feat(cloudfront-origins): read versioned access level by matthiasgubler · Pull Request #33038 · aws/aws-cdk

matthiasgubler · 2025-01-21T21:59:35Z

Issue # (if applicable)

Reason for this change

This allows creating an S3 bucket origin OriginAccessControl for access of versioned objects via CloudFront.

Description of changes

Added a new AccessLevel.READ_VERSIONED, to extend the list of the OAC access levels, which extends the S3 bucket policy to contain s3:GetObjectVersion. I followed the existing patterns for the different AccessLevels, to make the change as small as possible.

This enables versioned S3 bucket origins to allow the CloudFront distribution to access object versions.

Describe any new or updated permissions being added

n/a

Description of how you validated changes

Added a new unit-test and a new integration test

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter fails with the following errors:

❌ Features must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

codecov · 2025-01-21T22:17:04Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.17%. Comparing base (afa3d1f) to head (3c0b309).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33038   +/-   ##
=======================================
  Coverage   82.17%   82.17%           
=======================================
  Files         119      119           
  Lines        6862     6862           
  Branches     1158     1158           
=======================================
  Hits         5639     5639           
  Misses       1120     1120           
  Partials      103      103

Flag	Coverage Δ
suite.unit	`82.17% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`82.17% <ø> (ø)`

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

packages/aws-cdk-lib/aws-cloudfront-origins/lib/s3-bucket-origin.ts

This allows creating an S3 bucket origin OriginAccessControl for access of versioned objects Fixes #33034

matthiasgubler · 2025-02-19T15:22:44Z

@moelasmar can you help me with this: #33034 (comment)

GavinZZ · 2025-02-20T21:49:45Z

@matthiasgubler I see the CodeBuild CI is successful. Is your comment related to the Code scanning results / CodeQL? If so, I have proceeded to dismiss the alert as it's used in test snapshot.

GavinZZ

Thank you for the contribution!

mergify · 2025-02-20T21:51:35Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-02-20T21:51:40Z

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.

If you want to requeue this pull request, you need to post a comment with the text: @mergifyio requeue

matthiasgubler · 2025-02-20T21:52:46Z

@GavinZZ yes, it was the CodeQL in the generated IT code: This does not escape backslash characters in the input.

Thank you for checking and approving it!

mergify · 2025-02-20T21:54:59Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Pull request has been modified.

mergify · 2025-02-20T22:34:38Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-02-20T23:01:27Z

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.

If you want to requeue this pull request, you need to post a comment with the text: @mergifyio requeue

GavinZZ · 2025-02-20T23:06:03Z

@Mergifyio requeue

mergify · 2025-02-20T23:06:25Z

requeue

✅ The queue state of this pull request has been cleaned. It can be re-embarked automatically

mergify · 2025-02-20T23:06:49Z

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.

If you want to requeue this pull request, you need to post a comment with the text: @mergifyio requeue

GavinZZ · 2025-02-20T23:09:11Z

@mergify update

mergify · 2025-02-20T23:09:18Z

update

❌ Mergify doesn't have permission to update

Details

For security reasons, Mergify can't update this pull request. Try updating locally.
GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/yarn-upgrade.yml without workflows permission

Pull request has been modified.

aws-cdk-automation · 2025-02-20T23:40:56Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 3c0b309
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-02-20T23:41:15Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-02-20T23:41:35Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

github-actions bot added the beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK label Jan 21, 2025

aws-cdk-automation requested a review from a team January 21, 2025 21:59

github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 labels Jan 21, 2025

aws-cdk-automation previously requested changes Jan 21, 2025

View reviewed changes

matthiasgubler commented Jan 22, 2025

View reviewed changes

packages/aws-cdk-lib/aws-cloudfront-origins/lib/s3-bucket-origin.ts Outdated Show resolved Hide resolved

matthiasgubler requested a review from aws-cdk-automation January 22, 2025 00:57

matthiasgubler marked this pull request as ready for review January 22, 2025 02:03

Add CloudFront AccessLevel.READ_VERSIONED

51ce2c9

This allows creating an S3 bucket origin OriginAccessControl for access of versioned objects Fixes #33034

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 22, 2025

Merge branch 'main' into 33034-add-versioned-access

78daa68

github-actions bot mentioned this pull request Feb 1, 2025

Monthly PR metrics report #33266

Closed

GavinZZ previously approved these changes Feb 20, 2025

View reviewed changes

GavinZZ self-assigned this Feb 20, 2025

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 20, 2025

Merge branch 'main' into 33034-add-versioned-access

d9f31f8

GavinZZ previously approved these changes Feb 20, 2025

View reviewed changes

Merge branch 'main' into 33034-add-versioned-access

3c0b309

GavinZZ approved these changes Feb 20, 2025

View reviewed changes

mergify bot merged commit 315be88 into aws:main Feb 20, 2025
22 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Feb 20, 2025

matthiasgubler deleted the 33034-add-versioned-access branch February 21, 2025 00:00

Conversation

matthiasgubler commented Jan 21, 2025

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Jan 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

matthiasgubler commented Feb 19, 2025

Uh oh!

GavinZZ commented Feb 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

GavinZZ left a comment

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Feb 20, 2025

Uh oh!

mergify bot commented Feb 20, 2025

Uh oh!

matthiasgubler commented Feb 20, 2025

Uh oh!

mergify bot commented Feb 20, 2025

Uh oh!

mergify bot commented Feb 20, 2025

Uh oh!

mergify bot commented Feb 20, 2025

Uh oh!

GavinZZ commented Feb 20, 2025

Uh oh!

mergify bot commented Feb 20, 2025

✅ The queue state of this pull request has been cleaned. It can be re-embarked automatically

Uh oh!

mergify bot commented Feb 20, 2025

Uh oh!

GavinZZ commented Feb 20, 2025

Uh oh!

mergify bot commented Feb 20, 2025

❌ Mergify doesn't have permission to update

Uh oh!

aws-cdk-automation commented Feb 20, 2025

AWS CodeBuild CI Report

Uh oh!

mergify bot commented Feb 20, 2025

Uh oh!

Uh oh!

github-actions bot commented Feb 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov bot commented Jan 21, 2025 •

edited

Loading

GavinZZ commented Feb 20, 2025 •

edited

Loading