fix(s3): incorrect account used for S3 event source mapping

[jonife]

Issue # (if applicable)

#21628

initial PR was closed for naming issues: #29023

Closes #.
1

Reason for this change

A Customers has a stack intending to deploy with alongside a Lambda to account "A"

A Bucket (in account "B") was referenced using fromBucketAttributes in the same stack and specified account "B" as the account attribute. When hooked to Lambda using addEventSource, it was expected that the IAM configuration generated will specify account "B" as part of the conditional grant.

However, Account "A" is defined as the "source account" which is incorrect. The Bucket lives in account "B" and was only referenced in the stack whose resources get deployed to "A".

Today S3 bucket is added as an event source to lambda, the account for the bucket is sourced from the stack not from the bucket configuration.

CDK fails to reference customer's bucket account rather is results to using the stack account which might not necessary be the bucket account.

Description of changes

Description of how you validated changes

1. Extensive testing was conducted by creating an application and validating the generated templates
2. Unit test was also added to test the new change

aws-cdk-lib % yarn test aws-lambda-event-sources 
yarn run v1.22.19
$ jest aws-lambda-event-sources
 PASS  aws-lambda-event-sources/test/sns.test.ts (56.025 s)
 PASS  aws-lambda-event-sources/test/s3.test.ts (56.097 s)
 PASS  aws-lambda-event-sources/test/api.test.ts (56.436 s)
 PASS  aws-lambda-event-sources/test/kinesis.test.ts (56.558 s)
 PASS  aws-lambda-event-sources/test/dynamo.test.ts (57.016 s)
 PASS  aws-lambda-event-sources/test/sqs.test.ts (56.816 s)
 PASS  aws-lambda-event-sources/test/kafka.test.ts (57.452 s)
A worker process has failed to exit gracefully and has been force exited. This is likely caused by tests leaking due to improper teardown. Try running with --detectOpenHandles to find leaks. Active timers can also cause this, ensure that .unref() was called on them.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[jonife]

Exemption Request: Extensive integration test might not be possible because of lack of account to create an bucket in a separate account. However extensive unit and end to end test was written and carried out.

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[GavinZZ]

LGTM, thanks for contributing.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 377078e
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).