From 113527d2e178d8a57ddfe40406927f76d1a56f69 Mon Sep 17 00:00:00 2001 From: maz Date: Tue, 14 May 2024 17:47:17 +0900 Subject: [PATCH 01/16] feat: artifact encryption --- ...efaultTestDeployAssert3AD5A094.assets.json | 19 + ...aultTestDeployAssert3AD5A094.template.json | 36 + .../index.js | 1 + .../index.js | 1 + .../canary-artifact-s3-encryption.assets.json | 45 + ...anary-artifact-s3-encryption.template.json | 903 +++++++++++++ .../cdk.out | 1 + .../integ.json | 12 + .../manifest.json | 227 ++++ .../tree.json | 1114 +++++++++++++++++ .../integ.canary-artifact-s3-encryption.ts | 76 ++ packages/aws-cdk-lib/aws-synthetics/README.md | 30 +- .../aws-cdk-lib/aws-synthetics/lib/canary.ts | 80 +- .../aws-synthetics/test/canary.test.ts | 135 ++ 14 files changed, 2677 insertions(+), 3 deletions(-) create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/IntegCanaryTestDefaultTestDeployAssert3AD5A094.assets.json create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/IntegCanaryTestDefaultTestDeployAssert3AD5A094.template.json create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d/index.js create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.d57a897c2081bda5ce88819548c8b944dff49e721e1f7f7e9e3dd8323e6ccb0d/index.js create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/cdk.out create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/integ.json create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/tree.json create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/IntegCanaryTestDefaultTestDeployAssert3AD5A094.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/IntegCanaryTestDefaultTestDeployAssert3AD5A094.assets.json new file mode 100644 index 0000000000000..ceb305d3c2f6e --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/IntegCanaryTestDefaultTestDeployAssert3AD5A094.assets.json @@ -0,0 +1,19 @@ +{ + "version": "36.0.0", + "files": { + "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": { + "source": { + "path": "IntegCanaryTestDefaultTestDeployAssert3AD5A094.template.json", + "packaging": "file" + }, + "destinations": { + "current_account-current_region": { + "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}", + "objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json", + "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}" + } + } + } + }, + "dockerImages": {} +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/IntegCanaryTestDefaultTestDeployAssert3AD5A094.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/IntegCanaryTestDefaultTestDeployAssert3AD5A094.template.json new file mode 100644 index 0000000000000..ad9d0fb73d1dd --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/IntegCanaryTestDefaultTestDeployAssert3AD5A094.template.json @@ -0,0 +1,36 @@ +{ + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]" + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d/index.js b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d/index.js new file mode 100644 index 0000000000000..d52c856d6a605 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d/index.js @@ -0,0 +1 @@ +"use strict";var I=Object.create;var i=Object.defineProperty;var C=Object.getOwnPropertyDescriptor;var w=Object.getOwnPropertyNames;var P=Object.getPrototypeOf,A=Object.prototype.hasOwnProperty;var B=(e,t)=>{for(var o in t)i(e,o,{get:t[o],enumerable:!0})},d=(e,t,o,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of w(t))!A.call(e,s)&&s!==o&&i(e,s,{get:()=>t[s],enumerable:!(r=C(t,s))||r.enumerable});return e};var l=(e,t,o)=>(o=e!=null?I(P(e)):{},d(t||!e||!e.__esModule?i(o,"default",{value:e,enumerable:!0}):o,e)),L=e=>d(i({},"__esModule",{value:!0}),e);var q={};B(q,{autoDeleteHandler:()=>S,handler:()=>F});module.exports=L(q);var h=require("@aws-sdk/client-s3");var y=l(require("https")),m=l(require("url")),a={sendHttpRequest:T,log:O,includeStackTraces:!0,userHandlerIndex:"./index"},p="AWSCDK::CustomResourceProviderFramework::CREATE_FAILED",k="AWSCDK::CustomResourceProviderFramework::MISSING_PHYSICAL_ID";function R(e){return async(t,o)=>{let r={...t,ResponseURL:"..."};if(a.log(JSON.stringify(r,void 0,2)),t.RequestType==="Delete"&&t.PhysicalResourceId===p){a.log("ignoring DELETE event caused by a failed CREATE event"),await u("SUCCESS",t);return}try{let s=await e(r,o),n=D(t,s);await u("SUCCESS",n)}catch(s){let n={...t,Reason:a.includeStackTraces?s.stack:s.message};n.PhysicalResourceId||(t.RequestType==="Create"?(a.log("CREATE failed, responding with a marker physical resource id so that the subsequent DELETE will be ignored"),n.PhysicalResourceId=p):a.log(`ERROR: Malformed event. "PhysicalResourceId" is required: ${JSON.stringify(t)}`)),await u("FAILED",n)}}}function D(e,t={}){let o=t.PhysicalResourceId??e.PhysicalResourceId??e.RequestId;if(e.RequestType==="Delete"&&o!==e.PhysicalResourceId)throw new Error(`DELETE: cannot change the physical resource ID from "${e.PhysicalResourceId}" to "${t.PhysicalResourceId}" during deletion`);return{...e,...t,PhysicalResourceId:o}}async function u(e,t){let o={Status:e,Reason:t.Reason??e,StackId:t.StackId,RequestId:t.RequestId,PhysicalResourceId:t.PhysicalResourceId||k,LogicalResourceId:t.LogicalResourceId,NoEcho:t.NoEcho,Data:t.Data},r=m.parse(t.ResponseURL),s=`${r.protocol}//${r.hostname}/${r.pathname}?***`;a.log("submit response to cloudformation",s,o);let n=JSON.stringify(o),f={hostname:r.hostname,path:r.path,method:"PUT",headers:{"content-type":"","content-length":Buffer.byteLength(n,"utf8")}};await b({attempts:5,sleep:1e3},a.sendHttpRequest)(f,n)}async function T(e,t){return new Promise((o,r)=>{try{let s=y.request(e,n=>{n.resume(),!n.statusCode||n.statusCode>=400?r(new Error(`Unsuccessful HTTP response: ${n.statusCode}`)):o()});s.on("error",r),s.write(t),s.end()}catch(s){r(s)}})}function O(e,...t){console.log(e,...t)}function b(e,t){return async(...o)=>{let r=e.attempts,s=e.sleep;for(;;)try{return await t(...o)}catch(n){if(r--<=0)throw n;await x(Math.floor(Math.random()*s)),s*=2}}}async function x(e){return new Promise(t=>setTimeout(t,e))}var g="aws-cdk:auto-delete-objects",H=JSON.stringify({Version:"2012-10-17",Statement:[]}),c=new h.S3({}),F=R(S);async function S(e){switch(e.RequestType){case"Create":return;case"Update":return{PhysicalResourceId:(await _(e)).PhysicalResourceId};case"Delete":return W(e.ResourceProperties?.BucketName)}}async function _(e){let t=e,o=t.OldResourceProperties?.BucketName;return{PhysicalResourceId:t.ResourceProperties?.BucketName??o}}async function U(e){try{let t=(await c.getBucketPolicy({Bucket:e}))?.Policy??H,o=JSON.parse(t);o.Statement.push({Principal:"*",Effect:"Deny",Action:["s3:PutObject"],Resource:[`arn:aws:s3:::${e}/*`]}),await c.putBucketPolicy({Bucket:e,Policy:JSON.stringify(o)})}catch(t){if(t.name==="NoSuchBucket")throw t;console.log(`Could not set new object deny policy on bucket '${e}' prior to deletion.`)}}async function E(e){let t=await c.listObjectVersions({Bucket:e}),o=[...t.Versions??[],...t.DeleteMarkers??[]];if(o.length===0)return;let r=o.map(s=>({Key:s.Key,VersionId:s.VersionId}));await c.deleteObjects({Bucket:e,Delete:{Objects:r}}),t?.IsTruncated&&await E(e)}async function W(e){if(!e)throw new Error("No BucketName was provided.");try{if(!await N(e)){console.log(`Bucket does not have '${g}' tag, skipping cleaning.`);return}await U(e),await E(e)}catch(t){if(t.name==="NoSuchBucket"){console.log(`Bucket '${e}' does not exist.`);return}throw t}}async function N(e){return(await c.getBucketTagging({Bucket:e})).TagSet?.some(o=>o.Key===g&&o.Value==="true")}0&&(module.exports={autoDeleteHandler,handler}); diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.d57a897c2081bda5ce88819548c8b944dff49e721e1f7f7e9e3dd8323e6ccb0d/index.js b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.d57a897c2081bda5ce88819548c8b944dff49e721e1f7f7e9e3dd8323e6ccb0d/index.js new file mode 100644 index 0000000000000..f9cc630970c96 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.d57a897c2081bda5ce88819548c8b944dff49e721e1f7f7e9e3dd8323e6ccb0d/index.js @@ -0,0 +1 @@ +"use strict";var I=Object.create;var i=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var S=Object.getOwnPropertyNames;var w=Object.getPrototypeOf,A=Object.prototype.hasOwnProperty;var P=(o,e)=>{for(var t in e)i(o,t,{get:e[t],enumerable:!0})},l=(o,e,t,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of S(e))!A.call(o,s)&&s!==t&&i(o,s,{get:()=>e[s],enumerable:!(n=g(e,s))||n.enumerable});return o};var m=(o,e,t)=>(t=o!=null?I(w(o)):{},l(e||!o||!o.