Skip to content

feat(app-staging-synthesizer): cross-account support #26638

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

feat(app-staging-synthesizer): cross-account support #26638

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ebce0a1
Add property for cross account trust
tenjaa Aug 4, 2023
4002f4c
Document additionalTrustedPrincipals property
tenjaa Aug 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 22 additions & 2 deletions packages/@aws-cdk/app-staging-synthesizer-alpha/lib/default-staging-stack.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,16 @@ export interface DefaultStagingStackOptions {
* @default 'StagingStack'
*/
readonly stagingStackNamePrefix?: string;

/**
* Specify trusted principals for e.g. cross-account usage.
* They will be added to the default principal.
* Both file-role and image-role will be modified.
* Will be ignored when custom roles are provided.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a validation for this please.

*
* @default - no additional principals will be trusted
*/
readonly additionalTrustedPrincipals?: iam.IPrincipal[]
}

/**
Expand Down Expand Up @@ -238,6 +248,8 @@ export class DefaultStagingStack extends Stack implements IStagingResources {

private readonly deployRoleArn?: string;

private readonly additionalTrustedPrincipals: iam.IPrincipal[];

constructor(scope: App, id: string, private readonly props: DefaultStagingStackProps) {
super(scope, id, {
...props,
Expand All @@ -263,6 +275,8 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
this.providedFileRole = props.fileAssetPublishingRole?._specialize(specializer);
this.providedImageRole = props.imageAssetPublishingRole?._specialize(specializer);
this.stagingRepos = {};

this.additionalTrustedPrincipals = props.additionalTrustedPrincipals ?? [];
}

private validateAppId(id: string) {
Expand Down Expand Up @@ -298,7 +312,10 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
const roleName = this.fileRoleName;
this.fileRole = new iam.Role(this, 'CdkFileRole', {
roleName,
assumedBy: new iam.AccountPrincipal(this.account),
assumedBy: new iam.CompositePrincipal(
new iam.AccountPrincipal(this.account),
...this.additionalTrustedPrincipals,
),
});

this.fileRoleManifestArn = Stack.of(this).formatArn({
Expand Down Expand Up @@ -329,7 +346,10 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
const roleName = this.imageRoleName;
this.imageRole = new iam.Role(this, 'CdkImageRole', {
roleName,
assumedBy: new iam.AccountPrincipal(this.account),
assumedBy: new iam.CompositePrincipal(
new iam.AccountPrincipal(this.account),
...this.additionalTrustedPrincipals,
),
});
this.imageRoleManifestArn = Stack.of(this).formatArn({
partition: '${AWS::Partition}',
Expand Down
55 changes: 55 additions & 0 deletions packages/@aws-cdk/app-staging-synthesizer-alpha/test/app-staging-synthesizer.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ import * as fs from 'fs';
import * as path from 'path';
import { App, Stack, CfnResource, FileAssetPackaging, Token, Lazy, Duration } from 'aws-cdk-lib';
import { Match, Template } from 'aws-cdk-lib/assertions';
import { AccountPrincipal } from 'aws-cdk-lib/aws-iam';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as cxschema from 'aws-cdk-lib/cloud-assembly-schema';
import { CloudAssembly } from 'aws-cdk-lib/cx-api';
Expand Down Expand Up @@ -547,6 +548,60 @@ describe(AppStagingSynthesizer, () => {
expect(() => app.synth()).toThrowError(/Staging resource template cannot be greater than 51200 bytes/);
});

test('pass trusted principals', () => {
// GIVEN
app = new App({
defaultStackSynthesizer: AppStagingSynthesizer.defaultResources({
appId: APP_ID,
additionalTrustedPrincipals: [new AccountPrincipal('999999999999')],
}),
});
stack = new Stack(app, 'Stack', {
env: {
account: '000000000000',
region: 'us-east-1',
},
});

stack.synthesizer.addDockerImageAsset({
directoryName: '.',
sourceHash: 'abcdef',
assetName: 'abcdef',
});

// WHEN
const asm = app.synth();

// THEN
const crossAccountAssumeRolePolicyDocument = {
Statement: Match.arrayEquals([
Match.anyValue(),
{
Effect: 'Allow',
Principal: {
AWS: {
'Fn::Join': [
'',
Match.arrayWith([
':iam::999999999999:root',
]),
],
},
},
Action: 'sts:AssumeRole',
},
]),
};
Template.fromJSON(getStagingResourceStack(asm).template).hasResourceProperties('AWS::IAM::Role', {
AssumeRolePolicyDocument: crossAccountAssumeRolePolicyDocument,
RoleName: 'cdk-appid-file-role-us-east-1',
});
Template.fromJSON(getStagingResourceStack(asm).template).hasResourceProperties('AWS::IAM::Role', {
AssumeRolePolicyDocument: crossAccountAssumeRolePolicyDocument,
RoleName: 'cdk-appid-image-role-us-east-1',
});
});

/**
* Evaluate a possibly string-containing value the same way CFN would do
*
Expand Down