Skip to content

Commit 3c98d1e

Browse files
joel-awsjoel-aws
authored
fix(logs-destinations): missing dependency to Policy created by KinesisDestination (#24811)
Fixes #21827 All credit to @pv93 for [their fix](#21827 (comment)).
1 parent 3c0756a commit 3c98d1e

12 files changed

+764
-0
lines changed

‎packages/@aws-cdk/aws-logs-destinations/lib/kinesis.ts

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,17 @@ export class KinesisDestination implements logs.ILogSubscriptionDestination {
3636
});
3737
this.stream.grantWrite(role);
3838
role.grantPassRole(role);
39+
40+
const policy = role.node.tryFindChild('DefaultPolicy') as iam.CfnPolicy;
41+
if (policy) {
42+
// Remove circular dependency
43+
const cfnRole = role.node.defaultChild as iam.CfnRole;
44+
cfnRole.addOverride('DependsOn', undefined);
45+
46+
// Ensure policy is created before subscription filter
47+
scope.node.addDependency(policy);
48+
}
49+
3950
return { arn: this.stream.streamArn, role };
4051
}
4152
}

‎packages/@aws-cdk/aws-logs-destinations/package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@
7575
"@aws-cdk/assertions": "0.0.0",
7676
"@aws-cdk/cdk-build-tools": "0.0.0",
7777
"@aws-cdk/integ-runner": "0.0.0",
78+
"@aws-cdk/integ-tests": "0.0.0",
7879
"@aws-cdk/cfn2ts": "0.0.0",
7980
"@aws-cdk/pkglint": "0.0.0",
8081
"@types/jest": "^27.5.2",

‎packages/@aws-cdk/aws-logs-destinations/test/integ.kinesis.js.snapshot/KinesisIntegDefaultTestDeployAssertE6E3ADDB.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "KinesisIntegDefaultTestDeployAssertE6E3ADDB.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-logs-destinations/test/integ.kinesis.js.snapshot/KinesisIntegDefaultTestDeployAssertE6E3ADDB.template.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk/aws-logs-destinations/test/integ.kinesis.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"31.0.0"}

‎packages/@aws-cdk/aws-logs-destinations/test/integ.kinesis.js.snapshot/integ.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "31.0.0",
3+
"testCases": {
4+
"KinesisInteg/DefaultTest": {
5+
"stacks": [
6+
"kinesis-logsubscription-integ"
7+
],
8+
"assertionStack": "KinesisInteg/DefaultTest/DeployAssert",
9+
"assertionStackName": "KinesisIntegDefaultTestDeployAssertE6E3ADDB"
10+
}
11+
}
12+
}

‎packages/@aws-cdk/aws-logs-destinations/test/integ.kinesis.js.snapshot/kinesis-logsubscription-integ.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"c32b075cf703af59a0711e440bc11930c01e91f7de8d901334778493c7c28263": {
5+
"source": {
6+
"path": "kinesis-logsubscription-integ.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "c32b075cf703af59a0711e440bc11930c01e91f7de8d901334778493c7c28263.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-logs-destinations/test/integ.kinesis.js.snapshot/kinesis-logsubscription-integ.template.json