__esModule?i(t,"default",{value:o,enumerable:!0}):t,o)),L=o=>l(i({},"__esModule",{value:!0}),o);var W={};P(W,{autoDeleteHandler:()=>E,handler:()=>_});module.exports=L(W);var c=require("@aws-sdk/client-lambda"),u=require("@aws-sdk/client-synthetics");var y=m(require("https")),R=m(require("url")),a={sendHttpRequest:T,log:F,includeStackTraces:!0,userHandlerIndex:"./index"},p="AWSCDK::CustomResourceProviderFramework::CREATE_FAILED",D="AWSCDK::CustomResourceProviderFramework::MISSING_PHYSICAL_ID";function C(o){return async(e,t)=>{let n={...e,ResponseURL:"..."};if(a.log(JSON.stringify(n,void 0,2)),e.RequestType==="Delete"&&e.PhysicalResourceId===p){a.log("ignoring DELETE event caused by a failed CREATE event"),await d("SUCCESS",e);return}try{let s=await o(n,t),r=b(e,s);await d("SUCCESS",r)}catch(s){let r={...e,Reason:a.includeStackTraces?s.stack:s.message};r.PhysicalResourceId||(e.RequestType==="Create"?(a.log("CREATE failed, responding with a marker physical resource id so that the subsequent DELETE will be ignored"),r.PhysicalResourceId=p):a.log(`ERROR: Malformed event. "PhysicalResourceId" is required: ${JSON.stringify(e)}`)),await d("FAILED",r)}}}function b(o,e={}){let t=e.PhysicalResourceId??o.PhysicalResourceId??o.RequestId;if(o.RequestType==="Delete"&&t!==o.PhysicalResourceId)throw new Error(`DELETE: cannot change the physical resource ID from "${o.PhysicalResourceId}" to "${e.PhysicalResourceId}" during deletion`);return{...o,...e,PhysicalResourceId:t}}async function d(o,e){let t={Status:o,Reason:e.Reason??o,StackId:e.StackId,RequestId:e.RequestId,PhysicalResourceId:e.PhysicalResourceId||D,LogicalResourceId:e.LogicalResourceId,NoEcho:e.NoEcho,Data:e.Data},n=R.parse(e.ResponseURL),s=`${n.protocol}//${n.hostname}/${n.pathname}?***`;a.log("submit response to cloudformation",s,t);let r=JSON.stringify(t),f={hostname:n.hostname,path:n.path,method:"PUT",headers:{"content-type":"","content-length":Buffer.byteLength(r,"utf8")}};await x({attempts:5,sleep:1e3},a.sendHttpRequest)(f,r)}async function T(o,e){return new Promise((t,n)=>{try{let s=y.request(o,r=>{r.resume(),!r.statusCode||r.statusCode>=400?n(new Error(`Unsuccessful HTTP response: ${r.statusCode}`)):t()});s.on("error",n),s.write(e),s.end()}catch(s){n(s)}})}function F(o,...e){console.log(o,...e)}function x(o,e){return async(...t)=>{let n=o.attempts,s=o.sleep;for(;;)try{return await e(...t)}catch(r){if(n--<=0)throw r;await N(Math.floor(Math.random()*s)),s*=2}}}async function N(o){return new Promise(e=>setTimeout(e,o))}var h="aws-cdk:auto-delete-underlying-resources",H=new c.LambdaClient({}),U=new u.SyntheticsClient({}),_=C(E);async function E(o){switch(o.RequestType){case"Create":return{PhyscialResourceId:o.ResourceProperties?.CanaryName};case"Update":return{PhysicalResourceId:(await k(o)).PhysicalResourceId};case"Delete":return q(o.ResourceProperties?.CanaryName)}}async function k(o){return{PhysicalResourceId:o.ResourceProperties?.CanaryName}}async function q(o){if(console.log(`Deleting lambda function associated with ${o}`),!o)throw new Error("No CanaryName was provided.");try{let e=await U.send(new u.GetCanaryCommand({Name:o}));if(e.Canary===void 0||e.Canary.Id===void 0)return;if(e.Canary.EngineArn===void 0)return;if(!O(e.Canary.Tags)){console.log(`Canary does not have '${h}' tag, skipping deletion.`);return}let t=e.Canary.EngineArn.split(":");t.at(-1)?.includes(e.Canary.Id)||t.pop();let n=t.join(":");console.log(`Deleting lambda ${n}`),await H.send(new c.DeleteFunctionCommand({FunctionName:n}))}catch(e){if(e.name!=="ResourceNotFoundException")throw e}}function O(o){return o?Object.keys(o).some(e=>e===h&&o[e]==="true"):!1}0&&(module.exports={autoDeleteHandler,handler}); diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json new file mode 100644 index 0000000000000..648f5c34f8e36 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json @@ -0,0 +1,45 @@ +{ + "version": "36.0.0", + "files": { + "96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d": { + "source": { + "path": "asset.96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d", + "packaging": "zip" + }, + "destinations": { + "current_account-current_region": { + "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}", + "objectKey": "96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d.zip", + "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}" + } + } + }, + "d57a897c2081bda5ce88819548c8b944dff49e721e1f7f7e9e3dd8323e6ccb0d": { + "source": { + "path": "asset.d57a897c2081bda5ce88819548c8b944dff49e721e1f7f7e9e3dd8323e6ccb0d", + "packaging": "zip" + }, + "destinations": { + "current_account-current_region": { + "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}", + "objectKey": "d57a897c2081bda5ce88819548c8b944dff49e721e1f7f7e9e3dd8323e6ccb0d.zip", + "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}" + } + } + }, + "83d99b596872351cd17d1d60c0a3a9101239b2549fc1cf97334218abfe09ef9e": { + "source": { + "path": "canary-artifact-s3-encryption.template.json", + "packaging": "file" + }, + "destinations": { + "current_account-current_region": { + "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}", + "objectKey": "83d99b596872351cd17d1d60c0a3a9101239b2549fc1cf97334218abfe09ef9e.json", + "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}" + } + } + } + }, + "dockerImages": {} +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json new file mode 100644 index 0000000000000..efdb339b3625f --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json @@ -0,0 +1,903 @@ +{ + "Resources": { + "MyTestBucket81062429": { + "Type": "AWS::S3::Bucket", + "Properties": { + "Tags": [ + { + "Key": "aws-cdk:auto-delete-objects", + "Value": "true" + } + ] + }, + "UpdateReplacePolicy": "Delete", + "DeletionPolicy": "Delete" + }, + "MyTestBucketPolicyE11AF29F": { + "Type": "AWS::S3::BucketPolicy", + "Properties": { + "Bucket": { + "Ref": "MyTestBucket81062429" + }, + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "s3:DeleteObject*", + "s3:GetBucket*", + "s3:List*", + "s3:PutBucketPolicy" + ], + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::GetAtt": [ + "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", + "Arn" + ] + } + }, + "Resource": [ + { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + }, + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + }, + "/*" + ] + ] + } + ] + } + ], + "Version": "2012-10-17" + } + } + }, + "MyTestBucketAutoDeleteObjectsCustomResource1E1AC890": { + "Type": "Custom::S3AutoDeleteObjects", + "Properties": { + "ServiceToken": { + "Fn::GetAtt": [ + "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F", + "Arn" + ] + }, + "BucketName": { + "Ref": "MyTestBucket81062429" + } + }, + "DependsOn": [ + "MyTestBucketPolicyE11AF29F" + ], + "UpdateReplacePolicy": "Delete", + "DeletionPolicy": "Delete" + }, + "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ] + }, + "ManagedPolicyArns": [ + { + "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + } + ] + } + }, + "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F": { + "Type": "AWS::Lambda::Function", + "Properties": { + "Code": { + "S3Bucket": { + "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" + }, + "S3Key": "96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d.zip" + }, + "Timeout": 900, + "MemorySize": 128, + "Handler": "index.handler", + "Role": { + "Fn::GetAtt": [ + "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", + "Arn" + ] + }, + "Runtime": "nodejs18.x", + "Description": { + "Fn::Join": [ + "", + [ + "Lambda function for auto-deleting objects in ", + { + "Ref": "MyTestBucket81062429" + }, + " S3 bucket." + ] + ] + } + }, + "DependsOn": [ + "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092" + ] + }, + "CanarySseS3ServiceRoleC3DFF4A1": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Policies": [ + { + "PolicyDocument": { + "Statement": [ + { + "Action": "s3:ListAllMyBuckets", + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": "s3:GetBucketLocation", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + } + }, + { + "Action": "s3:PutObject", + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + }, + "/integ/*" + ] + ] + } + }, + { + "Action": "cloudwatch:PutMetricData", + "Condition": { + "StringEquals": { + "cloudwatch:namespace": "CloudWatchSynthetics" + } + }, + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": [ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":logs:", + { + "Ref": "AWS::Region" + }, + ":", + { + "Ref": "AWS::AccountId" + }, + ":log-group:/aws/lambda/cwsyn-*" + ] + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "canaryPolicy" + } + ] + } + }, + "CanarySseS377E9DBF2": { + "Type": "AWS::Synthetics::Canary", + "Properties": { + "ArtifactConfig": { + "S3Encryption": { + "EncryptionMode": "SSE_S3" + } + }, + "ArtifactS3Location": { + "Fn::Join": [ + "", + [ + "s3://", + { + "Ref": "MyTestBucket81062429" + }, + "/integ" + ] + ] + }, + "Code": { + "Handler": "index.handler", + "Script": "\n