477-
478-
expect(stack.resolve(s.toStatementJson())).toEqual({
479-
Effect: 'Allow',
480-
Action: 'test:Action',
481-
Principal: { Service: 'codedeploy.cn-north-1.amazonaws.com.cn' },
466+
Principal: { Service: 'codedeploy.amazonaws.com' },
482467
});
483468
});
484469

0 commit comments

Comments
 (0)