Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(batch): grant execution role logs:CreateLogStream by default #26288

Merged
merged 8 commits into from
Jul 12, 2023
Merged

fix(batch): grant execution role logs:CreateLogStream by default #26288

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
826e552
add CreateLogStream
comcalvi Jul 7, 2023
061086e
formatting
comcalvi Jul 7, 2023
5117f2d
integ tests
comcalvi Jul 7, 2023
87baf02
snapshot
comcalvi Jul 7, 2023
74a6a1c
use grantWrite with the batch log group and only use if logging disabled
comcalvi Jul 7, 2023
86e2db9
add putLogEvents to permissions
comcalvi Jul 10, 2023
70d891d
snaps
comcalvi Jul 10, 2023
c16b0b6
Merge branch 'main' into createLogStream
mergify[bot] Jul 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions ...ions-tasks/test/batch/integ.run-batch-job.js.snapshot/aws-stepfunctions-integ.assets.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
{
"version": "31.0.0",
"version": "32.0.0",
"files": {
"02f57d4a4fe6e856437076797ed3037dbed370ebb26574bc4a5d570ab0b0b478": {
"930dfb668387044df89bf3a77a4f4f869d5b2e96730574b7d222a5eaa0ca9e1f": {
"source": {
"path": "aws-stepfunctions-integ.template.json",
"packaging": "file"
},
"destinations": {
"current_account-current_region": {
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
"objectKey": "02f57d4a4fe6e856437076797ed3037dbed370ebb26574bc4a5d570ab0b0b478.json",
"objectKey": "930dfb668387044df89bf3a77a4f4f869d5b2e96730574b7d222a5eaa0ca9e1f.json",
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
}
}
Expand Down
13 changes: 8 additions & 5 deletions ...ns-tasks/test/batch/integ.run-batch-job.js.snapshot/aws-stepfunctions-integ.template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -529,6 +529,14 @@
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"ecr:GetAuthorizationToken",
"logs:CreateLogStream"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ecr:BatchCheckLayerAvailability",
Expand Down Expand Up @@ -559,11 +567,6 @@
]
]
}
},
{
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
2 changes: 1 addition & 1 deletion ...ork-integ/test/aws-stepfunctions-tasks/test/batch/integ.run-batch-job.js.snapshot/cdk.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
{"version":"31.0.0"}
{"version":"32.0.0"}
2 changes: 1 addition & 1 deletion ...-integ/test/aws-stepfunctions-tasks/test/batch/integ.run-batch-job.js.snapshot/integ.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"version": "31.0.0",
"version": "32.0.0",
"testCases": {
"integ.run-batch-job": {
"stacks": [
Expand Down
13 changes: 2 additions & 11 deletions ...teg/test/aws-stepfunctions-tasks/test/batch/integ.run-batch-job.js.snapshot/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"version": "31.0.0",
"version": "32.0.0",
"artifacts": {
"aws-stepfunctions-integ.assets": {
"type": "cdk:asset-manifest",
Expand All @@ -17,7 +17,7 @@
"validateOnSynth": false,
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/02f57d4a4fe6e856437076797ed3037dbed370ebb26574bc4a5d570ab0b0b478.json",
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/930dfb668387044df89bf3a77a4f4f869d5b2e96730574b7d222a5eaa0ca9e1f.json",
"requiresBootstrapStackVersion": 6,
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
"additionalDependencies": [
Expand Down Expand Up @@ -260,15 +260,6 @@
"type": "aws:cdk:logicalId",
"data": "CheckBootstrapVersion"
}
],
"JobQueueC5644E0D": [
{
"type": "aws:cdk:logicalId",
"data": "JobQueueC5644E0D",
"trace": [
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
]
}
]
},
"displayName": "aws-stepfunctions-integ"
Expand Down
15 changes: 9 additions & 6 deletions ...k-integ/test/aws-stepfunctions-tasks/test/batch/integ.run-batch-job.js.snapshot/tree.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -908,6 +908,14 @@
"aws:cdk:cloudformation:props": {
"policyDocument": {
"Statement": [
{
"Action": [
"ecr:GetAuthorizationToken",
"logs:CreateLogStream"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ecr:BatchCheckLayerAvailability",
Expand Down Expand Up @@ -938,11 +946,6 @@
]
]
}
},
{
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -1304,7 +1307,7 @@
"path": "Tree",
"constructInfo": {
"fqn": "constructs.Construct",
"version": "10.1.270"
"version": "10.2.55"
}
}
},
Expand Down
6 changes: 3 additions & 3 deletions ...nctions-tasks/test/batch/integ.submit-job.js.snapshot/aws-stepfunctions-integ.assets.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
{
"version": "31.0.0",
"version": "32.0.0",
"files": {
"40eeb6dc0a7fbe38cdca73b998f41d71b047bf499a3554164309a332a0d0e539": {
"ea4098e36ea16db445eda8129295b5d8772aa70705cd702b708faab6fb4187b4": {
"source": {
"path": "aws-stepfunctions-integ.template.json",
"packaging": "file"
},
"destinations": {
"current_account-current_region": {
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
"objectKey": "40eeb6dc0a7fbe38cdca73b998f41d71b047bf499a3554164309a332a0d0e539.json",
"objectKey": "ea4098e36ea16db445eda8129295b5d8772aa70705cd702b708faab6fb4187b4.json",
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
}
}
Expand Down
13 changes: 8 additions & 5 deletions ...tions-tasks/test/batch/integ.submit-job.js.snapshot/aws-stepfunctions-integ.template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -529,6 +529,14 @@
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"ecr:GetAuthorizationToken",
"logs:CreateLogStream"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ecr:BatchCheckLayerAvailability",
Expand Down Expand Up @@ -559,11 +567,6 @@
]
]
}
},
{
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
2 changes: 1 addition & 1 deletion ...mework-integ/test/aws-stepfunctions-tasks/test/batch/integ.submit-job.js.snapshot/cdk.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
{"version":"31.0.0"}
{"version":"32.0.0"}
2 changes: 1 addition & 1 deletion ...ork-integ/test/aws-stepfunctions-tasks/test/batch/integ.submit-job.js.snapshot/integ.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"version": "31.0.0",
"version": "32.0.0",
"testCases": {
"integ.submit-job": {
"stacks": [
Expand Down
13 changes: 2 additions & 11 deletions ...-integ/test/aws-stepfunctions-tasks/test/batch/integ.submit-job.js.snapshot/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"version": "31.0.0",
"version": "32.0.0",
"artifacts": {
"aws-stepfunctions-integ.assets": {
"type": "cdk:asset-manifest",
Expand All @@ -17,7 +17,7 @@
"validateOnSynth": false,
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/40eeb6dc0a7fbe38cdca73b998f41d71b047bf499a3554164309a332a0d0e539.json",
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/ea4098e36ea16db445eda8129295b5d8772aa70705cd702b708faab6fb4187b4.json",
"requiresBootstrapStackVersion": 6,
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
"additionalDependencies": [
Expand Down Expand Up @@ -260,15 +260,6 @@
"type": "aws:cdk:logicalId",
"data": "CheckBootstrapVersion"
}
],
"JobQueueC5644E0D": [
{
"type": "aws:cdk:logicalId",
"data": "JobQueueC5644E0D",
"trace": [
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
]
}
]
},
"displayName": "aws-stepfunctions-integ"
Expand Down
15 changes: 9 additions & 6 deletions ...work-integ/test/aws-stepfunctions-tasks/test/batch/integ.submit-job.js.snapshot/tree.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -908,6 +908,14 @@
"aws:cdk:cloudformation:props": {
"policyDocument": {
"Statement": [
{
"Action": [
"ecr:GetAuthorizationToken",
"logs:CreateLogStream"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ecr:BatchCheckLayerAvailability",
Expand Down Expand Up @@ -938,11 +946,6 @@
]
]
}
},
{
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -1304,7 +1307,7 @@
"path": "Tree",
"constructInfo": {
"fqn": "constructs.Construct",
"version": "10.1.270"
"version": "10.2.55"
}
}
},
Expand Down
10 changes: 9 additions & 1 deletion packages/@aws-cdk/aws-batch-alpha/lib/ecs-container-definition.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -965,9 +965,17 @@ export class EcsFargateContainerDefinition extends EcsContainerDefinitionBase im
}

function createExecutionRole(scope: Construct, id: string): iam.IRole {
return new iam.Role(scope, id, {
const execRole = new iam.Role(scope, id, {
assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
// needed for cross-account access with TagParameterContainerImage
roleName: PhysicalName.GENERATE_IF_NEEDED,
});

// all jobs will fail without this if they produce any output at all when no logging is specified
comcalvi marked this conversation as resolved.
Show resolved Hide resolved
execRole.addToPrincipalPolicy(new iam.PolicyStatement({
actions: ['logs:CreateLogStream'],
resources: ['*'],
}));

return execRole;
}
81 changes: 71 additions & 10 deletions packages/@aws-cdk/aws-batch-alpha/test/ecs-container-definition.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@

import { Template } from 'aws-cdk-lib/assertions';
import * as path from 'path';
import { Vpc } from 'aws-cdk-lib/aws-ec2';
Expand Down Expand Up @@ -46,7 +45,15 @@ describe.each([EcsEc2ContainerDefinition, EcsFargateContainerDefinition])('%p',
// GIVEN
beforeEach(() => {
stack = new Stack();
pascalCaseExpectedProps = capitalizePropertyNames(stack, defaultExpectedProps);
pascalCaseExpectedProps = capitalizePropertyNames(stack, {
...defaultExpectedProps,
containerProperties: {
...defaultExpectedProps.containerProperties,
executionRoleArn: {
'Fn::GetAtt': ['EcsContainerExecutionRole3B199293', 'Arn'],
} as any,
},
});
});

test('ecs container defaults', () => {
Expand All @@ -60,6 +67,42 @@ describe.each([EcsEc2ContainerDefinition, EcsFargateContainerDefinition])('%p',
// THEN
Template.fromStack(stack).hasResourceProperties('AWS::Batch::JobDefinition', {
...pascalCaseExpectedProps,
ContainerProperties: {
ExecutionRoleArn: {
'Fn::GetAtt': ['EcsContainerExecutionRole3B199293', 'Arn'],
},
...pascalCaseExpectedProps.ContainerProperties,
},
});

Template.fromStack(stack).hasResourceProperties('AWS::IAM::Role', {
AssumeRolePolicyDocument: {
Statement: [
{
Action: 'sts:AssumeRole',
Effect: 'Allow',
Principal: { Service: 'ecs-tasks.amazonaws.com' },
},
],
Version: '2012-10-17',
},
});

Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
PolicyDocument: {
Statement: [
{
Action: 'logs:CreateLogStream',
Effect: 'Allow',
Resource: '*',
},
],
Version: '2012-10-17',
},
PolicyName: 'EcsContainerExecutionRoleDefaultPolicy6F59CD37',
Roles: [{
Ref: 'EcsContainerExecutionRole3B199293',
}],
});
});

Expand Down Expand Up @@ -185,7 +228,7 @@ describe.each([EcsEc2ContainerDefinition, EcsFargateContainerDefinition])('%p',
});
});

test('respects logging and creates an execution role for EC2 and Fargate containers', () => {
test('respects logging', () => {
// WHEN
new EcsJobDefinition(stack, 'ECSJobDefn', {
container: new ContainerDefinition(stack, 'EcsContainer', {
Expand Down Expand Up @@ -221,11 +264,13 @@ describe.each([EcsEc2ContainerDefinition, EcsFargateContainerDefinition])('%p',

Template.fromStack(stack).hasResourceProperties('AWS::IAM::Role', {
AssumeRolePolicyDocument: {
Statement: [{
Action: 'sts:AssumeRole',
Effect: 'Allow',
Principal: { Service: 'ecs-tasks.amazonaws.com' },
}],
Statement: [
{
Action: 'sts:AssumeRole',
Effect: 'Allow',
Principal: { Service: 'ecs-tasks.amazonaws.com' },
},
],
Version: '2012-10-17',
},
});
Expand Down Expand Up @@ -564,7 +609,15 @@ describe('EC2 containers', () => {
// GIVEN
beforeEach(() => {
stack = new Stack();
pascalCaseExpectedProps = capitalizePropertyNames(stack, defaultExpectedProps);
pascalCaseExpectedProps = capitalizePropertyNames(stack, {
...defaultExpectedProps,
containerProperties: {
...defaultExpectedProps.containerProperties,
executionRoleArn: {
'Fn::GetAtt': ['EcsEc2ContainerExecutionRole90E18680', 'Arn'],
} as any,
},
});
});

test('respects addUlimit()', () => {
Expand Down Expand Up @@ -708,7 +761,15 @@ describe('Fargate containers', () => {
// GIVEN
beforeEach(() => {
stack = new Stack();
pascalCaseExpectedProps = capitalizePropertyNames(stack, defaultExpectedProps);
pascalCaseExpectedProps = capitalizePropertyNames(stack, {
...defaultExpectedProps,
containerProperties: {
...defaultExpectedProps.containerProperties,
executionRoleArn: {
'Fn::GetAtt': ['EcsContainerExecutionRole3B199293', 'Arn'],
} as any,
},
});
});

test('create executionRole by default', () => {
Expand Down
Loading