exports.handler = async () => {\n console.log('hello world');\n };" + }, + "ExecutionRoleArn": { + "Fn::GetAtt": [ + "CanarySseS3ServiceRoleC3DFF4A1", + "Arn" + ] + }, + "Name": "canaryartifactseee471", + "RuntimeVersion": "syn-nodejs-puppeteer-7.0", + "Schedule": { + "DurationInSeconds": "0", + "Expression": "rate(1 minute)" + }, + "StartCanaryAfterCreation": true, + "Tags": [ + { + "Key": "aws-cdk:auto-delete-underlying-resources", + "Value": "true" + } + ] + } + }, + "CanarySseS3AutoDeleteUnderlyingResourcesCustomResource683951EB": { + "Type": "Custom::SyntheticsAutoDeleteUnderlyingResources", + "Properties": { + "ServiceToken": { + "Fn::GetAtt": [ + "CustomSyntheticsAutoDeleteUnderlyingResourcesCustomResourceProviderHandler26776D4E", + "Arn" + ] + }, + "CanaryName": { + "Ref": "CanarySseS377E9DBF2" + } + }, + "UpdateReplacePolicy": "Delete", + "DeletionPolicy": "Delete" + }, + "CustomSyntheticsAutoDeleteUnderlyingResourcesCustomResourceProviderRole2D11A112": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ] + }, + "ManagedPolicyArns": [ + { + "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + } + ], + "Policies": [ + { + "PolicyName": "Inline", + "PolicyDocument": { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "lambda:DeleteFunction" + ], + "Resource": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":lambda:", + { + "Ref": "AWS::Region" + }, + ":", + { + "Ref": "AWS::AccountId" + }, + ":function:cwsyn-*" + ] + ] + } + }, + { + "Effect": "Allow", + "Action": [ + "synthetics:GetCanary" + ], + "Resource": "*" + } + ] + } + } + ] + } + }, + "CustomSyntheticsAutoDeleteUnderlyingResourcesCustomResourceProviderHandler26776D4E": { + "Type": "AWS::Lambda::Function", + "Properties": { + "Code": { + "S3Bucket": { + "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" + }, + "S3Key": "d57a897c2081bda5ce88819548c8b944dff49e721e1f7f7e9e3dd8323e6ccb0d.zip" + }, + "Timeout": 900, + "MemorySize": 128, + "Handler": "index.handler", + "Role": { + "Fn::GetAtt": [ + "CustomSyntheticsAutoDeleteUnderlyingResourcesCustomResourceProviderRole2D11A112", + "Arn" + ] + }, + "Runtime": "nodejs18.x", + "Description": { + "Fn::Join": [ + "", + [ + "Lambda function for auto-deleting underlying resources created by ", + { + "Ref": "CanarySseS377E9DBF2" + }, + "." + ] + ] + } + }, + "DependsOn": [ + "CustomSyntheticsAutoDeleteUnderlyingResourcesCustomResourceProviderRole2D11A112" + ] + }, + "CanarySseKmsWithoutKeySettingServiceRole50435BBC": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Policies": [ + { + "PolicyDocument": { + "Statement": [ + { + "Action": "s3:ListAllMyBuckets", + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": "s3:GetBucketLocation", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + } + }, + { + "Action": "s3:PutObject", + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + }, + "/integ/*" + ] + ] + } + }, + { + "Action": "cloudwatch:PutMetricData", + "Condition": { + "StringEquals": { + "cloudwatch:namespace": "CloudWatchSynthetics" + } + }, + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": [ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":logs:", + { + "Ref": "AWS::Region" + }, + ":", + { + "Ref": "AWS::AccountId" + }, + ":log-group:/aws/lambda/cwsyn-*" + ] + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "canaryPolicy" + } + ] + } + }, + "CanarySseKmsWithoutKeySettingServiceRoleDefaultPolicyAC49E578": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "kms:Decrypt", + "kms:Encrypt", + "kms:GenerateDataKey*", + "kms:ReEncrypt*" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "CanarySseKmsWithoutKeySettingKey11BDE817", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "CanarySseKmsWithoutKeySettingServiceRoleDefaultPolicyAC49E578", + "Roles": [ + { + "Ref": "CanarySseKmsWithoutKeySettingServiceRole50435BBC" + } + ] + } + }, + "CanarySseKmsWithoutKeySettingKey11BDE817": { + "Type": "AWS::KMS::Key", + "Properties": { + "Description": "Created by canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting", + "KeyPolicy": { + "Statement": [ + { + "Action": "kms:*", + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::", + { + "Ref": "AWS::AccountId" + }, + ":root" + ] + ] + } + }, + "Resource": "*" + } + ], + "Version": "2012-10-17" + } + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain" + }, + "CanarySseKmsWithoutKeySettingD8C26A32": { + "Type": "AWS::Synthetics::Canary", + "Properties": { + "ArtifactConfig": { + "S3Encryption": { + "EncryptionMode": "SSE_KMS", + "KmsKeyArn": { + "Fn::GetAtt": [ + "CanarySseKmsWithoutKeySettingKey11BDE817", + "Arn" + ] + } + } + }, + "ArtifactS3Location": { + "Fn::Join": [ + "", + [ + "s3://", + { + "Ref": "MyTestBucket81062429" + }, + "/integ" + ] + ] + }, + "Code": { + "Handler": "index.handler", + "Script": "\n exports.handler = async () => {\n console.log('hello world');\n };" + }, + "ExecutionRoleArn": { + "Fn::GetAtt": [ + "CanarySseKmsWithoutKeySettingServiceRole50435BBC", + "Arn" + ] + }, + "Name": "canaryartifactsefa4b6", + "RuntimeVersion": "syn-nodejs-puppeteer-7.0", + "Schedule": { + "DurationInSeconds": "0", + "Expression": "rate(1 minute)" + }, + "StartCanaryAfterCreation": true, + "Tags": [ + { + "Key": "aws-cdk:auto-delete-underlying-resources", + "Value": "true" + } + ] + } + }, + "CanarySseKmsWithoutKeySettingAutoDeleteUnderlyingResourcesCustomResourceB288EFE0": { + "Type": "Custom::SyntheticsAutoDeleteUnderlyingResources", + "Properties": { + "ServiceToken": { + "Fn::GetAtt": [ + "CustomSyntheticsAutoDeleteUnderlyingResourcesCustomResourceProviderHandler26776D4E", + "Arn" + ] + }, + "CanaryName": { + "Ref": "CanarySseKmsWithoutKeySettingD8C26A32" + } + }, + "UpdateReplacePolicy": "Delete", + "DeletionPolicy": "Delete" + }, + "Key961B73FD": { + "Type": "AWS::KMS::Key", + "Properties": { + "KeyPolicy": { + "Statement": [ + { + "Action": "kms:*", + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::", + { + "Ref": "AWS::AccountId" + }, + ":root" + ] + ] + } + }, + "Resource": "*" + } + ], + "Version": "2012-10-17" + } + }, + "UpdateReplacePolicy": "Delete", + "DeletionPolicy": "Delete" + }, + "CanarySseKmsWithServiceRoleDE325788": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Policies": [ + { + "PolicyDocument": { + "Statement": [ + { + "Action": "s3:ListAllMyBuckets", + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": "s3:GetBucketLocation", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + } + }, + { + "Action": "s3:PutObject", + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + }, + "/integ/*" + ] + ] + } + }, + { + "Action": "cloudwatch:PutMetricData", + "Condition": { + "StringEquals": { + "cloudwatch:namespace": "CloudWatchSynthetics" + } + }, + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": [ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":logs:", + { + "Ref": "AWS::Region" + }, + ":", + { + "Ref": "AWS::AccountId" + }, + ":log-group:/aws/lambda/cwsyn-*" + ] + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "canaryPolicy" + } + ] + } + }, + "CanarySseKmsWithServiceRoleDefaultPolicyBD214DF4": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "kms:Decrypt", + "kms:Encrypt", + "kms:GenerateDataKey*", + "kms:ReEncrypt*" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "Key961B73FD", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "CanarySseKmsWithServiceRoleDefaultPolicyBD214DF4", + "Roles": [ + { + "Ref": "CanarySseKmsWithServiceRoleDE325788" + } + ] + } + }, + "CanarySseKmsWith1F191227": { + "Type": "AWS::Synthetics::Canary", + "Properties": { + "ArtifactConfig": { + "S3Encryption": { + "EncryptionMode": "SSE_KMS", + "KmsKeyArn": { + "Fn::GetAtt": [ + "Key961B73FD", + "Arn" + ] + } + } + }, + "ArtifactS3Location": { + "Fn::Join": [ + "", + [ + "s3://", + { + "Ref": "MyTestBucket81062429" + }, + "/integ" + ] + ] + }, + "Code": { + "Handler": "index.handler", + "Script": "\n exports.handler = async () => {\n console.log('hello world');\n };" + }, + "ExecutionRoleArn": { + "Fn::GetAtt": [ + "CanarySseKmsWithServiceRoleDE325788", + "Arn" + ] + }, + "Name": "canaryartifacts4881f3", + "RuntimeVersion": "syn-nodejs-puppeteer-7.0", + "Schedule": { + "DurationInSeconds": "0", + "Expression": "rate(1 minute)" + }, + "StartCanaryAfterCreation": true, + "Tags": [ + { + "Key": "aws-cdk:auto-delete-underlying-resources", + "Value": "true" + } + ] + } + }, + "CanarySseKmsWithAutoDeleteUnderlyingResourcesCustomResource4F111E39": { + "Type": "Custom::SyntheticsAutoDeleteUnderlyingResources", + "Properties": { + "ServiceToken": { + "Fn::GetAtt": [ + "CustomSyntheticsAutoDeleteUnderlyingResourcesCustomResourceProviderHandler26776D4E", + "Arn" + ] + }, + "CanaryName": { + "Ref": "CanarySseKmsWith1F191227" + } + }, + "UpdateReplacePolicy": "Delete", + "DeletionPolicy": "Delete" + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]" + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/cdk.out b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/cdk.out new file mode 100644 index 0000000000000..1f0068d32659a --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/cdk.out @@ -0,0 +1 @@ +{"version":"36.0.0"} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/integ.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/integ.json new file mode 100644 index 0000000000000..0546bb1684300 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/integ.json @@ -0,0 +1,12 @@ +{ + "version": "36.0.0", + "testCases": { + "IntegCanaryTest/DefaultTest": { + "stacks": [ + "canary-artifact-s3-encryption" + ], + "assertionStack": "IntegCanaryTest/DefaultTest/DeployAssert", + "assertionStackName": "IntegCanaryTestDefaultTestDeployAssert3AD5A094" + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json new file mode 100644 index 0000000000000..7e7ced9cc20b7 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json @@ -0,0 +1,227 @@ +{ + "version": "36.0.0", + "artifacts": { + "canary-artifact-s3-encryption.assets": { + "type": "cdk:asset-manifest", + "properties": { + "file": "canary-artifact-s3-encryption.assets.json", + "requiresBootstrapStackVersion": 6, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version" + } + }, + "canary-artifact-s3-encryption": { + "type": "aws:cloudformation:stack", + "environment": "aws://unknown-account/unknown-region", + "properties": { + "templateFile": "canary-artifact-s3-encryption.template.json", + "terminationProtection": false, + "validateOnSynth": false, + "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}", + "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}", + "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/83d99b596872351cd17d1d60c0a3a9101239b2549fc1cf97334218abfe09ef9e.json", + "requiresBootstrapStackVersion": 6, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version", + "additionalDependencies": [ + "canary-artifact-s3-encryption.assets" + ], + "lookupRole": { + "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}", + "requiresBootstrapStackVersion": 8, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version" + } + }, + "dependencies": [ + "canary-artifact-s3-encryption.assets" + ], + "metadata": { + "/canary-artifact-s3-encryption/MyTestBucket/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "MyTestBucket81062429" + } + ], + "/canary-artifact-s3-encryption/MyTestBucket/Policy/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "MyTestBucketPolicyE11AF29F" + } + ], + "/canary-artifact-s3-encryption/MyTestBucket/AutoDeleteObjectsCustomResource/Default": [ + { + "type": "aws:cdk:logicalId", + "data": "MyTestBucketAutoDeleteObjectsCustomResource1E1AC890" + } + ], + "/canary-artifact-s3-encryption/Custom::S3AutoDeleteObjectsCustomResourceProvider/Role": [ + { + "type": "aws:cdk:logicalId", + "data": "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092" + } + ], + "/canary-artifact-s3-encryption/Custom::S3AutoDeleteObjectsCustomResourceProvider/Handler": [ + { + "type": "aws:cdk:logicalId", + "data": "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F" + } + ], + "/canary-artifact-s3-encryption/CanarySseS3/ServiceRole/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseS3ServiceRoleC3DFF4A1" + } + ], + "/canary-artifact-s3-encryption/CanarySseS3/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseS377E9DBF2" + } + ], + "/canary-artifact-s3-encryption/CanarySseS3/AutoDeleteUnderlyingResourcesCustomResource/Default": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseS3AutoDeleteUnderlyingResourcesCustomResource683951EB" + } + ], + "/canary-artifact-s3-encryption/Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider/Role": [ + { + "type": "aws:cdk:logicalId", + "data": "CustomSyntheticsAutoDeleteUnderlyingResourcesCustomResourceProviderRole2D11A112" + } + ], + "/canary-artifact-s3-encryption/Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider/Handler": [ + { + "type": "aws:cdk:logicalId", + "data": "CustomSyntheticsAutoDeleteUnderlyingResourcesCustomResourceProviderHandler26776D4E" + } + ], + "/canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/ServiceRole/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseKmsWithoutKeySettingServiceRole50435BBC" + } + ], + "/canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/ServiceRole/DefaultPolicy/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseKmsWithoutKeySettingServiceRoleDefaultPolicyAC49E578" + } + ], + "/canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/Key/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseKmsWithoutKeySettingKey11BDE817" + } + ], + "/canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseKmsWithoutKeySettingD8C26A32" + } + ], + "/canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/AutoDeleteUnderlyingResourcesCustomResource/Default": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseKmsWithoutKeySettingAutoDeleteUnderlyingResourcesCustomResourceB288EFE0" + } + ], + "/canary-artifact-s3-encryption/Key/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "Key961B73FD" + } + ], + "/canary-artifact-s3-encryption/CanarySseKmsWith/ServiceRole/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseKmsWithServiceRoleDE325788" + } + ], + "/canary-artifact-s3-encryption/CanarySseKmsWith/ServiceRole/DefaultPolicy/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseKmsWithServiceRoleDefaultPolicyBD214DF4" + } + ], + "/canary-artifact-s3-encryption/CanarySseKmsWith/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseKmsWith1F191227" + } + ], + "/canary-artifact-s3-encryption/CanarySseKmsWith/AutoDeleteUnderlyingResourcesCustomResource/Default": [ + { + "type": "aws:cdk:logicalId", + "data": "CanarySseKmsWithAutoDeleteUnderlyingResourcesCustomResource4F111E39" + } + ], + "/canary-artifact-s3-encryption/BootstrapVersion": [ + { + "type": "aws:cdk:logicalId", + "data": "BootstrapVersion" + } + ], + "/canary-artifact-s3-encryption/CheckBootstrapVersion": [ + { + "type": "aws:cdk:logicalId", + "data": "CheckBootstrapVersion" + } + ] + }, + "displayName": "canary-artifact-s3-encryption" + }, + "IntegCanaryTestDefaultTestDeployAssert3AD5A094.assets": { + "type": "cdk:asset-manifest", + "properties": { + "file": "IntegCanaryTestDefaultTestDeployAssert3AD5A094.assets.json", + "requiresBootstrapStackVersion": 6, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version" + } + }, + "IntegCanaryTestDefaultTestDeployAssert3AD5A094": { + "type": "aws:cloudformation:stack", + "environment": "aws://unknown-account/unknown-region", + "properties": { + "templateFile": "IntegCanaryTestDefaultTestDeployAssert3AD5A094.template.json", + "terminationProtection": false, + "validateOnSynth": false, + "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}", + "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}", + "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json", + "requiresBootstrapStackVersion": 6, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version", + "additionalDependencies": [ + "IntegCanaryTestDefaultTestDeployAssert3AD5A094.assets" + ], + "lookupRole": { + "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}", + "requiresBootstrapStackVersion": 8, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version" + } + }, + "dependencies": [ + "IntegCanaryTestDefaultTestDeployAssert3AD5A094.assets" + ], + "metadata": { + "/IntegCanaryTest/DefaultTest/DeployAssert/BootstrapVersion": [ + { + "type": "aws:cdk:logicalId", + "data": "BootstrapVersion" + } + ], + "/IntegCanaryTest/DefaultTest/DeployAssert/CheckBootstrapVersion": [ + { + "type": "aws:cdk:logicalId", + "data": "CheckBootstrapVersion" + } + ] + }, + "displayName": "IntegCanaryTest/DefaultTest/DeployAssert" + }, + "Tree": { + "type": "cdk:tree", + "properties": { + "file": "tree.json" + } + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/tree.