Skip to content

fix(iam): permissions boundary aspect doesn't always recognize roles#16154

Merged
mergify[bot] merged 2 commits intoaws:masterfrom
polothy:permissions-boundary-fix
Sep 7, 2021
Merged

fix(iam): permissions boundary aspect doesn't always recognize roles#16154
mergify[bot] merged 2 commits intoaws:masterfrom
polothy:permissions-boundary-fix

Conversation

@polothy
Copy link
Copy Markdown
Contributor

@polothy polothy commented Aug 20, 2021

Using instanceof does not seem to work in all scenarios. Instead, use the CfnResource.isCfnResource method to find the L1 constructs.


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Using `instanceof` does not seem to work in
all scenarios. Instead, use the
`CfnResource.isCfnResource` method to find
the L1 constructs.
@gitpod-io
Copy link
Copy Markdown

gitpod-io bot commented Aug 20, 2021

@polothy
Copy link
Copy Markdown
Contributor Author

polothy commented Aug 20, 2021

Might fix #15572

Backstory of the problem: we have a very small, simple NodeJS CDK project. It is using NodejsFunction for a lambda function. For some reason, the PermissionsBoundary aspect did not apply the permissions boundary to the lambda's service role. Perhaps the cause is due to type information being lost which would cause all the instanceof checks to fail. I think I read this is possible, and that is why all these isSomething methods exist to identify classes.

In the end, I think the code ends up being equivalent because all the code paths were just trying to modify the same L1 constructs.

I tested this code by writing my own aspect with same if statement logic. I used this aspect on the project and it resolved the problem. This appears to be tricky to test because when I try to add a test via jest, it doesn't seem to loose the type information and the instanceof checks continue to work (EG: wrote a test with a NodejsFunction).

@peterwoodworth peterwoodworth added @aws-cdk/aws-iam Related to AWS Identity and Access Management effort/small Small work item – less than a day of effort p1 labels Sep 1, 2021
@rix0rrr rix0rrr added the pr-linter/exempt-test The PR linter will not require test changes label Sep 7, 2021
@rix0rrr rix0rrr changed the title fix(iam): improve permissions boundary aspect fix(iam): permissions boundary aspect doesn't always recognize roles Sep 7, 2021
@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Sep 7, 2021

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Copy Markdown
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
  • Commit ID: b0f6abe
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit c8bfcf6 into aws:master Sep 7, 2021
@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Sep 7, 2021

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

@aws-cdk/aws-iam Related to AWS Identity and Access Management effort/small Small work item – less than a day of effort p1 pr-linter/exempt-test The PR linter will not require test changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants