-
Notifications
You must be signed in to change notification settings - Fork 3.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(stepfunctions-tasks): mwaa service generates wrong action in role policy #28082
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, thanks!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice fix, good assertions in the integ test. Thanks!
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Pull request has been modified.
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
… policy (aws#28082) When we use CallAwsService for Step Functions task, CDK generates IAM policy to grant permission regarding the API call. However, if we specify `mwaa` as service in CallAwsService, CDK generates wrong policy statement such as `mwaa:listEnvironments`. Correct service prefix for MWAA is `airflow`. https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedworkflowsforapacheairflow.html > Amazon Managed Workflows for Apache Airflow (service prefix: airflow) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies. This PR solves the issue by adding `mwaa` into iamServiceMap. This is similar with aws#27623. Closes aws#28081 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…ion in role policy (#28775) When we use CallAwsService for Step Functions task, CDK generates IAM policy to grant permission regarding the API call. However, if we specify `mediapackagevod` as service in CallAwsService, CDK generates wrong policy statement such as `mediapackagevod:deleteAsset`. Correct service prefix for MediaPackageVOD is `mediapackage-vod`. https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediapackagevod.html > Amazon MediaPackageVOD (service prefix: mediapackage-vod) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies. This PR solves the issue by adding mediapackagevod into iamServiceMap. This is similar with #27623 and #28082. Closes #28774. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…ion in role policy (#28775) When we use CallAwsService for Step Functions task, CDK generates IAM policy to grant permission regarding the API call. However, if we specify `mediapackagevod` as service in CallAwsService, CDK generates wrong policy statement such as `mediapackagevod:deleteAsset`. Correct service prefix for MediaPackageVOD is `mediapackage-vod`. https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediapackagevod.html > Amazon MediaPackageVOD (service prefix: mediapackage-vod) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies. This PR solves the issue by adding mediapackagevod into iamServiceMap. This is similar with #27623 and #28082. Closes #28774. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
When we use CallAwsService for Step Functions task, CDK generates IAM policy to grant permission regarding the API call. However, if we specify
mwaa
as service in CallAwsService, CDK generates wrong policy statement such asmwaa:listEnvironments
. Correct service prefix for MWAA isairflow
.https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedworkflowsforapacheairflow.html
This PR solves the issue by adding
mwaa
into iamServiceMap. This is similar with #27623.Closes #28081
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license