fix(subscriber): set role ARN

apps/subscriber/template.yaml

@@ -81,6 +81,10 @@ Conditions:
   UseStackName: !Equals
     - !Ref NameOverride
     - ''
+  HasRoleArn: !Not
+    - !Equals
+      - !Ref RoleArn
+      - ''
   HasDiscoveryRate: !Not
     - !Equals
       - !Ref DiscoveryRate
@@ -158,6 +162,17 @@ Resources:
                   - logs:CreateLogStream
                   - logs:PutLogEvents
                 Resource: !GetAtt LogGroup.Arn
+        - !If
+          - HasRoleArn
+          - PolicyName: pass
+            PolicyDocument:
+              Version: 2012-10-17
+              Statement:
+                - Effect: Allow
+                  Action:
+                    - iam:PassRole
+                  Resource: !Ref RoleArn
+          - !Ref AWS::NoValue
         - PolicyName: queue
           PolicyDocument:
             Version: 2012-10-17
@@ -230,7 +245,10 @@ Resources:
           LOG_GROUP_NAME_PATTERNS: !Join
             - ','
             - !Ref LogGroupNamePatterns
-          ROLE_ARN: !Ref RoleArn
+          ROLE_ARN: !If
+            - HasRoleArn
+            - !Ref RoleArn
+            - !Ref AWS::NoValue
           QUEUE_URL: !Ref Queue
           VERBOSITY: 9
           NUM_WORKERS: !Ref NumWorkers

cmd/subscriber/main.go

@@ -19,7 +19,7 @@ var env struct {
 	FilterName           string   `env:"FILTER_NAME"`
 	FilterPattern        string   `env:"FILTER_PATTERN"`
 	DestinationARN       string   `env:"DESTINATION_ARN"`
-	RoleARN              string   `env:"ROLE_ARN"`
+	RoleARN              *string  `env:"ROLE_ARN,noinit"` // noinit retains nil if env var unset
 	LogGroupNamePatterns []string `env:"LOG_GROUP_NAME_PATTERNS"`
 	LogGroupNamePrefixes []string `env:"LOG_GROUP_NAME_PREFIXES"`
 	QueueURL             string   `env:"QUEUE_URL,required"`

handler/subscriber/config.go

@@ -35,8 +35,10 @@ type Config struct {
 	// DestinationARN to subscribe log groups to.
 	// If empty, delete any subscription filters we manage.
 	DestinationARN string
-	// RoleARN for subscription filter
-	RoleARN string
+
+	// RoleARN for subscription filter.
+	// Only required if destination is a firehose delivery stream
+	RoleARN *string
 
 	// LogGroupNamePrefixes contains a list of prefixes which restricts the log
 	// groups we operate on.
@@ -68,12 +70,12 @@ func (c *Config) Validate() error {
 		}
 	}
 
-	if c.RoleARN != "" {
+	if c.RoleARN != nil {
 		if c.DestinationARN == "" {
 			errs = append(errs, ErrMissingDestinationARN)
 		}
 
-		roleARN, err := arn.Parse(c.RoleARN)
+		roleARN, err := arn.Parse(*c.RoleARN)
 		if err != nil || roleARN.Service != "iam" || !strings.HasPrefix(roleARN.Resource, "role/") {
 			errs = append(errs, fmt.Errorf("failed to parse role: %w", ErrInvalidARN))
 		}

handler/subscriber/config_test.go

@@ -7,6 +7,7 @@ import (
 	"github.com/observeinc/aws-sam-testing/handler/handlertest"
 	"github.com/observeinc/aws-sam-testing/handler/subscriber"
 
