feat(apigateway): DomainName supports SecurityPolicy by khoberg · Pull Request #6374 · aws/aws-cdk

khoberg · 2020-02-20T01:45:36Z

Passes SecurityPolicy prop from DomainName to CfnDomainName. Added new enum with the 2 current valid values for SecurityPolicy.

Closes #3862

aws-cdk-automation · 2020-02-20T02:28:16Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: 8e9030d
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2020-02-23T23:04:15Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: e432e4d
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

nija-at

Thanks for submitting this PR! 😊 Mostly looks ok, except for a few things.

nija-at · 2020-02-26T15:08:12Z

packages/@aws-cdk/aws-apigateway/lib/domain-name.ts

+
+  /**
+   * The Transport Layer Security (TLS) version + cipher suite for this domain name.
+   * @default undefined. This field is optional in AWS::ApiGateway::DomainName SecurityPolicy


What does CloudFormation default to? We should document that as the default here.

You can identify this by not setting this in CloudFormation, deploying the stack and calling the get-domain-name from the CLI.
I'm hoping it'll be TLS 1.2; if not, I think the CDK should pick that as the default.

That's actually the reason I looked into this; ApiGateway/CloudFormation defaults this to TLS 1.0. I'm in favor of defaulting it to TLS 1.2, but would that be a potentially breaking change since it restricts the allowed ciphers?

Actually, that's a very good point. We should keep it as TLS 1.0 then.

nija-at · 2020-02-26T15:11:37Z

packages/@aws-cdk/aws-apigateway/lib/domain-name.ts

+  TLS_1_0 = 'TLS_1_0',
+  TLS_1_2 = 'TLS_1_2'


I would rather avoid the awslint exclusions in the package.json.

Suggested change

TLS_1_0 = 'TLS_1_0',

TLS_1_2 = 'TLS_1_2'

/** Cipher suite TLS 1.0 */

TLS_1_0 = 'TLS_1_0',

/** Cipher suite TLS 1.2 */

TLS_1_2 = 'TLS_1_2'

TLS 1.0 is EOL on the march 31, 2020 ( ie, in 11 days) - so we should use 1.2 ?

nija-at · 2020-02-26T15:13:22Z

packages/@aws-cdk/aws-apigateway/lib/domain-name.ts

+import { EndpointType, IRestApi } from './restapi';
+
+/**
+ * The minimum version of the SSL protocol that you want Api Gateway to use for HTTPS connections.


Suggested change

* The minimum version of the SSL protocol that you want Api Gateway to use for HTTPS connections.

* The minimum version of the SSL protocol that you want API Gateway to use for HTTPS connections.

nija-at · 2020-02-26T15:16:15Z

packages/@aws-cdk/aws-apigateway/test/test.domains.ts

    test.done();
  },

+  'accepts different security policies'(test: Test) {


Can you add a 3rd verification, that when left unspecified, the value is absent in the CF template. Use ABSENT to do this.

…st for absent securityPolicy

Pull request has been modified.

aws-cdk-automation · 2020-02-29T01:49:23Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: d6245b6
Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2020-03-02T16:43:55Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: cb7493a
Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

Pull request has been modified.

aws-cdk-automation · 2020-03-03T13:28:45Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: 7b6c364
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2020-03-03T17:02:48Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2020-03-03T17:58:28Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: ae8c03e
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2020-03-03T17:58:49Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@default

* Pass securityPolicy from API Gateway DomainName to cfnDomainName * Update ApiGateway README with example securityPolicy * DomainName: Add documentation for SecurityPolicy TSL versions, add test for absent securityPolicy * fix tsdoc @default Co-authored-by: Void-Concept <49216983+Void-Concept@users.noreply.github.com> Co-authored-by: Niranjan Jayakar <16217941+nija-at@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

Pass securityPolicy from API Gateway DomainName to cfnDomainName

8e9030d

SomayaB assigned nija-at Feb 21, 2020

Update ApiGateway README with example securityPolicy

e432e4d

nija-at previously requested changes Feb 26, 2020

View reviewed changes

DomainName: Add documentation for SecurityPolicy TSL versions, add te…

d6245b6

…st for absent securityPolicy

fix tsdoc @default

cb7493a

nija-at previously approved these changes Mar 2, 2020

View reviewed changes

Merge branch 'master' into khoberg/apigw-domain-name-security-policy

7b6c364

nija-at approved these changes Mar 3, 2020

View reviewed changes

Merge branch 'master' into khoberg/apigw-domain-name-security-policy

ae8c03e

mergify bot merged commit e8c2e0c into aws:master Mar 3, 2020

snyk-bot mentioned this pull request Apr 10, 2020

[Snyk] Upgrade aws-cdk from 1.28.0 to 1.30.0 ammobinDOTca/ammobin-cdk#2

Closed

	* The minimum version of the SSL protocol that you want Api Gateway to use for HTTPS connections.
	* The minimum version of the SSL protocol that you want API Gateway to use for HTTPS connections.

Conversation

khoberg commented Feb 20, 2020

Uh oh!

aws-cdk-automation commented Feb 20, 2020

AWS CodeBuild CI Report

Uh oh!

aws-cdk-automation commented Feb 23, 2020

AWS CodeBuild CI Report

Uh oh!

nija-at left a comment

Choose a reason for hiding this comment

Uh oh!

nija-at Feb 26, 2020

Choose a reason for hiding this comment

Uh oh!

khoberg Feb 26, 2020

Choose a reason for hiding this comment

Uh oh!

nija-at Feb 26, 2020

Choose a reason for hiding this comment

Uh oh!

nija-at Feb 26, 2020

Choose a reason for hiding this comment

Uh oh!

davecarlson Mar 20, 2020

Choose a reason for hiding this comment

Uh oh!

nija-at Feb 26, 2020

Choose a reason for hiding this comment

Uh oh!

nija-at Feb 26, 2020

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation commented Feb 29, 2020

AWS CodeBuild CI Report

Uh oh!

aws-cdk-automation commented Mar 2, 2020

AWS CodeBuild CI Report

Uh oh!

aws-cdk-automation commented Mar 3, 2020

AWS CodeBuild CI Report

Uh oh!

mergify bot commented Mar 3, 2020

Uh oh!

aws-cdk-automation commented Mar 3, 2020

AWS CodeBuild CI Report

Uh oh!

mergify bot commented Mar 3, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants