-
Notifications
You must be signed in to change notification settings - Fork 3.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(scheduler-targets-alpha): imported target resources as schedule t…
…arget throws synth error (#32105) ### Issue # (if applicable) Tracking #31785 ### Reason for this change Similar to what was done in this PR for the Lambda Invoke target: #31837. Reasoning is explained in this [comment](#29615 (comment)): > At synth time, there are cases where CDK does not know about the actual environment (e.g. when the environment is using Tokens). In other words, the environment check works in some scenarios and not others. This creates more confusion than benefit. IF cross env target support is added in the future, this check will become a blocker for CDK customers to set up cross env target. ### Description of changes Remove synth-time error that checks for same account and region for all targets to allow use of imported resources as target. ### Description of how you validated changes All tests are passing. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
- Loading branch information
Showing
24 changed files
with
57 additions
and
615 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
20 changes: 3 additions & 17 deletions
20
packages/@aws-cdk/aws-scheduler-targets-alpha/lib/codebuild-start-build.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
23 changes: 3 additions & 20 deletions
23
packages/@aws-cdk/aws-scheduler-targets-alpha/lib/codepipeline-start-pipeline-execution.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
24 changes: 5 additions & 19 deletions
24
packages/@aws-cdk/aws-scheduler-targets-alpha/lib/inspector-start-assessment-run.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,37 +1,23 @@ | ||
| import { ISchedule, IScheduleTarget } from '@aws-cdk/aws-scheduler-alpha'; | ||
| import { Names } from 'aws-cdk-lib'; | ||
| import { IScheduleTarget } from '@aws-cdk/aws-scheduler-alpha'; | ||
| import { IRole, PolicyStatement } from 'aws-cdk-lib/aws-iam'; | ||
| import { CfnAssessmentTemplate } from 'aws-cdk-lib/aws-inspector'; | ||
| import { ScheduleTargetBase, ScheduleTargetBaseProps } from './target'; | ||
| import { sameEnvDimension } from './util'; | ||
|
|
||
| /** | ||
| * Use an Amazon Inspector as a target for AWS EventBridge Scheduler. | ||
| */ | ||
| export class InspectorStartAssessmentRun extends ScheduleTargetBase implements IScheduleTarget { | ||
| constructor( | ||
| private readonly template: CfnAssessmentTemplate, | ||
| private readonly props: ScheduleTargetBaseProps = {}, | ||
| template: CfnAssessmentTemplate, | ||
| props: ScheduleTargetBaseProps = {}, | ||
| ) { | ||
| super(props, template.attrArn); | ||
| } | ||
|
|
||
| protected addTargetActionToRole(schedule: ISchedule, role: IRole): void { | ||
| if (!sameEnvDimension(this.template.stack.region, schedule.env.region)) { | ||
| throw new Error(`Cannot assign assessment template in region ${this.template.stack.region} to the schedule ${Names.nodeUniqueId(schedule.node)} in region ${schedule.env.region}. Both the schedule and the assessment template must be in the same region.`); | ||
| } | ||
|
|
||
| if (!sameEnvDimension(this.template.stack.account, schedule.env.account)) { | ||
| throw new Error(`Cannot assign assessment template in account ${this.template.stack.account} to the schedule ${Names.nodeUniqueId(schedule.node)} in account ${schedule.env.region}. Both the schedule and the assessment template must be in the same account.`); | ||
| } | ||
|
|
||
| if (this.props.role && !sameEnvDimension(this.props.role.env.account, this.template.stack.account)) { | ||
| throw new Error(`Cannot grant permission to execution role in account ${this.props.role.env.account} to invoke target ${Names.nodeUniqueId(this.template.node)} in account ${this.template.stack.account}. Both the target and the execution role must be in the same account.`); | ||
| } | ||
|
|
||
| protected addTargetActionToRole(role: IRole): void { | ||
| role.addToPrincipalPolicy(new PolicyStatement({ | ||
| actions: ['inspector:StartAssessmentRun'], | ||
| resources: ['*'], | ||
| })); | ||
| } | ||
| } | ||
| } |
21 changes: 4 additions & 17 deletions
21
packages/@aws-cdk/aws-scheduler-targets-alpha/lib/kinesis-data-firehose-put-record.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,37 +1,24 @@ | ||
| import { ISchedule, IScheduleTarget } from '@aws-cdk/aws-scheduler-alpha'; | ||
| import { Names } from 'aws-cdk-lib'; | ||
| import { IScheduleTarget } from '@aws-cdk/aws-scheduler-alpha'; | ||
| import { IRole, PolicyStatement } from 'aws-cdk-lib/aws-iam'; | ||