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
{
2+
"Resources": {
3+
"MyStream5C050E93": {
4+
"Type": "AWS::Kinesis::Stream",
5+
"Properties": {
6+
"RetentionPeriodHours": 24,
7+
"ShardCount": 1,
8+
"StreamEncryption": {
9+
"Fn::If": [
10+
"AwsCdkKinesisEncryptedStreamsUnsupportedRegions",
11+
{
12+
"Ref": "AWS::NoValue"
13+
},
14+
{
15+
"EncryptionType": "KMS",
16+
"KeyId": "alias/aws/kinesis"
17+
}
18+
]
19+
},
20+
"StreamModeDetails": {
21+
"StreamMode": "PROVISIONED"
22+
}
23+
}
24+
},
25+
"LogGroupF5B46931": {
26+
"Type": "AWS::Logs::LogGroup",
27+
"Properties": {
28+
"RetentionInDays": 731
29+
},
30+
"UpdateReplacePolicy": "Delete",
31+
"DeletionPolicy": "Delete"
32+
},
33+
"SubscriptionCloudWatchLogsCanPutRecords9C1223EC": {
34+
"Type": "AWS::IAM::Role",
35+
"Properties": {
36+
"AssumeRolePolicyDocument": {
37+
"Statement": [
38+
{
39+
"Action": "sts:AssumeRole",
40+
"Effect": "Allow",
41+
"Principal": {
42+
"Service": "logs.amazonaws.com"
43+
}
44+
}
45+
],
46+
"Version": "2012-10-17"
47+
}
48+
}
49+
},
50+
"SubscriptionCloudWatchLogsCanPutRecordsDefaultPolicy50D4970F": {
51+
"Type": "AWS::IAM::Policy",
52+
"Properties": {
53+
"PolicyDocument": {
54+
"Statement": [
55+
{
56+
"Action": [
57+
"kinesis:ListShards",
58+
"kinesis:PutRecord",
59+
"kinesis:PutRecords"
60+
],
61+
"Effect": "Allow",
62+
"Resource": {
63+
"Fn::GetAtt": [
64+
"MyStream5C050E93",
65+
"Arn"
66+
]
67+
}
68+
},
69+
{
70+
"Action": "iam:PassRole",
71+
"Effect": "Allow",
72+
"Resource": {
73+
"Fn::GetAtt": [
74+
"SubscriptionCloudWatchLogsCanPutRecords9C1223EC",
75+
"Arn"
76+
]
77+
}
78+
}
79+
],
80+
"Version": "2012-10-17"
81+
},
82+
"PolicyName": "SubscriptionCloudWatchLogsCanPutRecordsDefaultPolicy50D4970F",
83+
"Roles": [
84+
{
85+
"Ref": "SubscriptionCloudWatchLogsCanPutRecords9C1223EC"
86+
}
87+
]
88+
}
89+
},
90+
"Subscription391C9821": {
91+
"Type": "AWS::Logs::SubscriptionFilter",
92+
"Properties": {
93+
"DestinationArn": {
94+
"Fn::GetAtt": [
95+
"MyStream5C050E93",
96+
"Arn"
97+
]
98+
},
99+
"FilterPattern": "",
100+
"LogGroupName": {
101+
"Ref": "LogGroupF5B46931"
102+
},
103+
"RoleArn": {
104+
"Fn::GetAtt": [
105+
"SubscriptionCloudWatchLogsCanPutRecords9C1223EC",
106+
"Arn"
107+
]
108+
}
109+
},
110+
"DependsOn": [
111+
"SubscriptionCloudWatchLogsCanPutRecordsDefaultPolicy50D4970F"
112+
]
113+
}
114+
},
115+
"Conditions": {
116+
"AwsCdkKinesisEncryptedStreamsUnsupportedRegions": {
117+
"Fn::Or": [
118+
{
119+
"Fn::Equals": [
120+
{
121+
"Ref": "AWS::Region"
122+
},
123+
"cn-north-1"
124+
]
125+
},
126+
{
127+
"Fn::Equals": [
128+
{
129+
"Ref": "AWS::Region"
130+
},
131+
"cn-northwest-1"
132+
]
133+
}
134+
]
135+
}
136+
},
137+
"Parameters": {
138+
"BootstrapVersion": {
139+
"Type": "AWS::SSM::Parameter::Value<String>",
140+
"Default": "/cdk-bootstrap/hnb659fds/version",
141+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
142+
}
143+
},
144+
"Rules": {
145+
"CheckBootstrapVersion": {
146+
"Assertions": [
147+
{
148+
"Assert": {
149+
"Fn::Not": [
150+
{
151+
"Fn::Contains": [
152+
[
153+
"1",
154+
"2",
155+
"3",
156+
"4",
157+
"5"
158+
],
159+
{
160+
"Ref": "BootstrapVersion"
161+
}
162+
]
163+
}
164+
]
165+
},
166+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
167+
}
168+
]
169+
}
170+
}
171+
}

0 commit comments

Comments
 (0)