docs(ec2): update `aws-ec2` README to include workaround for using a service principal in VPCEService `allowedPrincipals` by 7e11 · Pull Request #29512 · aws/aws-cdk

7e11 · 2024-03-15T23:46:56Z

VpcEndpointService has the member allowedPrincipals which is of type ArnPrincipal[]. However, ServicePrincipal is also valid and works in the AWS console. This documentation update includes a workaround for including service principals in the allowedPrincipals.

Issue #29478

Closes #29478

Reason for this change

VpcEndpointService has the member allowedPrincipals which is of type ArnPrincipal[]. However, if you use the AWS console, allowlisting a service principal is supported as well. Users are not able to use the type ServicePrincipal in allowedPrincipals in CDK. This is a feature gap.

I brought this up in #29478, and was told that the type couldn't be changed, but the workaround I was using could be added to the documentation.

Description of changes

Documentation update for the aws-ec2 module which includes a workaround for including service principals in the allowedPrincipals.

Description of how you validated changes

N/A - minor documentation changes only

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…ncipal in VPCEService `allowedPrincipals` `VpcEndpointService` has the member `allowedPrincipals` which is of type `ArnPrincipal[]`. However, `ServicePrincipal` is also valid and works in the AWS console. This documentation update includes a workaround for including service principals in the `allowedPrincipals`.

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

lpizzinidev

Thanks 👍
Can you please add test coverage for this scenario for both unit and integration tests?

lpizzinidev · 2024-03-16T16:09:24Z

packages/aws-cdk-lib/aws-ec2/README.md

+To include a service principal in the `allowedPrincipals`, there is a workaround where you can use a service principal string as input to the `ArnPrincipal` type. The resulting VPC endpoint will have an allowlisted principal of type `Service`, instead of `Arn` for that item in the list.
+```ts


Suggested change

To include a service principal in the `allowedPrincipals`, there is a workaround where you can use a service principal string as input to the `ArnPrincipal` type. The resulting VPC endpoint will have an allowlisted principal of type `Service`, instead of `Arn` for that item in the list.

```ts

You can also include a service principal in the `allowedPrincipals` property by specifying it as a parameter to the `ArnPrincipal` constructor.

The resulting VPC endpoint will have an allowlisted principal of type `Service`, instead of `Arn` for that item in the list.

```ts

I'll make this change in the revision that includes the tests.

7e11 · 2024-03-16T20:08:58Z

Will do

GavinZZ

Same feedback on the test coverage. Otherwise happy to approve it.

…karound.

lpizzinidev

Thanks 👍

GavinZZ

Thank you!

mergify · 2024-03-20T16:55:35Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2024-03-20T16:59:13Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

paulhcsun · 2024-03-21T16:49:37Z

@Mergifyio update

mergify · 2024-03-21T16:49:44Z

update

❌ Mergify doesn't have permission to update

Details

For security reasons, Mergify can't update this pull request. Try updating locally.
GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/request-cli-integ-test.yml without workflows permission

Pull request has been modified.

aws-cdk-automation · 2024-03-21T17:49:18Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 2079b16
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2024-03-21T20:42:09Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

…service principal in VPCEService `allowedPrincipals` (aws#29512) `VpcEndpointService` has the member `allowedPrincipals` which is of type `ArnPrincipal[]`. However, `ServicePrincipal` is also valid and works in the AWS console. This documentation update includes a workaround for including service principals in the `allowedPrincipals`. ### Issue aws#29478 Closes aws#29478 ### Reason for this change `VpcEndpointService` has the member `allowedPrincipals` which is of type `ArnPrincipal[]`. However, if you use the AWS console, allowlisting a service principal is supported as well. Users are not able to use the type `ServicePrincipal` in `allowedPrincipals` in CDK. This is a feature gap. I brought this up in aws#29478, and was told that the type couldn't be changed, but the workaround I was using could be added to the documentation. ### Description of changes Documentation update for the `aws-ec2` module which includes a workaround for including service principals in the `allowedPrincipals`. ### Description of how you validated changes N/A - minor documentation changes only ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

github-actions bot added beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK bug This issue is a bug. effort/medium Medium work item – several days of effort p2 labels Mar 15, 2024

aws-cdk-automation requested a review from a team March 15, 2024 23:47

aws-cdk-automation previously requested changes Mar 15, 2024

View reviewed changes

7e11 changed the title ~~Update aws-ec2 README to include workaround for using a service pri…~~ docs(ec2): Update aws-ec2 README to include workaround for using a service principal in VPCEService allowedPrincipals (#29478) Mar 15, 2024

7e11 changed the title ~~docs(ec2): Update aws-ec2 README to include workaround for using a service principal in VPCEService allowedPrincipals (#29478)~~ docs(ec2): update aws-ec2 README to include workaround for using a service principal in VPCEService allowedPrincipals Mar 15, 2024

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 16, 2024

lpizzinidev suggested changes Mar 16, 2024

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 16, 2024

github-actions bot mentioned this pull request Mar 18, 2024

Weekly PR metrics report #29527

Closed

GavinZZ reviewed Mar 18, 2024

View reviewed changes

Adding unit + integ tests for VPCE allowlisting service principal wor…

8fbba71

…karound.

lpizzinidev approved these changes Mar 19, 2024

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 19, 2024

GavinZZ previously approved these changes Mar 20, 2024

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 20, 2024

Merge branch 'main' into patch-1

2079b16

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 21, 2024

paulhcsun approved these changes Mar 21, 2024

View reviewed changes

mergify bot merged commit 07ce8ec into aws:main Mar 21, 2024

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 21, 2024

7e11 deleted the patch-1 branch March 21, 2024 21:41

github-actions bot mentioned this pull request Apr 1, 2024

Monthly PR metrics report #29668

Closed

		To include a service principal in the `allowedPrincipals`, there is a workaround where you can use a service principal string as input to the `ArnPrincipal` type. The resulting VPC endpoint will have an allowlisted principal of type `Service`, instead of `Arn` for that item in the list.
		```ts

Conversation

7e11 commented Mar 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue #29478

Reason for this change

Description of changes

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment

Choose a reason for hiding this comment

Uh oh!

lpizzinidev left a comment

Choose a reason for hiding this comment

Uh oh!

lpizzinidev Mar 16, 2024

Choose a reason for hiding this comment

Uh oh!

7e11 Mar 19, 2024

Choose a reason for hiding this comment

Uh oh!

7e11 commented Mar 16, 2024

Uh oh!

GavinZZ left a comment

Choose a reason for hiding this comment

Uh oh!

lpizzinidev left a comment

Choose a reason for hiding this comment

Uh oh!

GavinZZ left a comment

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Mar 20, 2024

Uh oh!

mergify bot commented Mar 20, 2024

Uh oh!

paulhcsun commented Mar 21, 2024

Uh oh!

mergify bot commented Mar 21, 2024

❌ Mergify doesn't have permission to update

Uh oh!

aws-cdk-automation commented Mar 21, 2024

AWS CodeBuild CI Report

Uh oh!

mergify bot commented Mar 21, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

7e11 commented Mar 15, 2024 •

edited

Loading