| import { CfnDeliveryStream } from 'aws-cdk-lib/aws-kinesisfirehose'; | ||
| import { ScheduleTargetBase, ScheduleTargetBaseProps } from './target'; | ||
| import { sameEnvDimension } from './util'; | ||
|
|
||
| /** | ||
| * Use an Amazon Kinesis Data Firehose as a target for AWS EventBridge Scheduler. | ||
| */ | ||
| export class KinesisDataFirehosePutRecord extends ScheduleTargetBase implements IScheduleTarget { | ||
| constructor( | ||
| private readonly deliveryStream: CfnDeliveryStream, | ||
| private readonly props: ScheduleTargetBaseProps = {}, | ||
| props: ScheduleTargetBaseProps = {}, | ||
| ) { | ||
| super(props, deliveryStream.attrArn); | ||
| } | ||
|
|
||
| protected addTargetActionToRole(schedule: ISchedule, role: IRole): void { | ||
| if (!sameEnvDimension(this.deliveryStream.stack.region, schedule.env.region)) { | ||
| throw new Error(`Cannot assign the Firehose delivery stream in region ${this.deliveryStream.stack.region} to the schedule ${Names.nodeUniqueId(schedule.node)} in region ${schedule.env.region}. Both the schedule and the Firehose delivery stream must be in the same region.`); | ||
| } | ||
|
|
||
| if (!sameEnvDimension(this.deliveryStream.stack.account, schedule.env.account)) { | ||
| throw new Error(`Cannot assign the Firehose delivery stream in account ${this.deliveryStream.stack.account} to the schedule ${Names.nodeUniqueId(schedule.node)} in account ${schedule.env.region}. Both the schedule and the Firehose delivery stream must be in the same account.`); | ||
| } | ||
|
|
||
| if (this.props.role && !sameEnvDimension(this.props.role.env.account, this.deliveryStream.stack.account)) { | ||
| throw new Error(`Cannot grant permission to execution role in account ${this.props.role.env.account} to invoke target ${Names.nodeUniqueId(this.deliveryStream.node)} in account ${this.deliveryStream.stack.account}. Both the target and the execution role must be in the same account.`); | ||
| } | ||
| protected addTargetActionToRole(role: IRole): void { | ||
|
|
||
| role.addToPrincipalPolicy(new PolicyStatement({ | ||
| actions: ['firehose:PutRecord'], | ||
| resources: [this.deliveryStream.attrArn], | ||
| })); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
23 changes: 3 additions & 20 deletions
23
packages/@aws-cdk/aws-scheduler-targets-alpha/lib/sns-publish.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,37 +1,20 @@ | ||
| import { ISchedule, IScheduleTarget } from '@aws-cdk/aws-scheduler-alpha'; | ||
| import { Names } from 'aws-cdk-lib'; | ||
| import { IScheduleTarget } from '@aws-cdk/aws-scheduler-alpha'; | ||
| import { IRole } from 'aws-cdk-lib/aws-iam'; | ||
| import * as sns from 'aws-cdk-lib/aws-sns'; | ||
| import { ScheduleTargetBase, ScheduleTargetBaseProps } from './target'; | ||
| import { sameEnvDimension } from './util'; | ||
|
|
||
| /** | ||
| * Use an Amazon SNS topic as a target for AWS EventBridge Scheduler. | ||
| */ | ||
| export class SnsPublish extends ScheduleTargetBase implements IScheduleTarget { | ||
| constructor( | ||
| private readonly topic: sns.ITopic, | ||
| private readonly props: ScheduleTargetBaseProps = {}, | ||
| props: ScheduleTargetBaseProps = {}, | ||
| ) { | ||
| super(props, topic.topicArn); | ||
| } | ||
|
|
||
| protected addTargetActionToRole(schedule: ISchedule, role: IRole): void { | ||
| // Check if target and schedule are in the region | ||
| if (!sameEnvDimension(this.topic.env.region, schedule.env.region)) { | ||
| throw new Error(`Cannot assign topic in region ${this.topic.env.region} to the schedule ${Names.nodeUniqueId(schedule.node)} in region ${schedule.env.region}. Both the schedule and the topic must be in the same region.`); | ||
| } | ||
|
|
||
| // Check if target and schedule are in the same account | ||
| if (!sameEnvDimension(this.topic.env.account, schedule.env.account)) { | ||
| throw new Error(`Cannot assign topic in account ${this.topic.env.account} to the schedule ${Names.nodeUniqueId(schedule.node)} in account ${role.env.account}. Both the schedule and the topic must be in the same account.`); | ||
| } | ||
|
|
||
| // Check if target and role are in the same account | ||
| if (this.props.role && !sameEnvDimension(this.props.role.env.account, this.topic.env.account)) { | ||
| throw new Error(`Cannot grant permission to execution role in account ${this.props.role.env.account} to publish to target ${Names.nodeUniqueId(this.topic.node)} in account ${this.topic.env.account}. Both the target and the execution role must be in the same account.`); | ||
| } | ||
|
|
||
| protected addTargetActionToRole(role: IRole): void { | ||
| this.topic.grantPublish(role); | ||
| } | ||
| } |
Oops, something went wrong.