+	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 )
@@ -45,7 +46,7 @@ func TestConfig(t *testing.T) {
 			Config: subscriber.Config{
 				CloudWatchLogsClient: &handlertest.CloudWatchLogsClient{},
 				FilterName:           "observe-logs-subscription",
-				RoleARN:              "arn:aws:iam::123456789012:role/test",
+				RoleARN:              aws.String("arn:aws:iam::123456789012:role/test"),
 			},
 			ExpectError: subscriber.ErrMissingDestinationARN,
 		},
@@ -55,7 +56,7 @@ func TestConfig(t *testing.T) {
 				CloudWatchLogsClient: &handlertest.CloudWatchLogsClient{},
 				FilterName:           "observe-logs-subscription",
 				DestinationARN:       "arn:aws:firehose:us-west-2:123456789012:deliverystream/test",
-				RoleARN:              "arn:aws:iam::123456789012:role/test",
+				RoleARN:              aws.String("arn:aws:iam::123456789012:role/test"),
 			},
 		},
 		{

handler/subscriber/handler.go

@@ -94,7 +94,7 @@ func New(cfg *Config) (*Handler, error) {
 			FilterName:     aws.String(cfg.FilterName),
 			FilterPattern:  aws.String(cfg.FilterPattern),
 			DestinationArn: aws.String(cfg.DestinationARN),
-			RoleArn:        aws.String(cfg.RoleARN),
+			RoleArn:        cfg.RoleARN,
 		},
 		logGroupNameFilter: cfg.LogGroupFilter(),
 	}

handler/subscriber/subscription.go

@@ -123,7 +123,7 @@ func (h *Handler) SubscriptionFilterDiff(subscriptionFilters []types.Subscriptio
 				FilterName:     h.subscriptionFilter.FilterName,
 				FilterPattern:  h.subscriptionFilter.FilterPattern,
 				DestinationArn: h.subscriptionFilter.DestinationArn,
-				RoleArn:        h.subscriptionFilter.LogGroupName,
+				RoleArn:        h.subscriptionFilter.RoleArn,
 			})
 		}
 	}
@@ -133,7 +133,7 @@ func (h *Handler) SubscriptionFilterDiff(subscriptionFilters []types.Subscriptio
 			FilterName:     h.subscriptionFilter.FilterName,
 			FilterPattern:  h.subscriptionFilter.FilterPattern,
 			DestinationArn: h.subscriptionFilter.DestinationArn,
-			RoleArn:        h.subscriptionFilter.LogGroupName,
+			RoleArn:        h.subscriptionFilter.RoleArn,
 		})
 	}
 

handler/subscriber/subscription_test.go

@@ -158,6 +158,32 @@ func TestSubscriptionFilterDiff(t *testing.T) {
 				},
 			},
 		},
+		{
+			Configure: types.SubscriptionFilter{
+				FilterName:     aws.String("observe"),
+				DestinationArn: aws.String("arn:aws:firehose:us-west-2:123456789012:deliverystream/example"),
+				RoleArn:        aws.String("arn:aws:iam::123456789012:role/example"),
+			},
+			Existing: []types.SubscriptionFilter{
+				{
+					FilterName: aws.String("foo"),
+				},
+				{
+					FilterName: aws.String("observe-logs-subscription"),
+				},
+			},
+			ExpectedActions: []any{
+				&cloudwatchlogs.DeleteSubscriptionFilterInput{
+					FilterName: aws.String("observe-logs-subscription"),
+				},
+				&cloudwatchlogs.PutSubscriptionFilterInput{
+					FilterName:     aws.String("observe"),
+					FilterPattern:  aws.String(""),
+					DestinationArn: aws.String("arn:aws:firehose:us-west-2:123456789012:deliverystream/example"),
+					RoleArn:        aws.String("arn:aws:iam::123456789012:role/example"),
+				},
+			},
+		},
 		{
 			/*
 				Do nothing if we exceed the two subscription filter limit
@@ -201,7 +227,7 @@ func TestSubscriptionFilterDiff(t *testing.T) {
 					CloudWatchLogsClient: &handlertest.CloudWatchLogsClient{},
 					FilterName:           aws.ToString(tt.Configure.FilterName),
 					DestinationARN:       aws.ToString(tt.Configure.DestinationArn),
-					RoleARN:              aws.ToString(tt.Configure.RoleArn),
+					RoleARN:              tt.Configure.RoleArn,
 				})
 			if err != nil {
 				t.Fatal(err)