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/tree.json new file mode 100644 index 0000000000000..90a88a1478dc0 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/tree.json @@ -0,0 +1,1114 @@ +{ + "version": "tree-0.1", + "tree": { + "id": "App", + "path": "", + "children": { + "canary-artifact-s3-encryption": { + "id": "canary-artifact-s3-encryption", + "path": "canary-artifact-s3-encryption", + "children": { + "MyTestBucket": { + "id": "MyTestBucket", + "path": "canary-artifact-s3-encryption/MyTestBucket", + "children": { + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/MyTestBucket/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::S3::Bucket", + "aws:cdk:cloudformation:props": { + "tags": [ + { + "key": "aws-cdk:auto-delete-objects", + "value": "true" + } + ] + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Policy": { + "id": "Policy", + "path": "canary-artifact-s3-encryption/MyTestBucket/Policy", + "children": { + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/MyTestBucket/Policy/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::S3::BucketPolicy", + "aws:cdk:cloudformation:props": { + "bucket": { + "Ref": "MyTestBucket81062429" + }, + "policyDocument": { + "Statement": [ + { + "Action": [ + "s3:DeleteObject*", + "s3:GetBucket*", + "s3:List*", + "s3:PutBucketPolicy" + ], + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::GetAtt": [ + "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", + "Arn" + ] + } + }, + "Resource": [ + { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + }, + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + }, + "/*" + ] + ] + } + ] + } + ], + "Version": "2012-10-17" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "AutoDeleteObjectsCustomResource": { + "id": "AutoDeleteObjectsCustomResource", + "path": "canary-artifact-s3-encryption/MyTestBucket/AutoDeleteObjectsCustomResource", + "children": { + "Default": { + "id": "Default", + "path": "canary-artifact-s3-encryption/MyTestBucket/AutoDeleteObjectsCustomResource/Default", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Custom::S3AutoDeleteObjectsCustomResourceProvider": { + "id": "Custom::S3AutoDeleteObjectsCustomResourceProvider", + "path": "canary-artifact-s3-encryption/Custom::S3AutoDeleteObjectsCustomResourceProvider", + "children": { + "Staging": { + "id": "Staging", + "path": "canary-artifact-s3-encryption/Custom::S3AutoDeleteObjectsCustomResourceProvider/Staging", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Role": { + "id": "Role", + "path": "canary-artifact-s3-encryption/Custom::S3AutoDeleteObjectsCustomResourceProvider/Role", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Handler": { + "id": "Handler", + "path": "canary-artifact-s3-encryption/Custom::S3AutoDeleteObjectsCustomResourceProvider/Handler", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "CanarySseS3": { + "id": "CanarySseS3", + "path": "canary-artifact-s3-encryption/CanarySseS3", + "children": { + "ServiceRole": { + "id": "ServiceRole", + "path": "canary-artifact-s3-encryption/CanarySseS3/ServiceRole", + "children": { + "ImportServiceRole": { + "id": "ImportServiceRole", + "path": "canary-artifact-s3-encryption/CanarySseS3/ServiceRole/ImportServiceRole", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/CanarySseS3/ServiceRole/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Role", + "aws:cdk:cloudformation:props": { + "assumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "policies": [ + { + "policyName": "canaryPolicy", + "policyDocument": { + "Statement": [ + { + "Action": "s3:ListAllMyBuckets", + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": "s3:GetBucketLocation", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + } + }, + { + "Action": "s3:PutObject", + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + }, + "/integ/*" + ] + ] + } + }, + { + "Action": "cloudwatch:PutMetricData", + "Condition": { + "StringEquals": { + "cloudwatch:namespace": "CloudWatchSynthetics" + } + }, + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": [ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":logs:", + { + "Ref": "AWS::Region" + }, + ":", + { + "Ref": "AWS::AccountId" + }, + ":log-group:/aws/lambda/cwsyn-*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + ] + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/CanarySseS3/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::Synthetics::Canary", + "aws:cdk:cloudformation:props": { + "artifactConfig": { + "s3Encryption": { + "encryptionMode": "SSE_S3" + } + }, + "artifactS3Location": { + "Fn::Join": [ + "", + [ + "s3://", + { + "Ref": "MyTestBucket81062429" + }, + "/integ" + ] + ] + }, + "code": { + "handler": "index.handler", + "script": "\n exports.handler = async () => {\n console.log('hello world');\n };" + }, + "executionRoleArn": { + "Fn::GetAtt": [ + "CanarySseS3ServiceRoleC3DFF4A1", + "Arn" + ] + }, + "name": "canaryartifactseee471", + "runtimeVersion": "syn-nodejs-puppeteer-7.0", + "schedule": { + "durationInSeconds": "0", + "expression": "rate(1 minute)" + }, + "startCanaryAfterCreation": true, + "tags": [ + { + "key": "aws-cdk:auto-delete-underlying-resources", + "value": "true" + } + ] + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "AutoDeleteUnderlyingResourcesCustomResource": { + "id": "AutoDeleteUnderlyingResourcesCustomResource", + "path": "canary-artifact-s3-encryption/CanarySseS3/AutoDeleteUnderlyingResourcesCustomResource", + "children": { + "Default": { + "id": "Default", + "path": "canary-artifact-s3-encryption/CanarySseS3/AutoDeleteUnderlyingResourcesCustomResource/Default", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider": { + "id": "Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider", + "path": "canary-artifact-s3-encryption/Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider", + "children": { + "Staging": { + "id": "Staging", + "path": "canary-artifact-s3-encryption/Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider/Staging", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Role": { + "id": "Role", + "path": "canary-artifact-s3-encryption/Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider/Role", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Handler": { + "id": "Handler", + "path": "canary-artifact-s3-encryption/Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider/Handler", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "CanarySseKmsWithoutKeySetting": { + "id": "CanarySseKmsWithoutKeySetting", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting", + "children": { + "ServiceRole": { + "id": "ServiceRole", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/ServiceRole", + "children": { + "ImportServiceRole": { + "id": "ImportServiceRole", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/ServiceRole/ImportServiceRole", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/ServiceRole/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Role", + "aws:cdk:cloudformation:props": { + "assumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "policies": [ + { + "policyName": "canaryPolicy", + "policyDocument": { + "Statement": [ + { + "Action": "s3:ListAllMyBuckets", + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": "s3:GetBucketLocation", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + } + }, + { + "Action": "s3:PutObject", + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + }, + "/integ/*" + ] + ] + } + }, + { + "Action": "cloudwatch:PutMetricData", + "Condition": { + "StringEquals": { + "cloudwatch:namespace": "CloudWatchSynthetics" + } + }, + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": [ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":logs:", + { + "Ref": "AWS::Region" + }, + ":", + { + "Ref": "AWS::AccountId" + }, + ":log-group:/aws/lambda/cwsyn-*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + ] + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "DefaultPolicy": { + "id": "DefaultPolicy", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/ServiceRole/DefaultPolicy", + "children": { + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/ServiceRole/DefaultPolicy/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Policy", + "aws:cdk:cloudformation:props": { + "policyDocument": { + "Statement": [ + { + "Action": [ + "kms:Decrypt", + "kms:Encrypt", + "kms:GenerateDataKey*", + "kms:ReEncrypt*" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "CanarySseKmsWithoutKeySettingKey11BDE817", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "policyName": "CanarySseKmsWithoutKeySettingServiceRoleDefaultPolicyAC49E578", + "roles": [ + { + "Ref": "CanarySseKmsWithoutKeySettingServiceRole50435BBC" + } + ] + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Key": { + "id": "Key", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/Key", + "children": { + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/Key/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::KMS::Key", + "aws:cdk:cloudformation:props": { + "description": "Created by canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting", + "keyPolicy": { + "Statement": [ + { + "Action": "kms:*", + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::", + { + "Ref": "AWS::AccountId" + }, + ":root" + ] + ] + } + }, + "Resource": "*" + } + ], + "Version": "2012-10-17" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::Synthetics::Canary", + "aws:cdk:cloudformation:props": { + "artifactConfig": { + "s3Encryption": { + "encryptionMode": "SSE_KMS", + "kmsKeyArn": { + "Fn::GetAtt": [ + "CanarySseKmsWithoutKeySettingKey11BDE817", + "Arn" + ] + } + } + }, + "artifactS3Location": { + "Fn::Join": [ + "", + [ + "s3://", + { + "Ref": "MyTestBucket81062429" + }, + "/integ" + ] + ] + }, + "code": { + "handler": "index.handler", + "script": "\n exports.handler = async () => {\n console.log('hello world');\n };" + }, + "executionRoleArn": { + "Fn::GetAtt": [ + "CanarySseKmsWithoutKeySettingServiceRole50435BBC", + "Arn" + ] + }, + "name": "canaryartifactsefa4b6", + "runtimeVersion": "syn-nodejs-puppeteer-7.0", + "schedule": { + "durationInSeconds": "0", + "expression": "rate(1 minute)" + }, + "startCanaryAfterCreation": true, + "tags": [ + { + "key": "aws-cdk:auto-delete-underlying-resources", + "value": "true" + } + ] + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "AutoDeleteUnderlyingResourcesCustomResource": { + "id": "AutoDeleteUnderlyingResourcesCustomResource", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/AutoDeleteUnderlyingResourcesCustomResource", + "children": { + "Default": { + "id": "Default", + "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/AutoDeleteUnderlyingResourcesCustomResource/Default", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Key": { + "id": "Key", + "path": "canary-artifact-s3-encryption/Key", + "children": { + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/Key/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::KMS::Key", + "aws:cdk:cloudformation:props": { + "keyPolicy": { + "Statement": [ + { + "Action": "kms:*", + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::", + { + "Ref": "AWS::AccountId" + }, + ":root" + ] + ] + } + }, + "Resource": "*" + } + ], + "Version": "2012-10-17" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "CanarySseKmsWith": { + "id": "CanarySseKmsWith", + "path": "canary-artifact-s3-encryption/CanarySseKmsWith", + "children": { + "ServiceRole": { + "id": "ServiceRole", + "path": "canary-artifact-s3-encryption/CanarySseKmsWith/ServiceRole", + "children": { + "ImportServiceRole": { + "id": "ImportServiceRole", + "path": "canary-artifact-s3-encryption/CanarySseKmsWith/ServiceRole/ImportServiceRole", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/CanarySseKmsWith/ServiceRole/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Role", + "aws:cdk:cloudformation:props": { + "assumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "policies": [ + { + "policyName": "canaryPolicy", + "policyDocument": { + "Statement": [ + { + "Action": "s3:ListAllMyBuckets", + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": "s3:GetBucketLocation", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + } + }, + { + "Action": "s3:PutObject", + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "MyTestBucket81062429", + "Arn" + ] + }, + "/integ/*" + ] + ] + } + }, + { + "Action": "cloudwatch:PutMetricData", + "Condition": { + "StringEquals": { + "cloudwatch:namespace": "CloudWatchSynthetics" + } + }, + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": [ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Effect": "Allow", + "Resource": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":logs:", + { + "Ref": "AWS::Region" + }, + ":", + { + "Ref": "AWS::AccountId" + }, + ":log-group:/aws/lambda/cwsyn-*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + ] + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "DefaultPolicy": { + "id": "DefaultPolicy", + "path": "canary-artifact-s3-encryption/CanarySseKmsWith/ServiceRole/DefaultPolicy", + "children": { + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/CanarySseKmsWith/ServiceRole/DefaultPolicy/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Policy", + "aws:cdk:cloudformation:props": { + "policyDocument": { + "Statement": [ + { + "Action": [ + "kms:Decrypt", + "kms:Encrypt", + "kms:GenerateDataKey*", + "kms:ReEncrypt*" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "Key961B73FD", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "policyName": "CanarySseKmsWithServiceRoleDefaultPolicyBD214DF4", + "roles": [ + { + "Ref": "CanarySseKmsWithServiceRoleDE325788" + } + ] + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "Resource": { + "id": "Resource", + "path": "canary-artifact-s3-encryption/CanarySseKmsWith/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::Synthetics::Canary", + "aws:cdk:cloudformation:props": { + "artifactConfig": { + "s3Encryption": { + "encryptionMode": "SSE_KMS", + "kmsKeyArn": { + "Fn::GetAtt": [ + "Key961B73FD", + "Arn" + ] + } + } + }, + "artifactS3Location": { + "Fn::Join": [ + "", + [ + "s3://", + { + "Ref": "MyTestBucket81062429" + }, + "/integ" + ] + ] + }, + "code": { + "handler": "index.handler", + "script": "\n exports.handler = async () => {\n console.log('hello world');\n };" + }, + "executionRoleArn": { + "Fn::GetAtt": [ + "CanarySseKmsWithServiceRoleDE325788", + "Arn" + ] + }, + "name": "canaryartifacts4881f3", + "runtimeVersion": "syn-nodejs-puppeteer-7.0", + "schedule": { + "durationInSeconds": "0", + "expression": "rate(1 minute)" + }, + "startCanaryAfterCreation": true, + "tags": [ + { + "key": "aws-cdk:auto-delete-underlying-resources", + "value": "true" + } + ] + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "AutoDeleteUnderlyingResourcesCustomResource": { + "id": "AutoDeleteUnderlyingResourcesCustomResource", + "path": "canary-artifact-s3-encryption/CanarySseKmsWith/AutoDeleteUnderlyingResourcesCustomResource", + "children": { + "Default": { + "id": "Default", + "path": "canary-artifact-s3-encryption/CanarySseKmsWith/AutoDeleteUnderlyingResourcesCustomResource/Default", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "BootstrapVersion": { + "id": "BootstrapVersion", + "path": "canary-artifact-s3-encryption/BootstrapVersion", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "CheckBootstrapVersion": { + "id": "CheckBootstrapVersion", + "path": "canary-artifact-s3-encryption/CheckBootstrapVersion", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "IntegCanaryTest": { + "id": "IntegCanaryTest", + "path": "IntegCanaryTest", + "children": { + "DefaultTest": { + "id": "DefaultTest", + "path": "IntegCanaryTest/DefaultTest", + "children": { + "Default": { + "id": "Default", + "path": "IntegCanaryTest/DefaultTest/Default", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "DeployAssert": { + "id": "DeployAssert", + "path": "IntegCanaryTest/DefaultTest/DeployAssert", + "children": { + "BootstrapVersion": { + "id": "BootstrapVersion", + "path": "IntegCanaryTest/DefaultTest/DeployAssert/BootstrapVersion", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + }, + "CheckBootstrapVersion": { + "id": "CheckBootstrapVersion", + "path": "IntegCanaryTest/DefaultTest/DeployAssert/CheckBootstrapVersion", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/integ-tests-alpha.IntegTestCase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/integ-tests-alpha.IntegTest", + "version": "0.0.0" + } + }, + "Tree": { + "id": "Tree", + "path": "Tree", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } + }, + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.3.0" + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts new file mode 100644 index 0000000000000..a324b8e874205 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts @@ -0,0 +1,76 @@ +/// !cdk-integ canary-one +import * as s3 from 'aws-cdk-lib/aws-s3'; +import * as cdk from 'aws-cdk-lib/core'; +import { Canary, Cleanup, Code, EncryptionMode, Runtime, Schedule, Test } from 'aws-cdk-lib/aws-synthetics'; +import { IntegTest } from '@aws-cdk/integ-tests-alpha'; +import { RemovalPolicy } from 'aws-cdk-lib'; +import { Key } from 'aws-cdk-lib/aws-kms'; + +const app = new cdk.App(); +const stack = new cdk.Stack(app, 'canary-artifact-s3-encryption'); + +const bucket = new s3.Bucket(stack, 'MyTestBucket', { + removalPolicy: RemovalPolicy.DESTROY, + autoDeleteObjects: true, +}); +const prefix = 'integ'; + +new Canary(stack, 'CanarySseS3', { + test: Test.custom({ + handler: 'index.handler', + code: Code.fromInline(` + exports.handler = async () => { + console.log(\'hello world\'); + };`), + }), + schedule: Schedule.rate(cdk.Duration.minutes(1)), + artifactsBucketLocation: { bucket, prefix }, + runtime: Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + cleanup: Cleanup.LAMBDA, + artifactS3Encryption: { + encryptionMode: EncryptionMode.S3_MANAGED, + }, +}); + +new Canary(stack, 'CanarySseKmsWithoutKeySetting', { + test: Test.custom({ + handler: 'index.handler', + code: Code.fromInline(` + exports.handler = async () => { + console.log(\'hello world\'); + };`), + }), + schedule: Schedule.rate(cdk.Duration.minutes(1)), + artifactsBucketLocation: { bucket, prefix }, + runtime: Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + cleanup: Cleanup.LAMBDA, + artifactS3Encryption: { + encryptionMode: EncryptionMode.KMS, + }, +}); + +const encryptKey = new Key(stack, 'Key', { removalPolicy: RemovalPolicy.DESTROY }); + +new Canary(stack, 'CanarySseKmsWith', { + test: Test.custom({ + handler: 'index.handler', + code: Code.fromInline(` + exports.handler = async () => { + console.log(\'hello world\'); + };`), + }), + schedule: Schedule.rate(cdk.Duration.minutes(1)), + artifactsBucketLocation: { bucket, prefix }, + runtime: Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + cleanup: Cleanup.LAMBDA, + artifactS3Encryption: { + encryptionMode: EncryptionMode.KMS, + kmsKey: encryptKey, + }, +}); + +new IntegTest(app, 'IntegCanaryTest', { + testCases: [stack], +}); + +app.synth(); diff --git a/packages/aws-cdk-lib/aws-synthetics/README.md b/packages/aws-cdk-lib/aws-synthetics/README.md index c4ec669708416..cc6eebfb393d0 100644 --- a/packages/aws-cdk-lib/aws-synthetics/README.md +++ b/packages/aws-cdk-lib/aws-synthetics/README.md @@ -114,7 +114,7 @@ const canary = new synthetics.Canary(this, 'Canary', { }); ``` -> Note: To properly clean up your canary on deletion, you still have to manually delete other resources +> Note: To properly clean up your canary on deletion, you still have to manually delete other resources > like S3 buckets and CloudWatch logs. ### Configuring the Canary Script @@ -248,3 +248,31 @@ const canary = new synthetics.Canary(this, 'MyCanary', { }], }); ``` + +Canary artifacts are encrypted at rest using an AWS-managed key by default. + +Additionally, you can choose the encryption options SSE-S3 or SSE-KMS by setting the `artifactS3Encryption` property. + +You can also supply your own external KMS key by specifying the `kmsKey` property. If you don't, a KMS key will be automatically created and associated with the canary. + +```ts +import * as kms from 'aws-cdk-lib/aws-kms'; + +const key = new kms.Key(stack, 'myKey'); + +const canary = new synthetics.Canary(this, 'MyCanary', { + schedule: synthetics.Schedule.rate(Duration.minutes(5)), + test: synthetics.Test.custom({ + code: synthetics.Code.fromAsset(path.join(__dirname, 'canary')), + handler: 'index.handler', + }), + runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + artifactsBucketLifecycleRules: [{ + expiration: Duration.days(30), + artifactS3Encryption: { + encryptionMode: synthetics.EncryptionMode.KMS, + kmsKey: key, // external KMS Key set + }, + }], +}); +``` \ No newline at end of file diff --git a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts index 2c49036174bf2..deeca18893c8a 100644 --- a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts +++ b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts @@ -1,13 +1,14 @@ import * as crypto from 'crypto'; import { Construct } from 'constructs'; import { Code } from './code'; -import { Runtime } from './runtime'; +import { Runtime, RuntimeFamily } from './runtime'; import { Schedule } from './schedule'; import { CloudWatchSyntheticsMetrics } from './synthetics-canned-metrics.generated'; import { CfnCanary } from './synthetics.generated'; import { Metric, MetricOptions, MetricProps } from '../../aws-cloudwatch'; import * as ec2 from '../../aws-ec2'; import * as iam from '../../aws-iam'; +import * as kms from '../../aws-kms'; import * as s3 from '../../aws-s3'; import * as cdk from '../../core'; import { AutoDeleteUnderlyingResourcesProvider } from '../../custom-resource-handlers/dist/aws-synthetics/auto-delete-underlying-resources-provider.generated'; @@ -229,6 +230,48 @@ export interface CanaryProps { * @default - no rules applied to the generated bucket. */ readonly artifactsBucketLifecycleRules?: Array; + + /** + * Canary Artifacts in S3 encryption configuration. + * Artifact encryption is only supported for Node.js runtime. + * + * @default - Artifacts are encrypted at rest using an AWS managed key + * + * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_artifact_encryption.html + */ + readonly artifactS3Encryption?: ArtifactS3Encryption; +} + +/** + * Canary Artifacts in S3 encryption configuration. + */ +export interface ArtifactS3Encryption { + /** + * Encryption mode. + * @default - Artifacts are encrypted at rest using an AWS managed key + */ + readonly encryptionMode?: EncryptionMode; + + /** + * The KMS key to be used to encrypt the data. + * @default - no kms key if mode = S3_MANAGED. + * A key will be created if one is not provided and mode = KMS. + */ + readonly kmsKey?: kms.IKey; +} + +export enum EncryptionMode { + /** + * Server-side encryption (SSE) with an Amazon S3-managed key. + * + */ + S3_MANAGED = 'SSE_S3', + + /** + * Server-side encryption (SSE) with an AWS KMS customer managed key. + * + */ + KMS = 'SSE_KMS', } /** @@ -263,6 +306,11 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { */ public readonly artifactsBucket: s3.IBucket; + /** + * Optional KMS encryption key associated with this canary. + */ + public readonly encryptionKey?: kms.IKey; + /** * Actual connections object for the underlying Lambda * @@ -296,6 +344,31 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { this._connections = new ec2.Connections({}); } + if (props.runtime.family !== RuntimeFamily.NODEJS && props.artifactS3Encryption) { + throw new Error('Artifact encryption is only supported for Node.js runtime.'); + } + + if (props.artifactS3Encryption?.encryptionMode !== EncryptionMode.KMS && props.artifactS3Encryption?.kmsKey) { + throw new Error('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS.'); + } + + let encryptionKey; + if (props.artifactS3Encryption?.encryptionMode === EncryptionMode.KMS) { + encryptionKey = props.artifactS3Encryption?.kmsKey ?? new kms.Key(this, 'Key', { description: `Created by ${this.node.path}` }); + } + + encryptionKey?.grantEncryptDecrypt(this.role); + + let artifactConfig; + if (props.artifactS3Encryption) { + artifactConfig = { + s3Encryption: { + encryptionMode: props.artifactS3Encryption.encryptionMode, + kmsKeyArn: encryptionKey?.keyArn ?? undefined, + }, + }; + } + const resource: CfnCanary = new CfnCanary(this, 'Resource', { artifactS3Location: this.artifactsBucket.s3UrlForObject(props.artifactsBucketLocation?.prefix), executionRoleArn: this.role.roleArn, @@ -308,6 +381,7 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { code: this.createCode(props), runConfig: this.createRunConfig(props), vpcConfig: this.createVpcConfig(props), + artifactConfig, }); this._resource = resource; @@ -315,6 +389,8 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { this.canaryState = resource.attrState; this.canaryName = this.getResourceNameAttribute(resource.ref); + this.encryptionKey = encryptionKey; + if (props.cleanup === Cleanup.LAMBDA) { this.cleanupUnderlyingResources(); } @@ -420,7 +496,7 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { actions: ['s3:GetBucketLocation'], }), new iam.PolicyStatement({ - resources: [this.artifactsBucket.arnForObjects(`${prefix ? prefix+'/*' : '*'}`)], + resources: [this.artifactsBucket.arnForObjects(`${prefix ? prefix + '/*' : '*'}`)], actions: ['s3:PutObject'], }), new iam.PolicyStatement({ diff --git a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts index 5481002b9d579..94ef853960145 100644 --- a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts +++ b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts @@ -2,6 +2,7 @@ import * as path from 'path'; import { Match, Template } from '../../assertions'; import * as ec2 from '../../aws-ec2'; import * as iam from '../../aws-iam'; +import * as kms from '../../aws-kms'; import * as s3 from '../../aws-s3'; import { Duration, Lazy, Stack } from '../../core'; import * as synthetics from '../lib'; @@ -787,3 +788,137 @@ describe('handler validation', () => { }).toThrow(/Canary Handler length must be between 1 and 128/); }); }); + +describe('artifact encryption test', () => { + test('SSE_S3 without a key', () => { + // GIVEN + const stack = new Stack(); + + // WHEN + new synthetics.Canary(stack, 'Canary', { + test: synthetics.Test.custom({ + handler: 'index.handler', + code: synthetics.Code.fromInline(` + exports.handler = async () => { + console.log(\'hello world\'); + };`), + }), + runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + artifactS3Encryption: { + encryptionMode: synthetics.EncryptionMode.S3_MANAGED, + }, + }); + + // THEN + Template.fromStack(stack).hasResourceProperties('AWS::Synthetics::Canary', { + ArtifactConfig: { + S3Encryption: { + EncryptionMode: 'SSE_S3', + KmsKeyArn: Match.absent(), + }, + }, + }); + }); + + test('auto-creates KMS key if encryption type is SSE_KMS but no key is provided', () => { + // GIVEN + const stack = new Stack(); + + // WHEN + const canary = new synthetics.Canary(stack, 'Canary', { + test: synthetics.Test.custom({ + handler: 'index.handler', + code: synthetics.Code.fromInline(` + exports.handler = async () => { + console.log(\'hello world\'); + };`), + }), + runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + artifactS3Encryption: { + encryptionMode: synthetics.EncryptionMode.KMS, + }, + }); + + Template.fromStack(stack).hasResourceProperties('AWS::KMS::Key', { + Description: 'Created by Default/Canary', + }); + + // THEN + Template.fromStack(stack).hasResourceProperties('AWS::Synthetics::Canary', { + ArtifactConfig: { + S3Encryption: { + EncryptionMode: 'SSE_KMS', + KmsKeyArn: stack.resolve(canary.encryptionKey?.keyArn), + }, + }, + }); + }); + + test('SSE_KMS with a key', () => { + // GIVEN + const stack = new Stack(); + const key = new kms.Key(stack, 'myKey'); + + // WHEN + new synthetics.Canary(stack, 'Canary', { + test: synthetics.Test.custom({ + handler: 'index.handler', + code: synthetics.Code.fromInline(` + exports.handler = async () => { + console.log(\'hello world\'); + };`), + }), + runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + artifactS3Encryption: { + encryptionMode: synthetics.EncryptionMode.KMS, + kmsKey: key, + }, + }); + + // THEN + Template.fromStack(stack).hasResourceProperties('AWS::Synthetics::Canary', { + ArtifactConfig: { + S3Encryption: { + EncryptionMode: 'SSE_KMS', + KmsKeyArn: stack.resolve(key.keyArn), + }, + }, + }); + }); + + test('SSE-S3 with a key throw an error', () => { + const stack = new Stack(); + const key = new kms.Key(stack, 'myKey'); + + expect(() => { + new synthetics.Canary(stack, 'Canary', { + test: synthetics.Test.custom({ + handler: 'index.functionName', + code: synthetics.Code.fromAsset(path.join(__dirname, 'canaries')), + }), + runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + artifactS3Encryption: { + encryptionMode: synthetics.EncryptionMode.S3_MANAGED, + kmsKey: key, + }, + }); + }).toThrow('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS.'); + }); + + test('Artifact encryption for non-Node.js runtime throws an error', () => { + const stack = new Stack(); + + expect(() => { + new synthetics.Canary(stack, 'Canary', { + runtime: synthetics.Runtime.SYNTHETICS_PYTHON_SELENIUM_3_0, + test: synthetics.Test.custom({ + handler: 'index.handler', + code: synthetics.Code.fromInline('# Synthetics handler code'), + }), + artifactS3Encryption: { + encryptionMode: synthetics.EncryptionMode.S3_MANAGED, + }, + }); + }).toThrow('Artifact encryption is only supported for Node.js runtime.'); + }); +}); From fee0334ad075fa9801e703ca9f348f6b2a4c4a67 Mon Sep 17 00:00:00 2001 From: maz Date: Wed, 15 May 2024 09:34:40 +0900 Subject: [PATCH 02/16] fix: add docs. --- packages/aws-cdk-lib/aws-synthetics/lib/canary.ts | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts index deeca18893c8a..870424ec70105 100644 --- a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts +++ b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts @@ -260,6 +260,9 @@ export interface ArtifactS3Encryption { readonly kmsKey?: kms.IKey; } +/** + * Encryption mode. + */ export enum EncryptionMode { /** * Server-side encryption (SSE) with an Amazon S3-managed key. From 3dfc53368a156bd56be06cf36faab5d0fc894af5 Mon Sep 17 00:00:00 2001 From: maz Date: Wed, 15 May 2024 09:38:34 +0900 Subject: [PATCH 03/16] fix: add docs. --- packages/aws-cdk-lib/aws-synthetics/lib/canary.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts index 870424ec70105..f24d64ec5ba44 100644 --- a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts +++ b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts @@ -261,7 +261,7 @@ export interface ArtifactS3Encryption { } /** - * Encryption mode. + * Encryption mode for canary artifacts. */ export enum EncryptionMode { /** From 4abab86cecf9695c3f177172a61145e29a9435e0 Mon Sep 17 00:00:00 2001 From: maz Date: Wed, 15 May 2024 11:29:35 +0900 Subject: [PATCH 04/16] fix: README --- packages/aws-cdk-lib/aws-synthetics/README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/aws-cdk-lib/aws-synthetics/README.md b/packages/aws-cdk-lib/aws-synthetics/README.md index cc6eebfb393d0..7a4fa32ce4719 100644 --- a/packages/aws-cdk-lib/aws-synthetics/README.md +++ b/packages/aws-cdk-lib/aws-synthetics/README.md @@ -269,10 +269,10 @@ const canary = new synthetics.Canary(this, 'MyCanary', { runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, artifactsBucketLifecycleRules: [{ expiration: Duration.days(30), - artifactS3Encryption: { - encryptionMode: synthetics.EncryptionMode.KMS, - kmsKey: key, // external KMS Key set - }, }], + artifactS3Encryption: { + encryptionMode: synthetics.EncryptionMode.KMS, + kmsKey: key, // external KMS Key set + }, }); ``` \ No newline at end of file From df7daf5d1ba139adc6d4712cc31f04b796fd01d6 Mon Sep 17 00:00:00 2001 From: maz Date: Wed, 15 May 2024 12:04:51 +0900 Subject: [PATCH 05/16] fix: README --- packages/aws-cdk-lib/aws-synthetics/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/aws-cdk-lib/aws-synthetics/README.md b/packages/aws-cdk-lib/aws-synthetics/README.md index 7a4fa32ce4719..1fd33e30b47c8 100644 --- a/packages/aws-cdk-lib/aws-synthetics/README.md +++ b/packages/aws-cdk-lib/aws-synthetics/README.md @@ -258,7 +258,7 @@ You can also supply your own external KMS key by specifying the `kmsKey` propert ```ts import * as kms from 'aws-cdk-lib/aws-kms'; -const key = new kms.Key(stack, 'myKey'); +const key = new kms.Key(this, 'myKey'); const canary = new synthetics.Canary(this, 'MyCanary', { schedule: synthetics.Schedule.rate(Duration.minutes(5)), From 88a8e7900c7e4a835b73530c63cb30d7b271e5fc Mon Sep 17 00:00:00 2001 From: maz Date: Sat, 15 Jun 2024 14:52:07 +0900 Subject: [PATCH 06/16] fix: update integ test --- .../canary-artifact-s3-encryption.assets.json | 4 +- ...anary-artifact-s3-encryption.template.json | 129 ++++++++++- .../manifest.json | 8 +- .../tree.json | 208 +++++++++--------- 4 files changed, 244 insertions(+), 105 deletions(-) diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json index 648f5c34f8e36..abe9a88e9a32c 100644 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json @@ -27,7 +27,7 @@ } } }, - "83d99b596872351cd17d1d60c0a3a9101239b2549fc1cf97334218abfe09ef9e": { + "06251d94ac81322a48b2d311299132baa16357fe5d1bfb49933c04ce1afd7b56": { "source": { "path": "canary-artifact-s3-encryption.template.json", "packaging": "file" @@ -35,7 +35,7 @@ "destinations": { "current_account-current_region": { "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}", - "objectKey": "83d99b596872351cd17d1d60c0a3a9101239b2549fc1cf97334218abfe09ef9e.json", + "objectKey": "06251d94ac81322a48b2d311299132baa16357fe5d1bfb49933c04ce1afd7b56.json", "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}" } } diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json index efdb339b3625f..2e0eaac6f73e9 100644 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json @@ -124,7 +124,15 @@ "Arn" ] }, - "Runtime": "nodejs18.x", + "Runtime": { + "Fn::FindInMap": [ + "LatestNodeRuntimeMap", + { + "Ref": "AWS::Region" + }, + "value" + ] + }, "Description": { "Fn::Join": [ "", @@ -384,7 +392,15 @@ "Arn" ] }, - "Runtime": "nodejs18.x", + "Runtime": { + "Fn::FindInMap": [ + "LatestNodeRuntimeMap", + { + "Ref": "AWS::Region" + }, + "value" + ] + }, "Description": { "Fn::Join": [ "", @@ -866,6 +882,115 @@ "DeletionPolicy": "Delete" } }, + "Mappings": { + "LatestNodeRuntimeMap": { + "af-south-1": { + "value": "nodejs20.x" + }, + "ap-east-1": { + "value": "nodejs20.x" + }, + "ap-northeast-1": { + "value": "nodejs20.x" + }, + "ap-northeast-2": { + "value": "nodejs20.x" + }, + "ap-northeast-3": { + "value": "nodejs20.x" + }, + "ap-south-1": { + "value": "nodejs20.x" + }, + "ap-south-2": { + "value": "nodejs20.x" + }, + "ap-southeast-1": { + "value": "nodejs20.x" + }, + "ap-southeast-2": { + "value": "nodejs20.x" + }, + "ap-southeast-3": { + "value": "nodejs20.x" + }, + "ap-southeast-4": { + "value": "nodejs20.x" + }, + "ca-central-1": { + "value": "nodejs20.x" + }, + "cn-north-1": { + "value": "nodejs18.x" + }, + "cn-northwest-1": { + "value": "nodejs18.x" + }, + "eu-central-1": { + "value": "nodejs20.x" + }, + "eu-central-2": { + "value": "nodejs20.x" + }, + "eu-north-1": { + "value": "nodejs20.x" + }, + "eu-south-1": { + "value": "nodejs20.x" + }, + "eu-south-2": { + "value": "nodejs20.x" + }, + "eu-west-1": { + "value": "nodejs20.x" + }, + "eu-west-2": { + "value": "nodejs20.x" + }, + "eu-west-3": { + "value": "nodejs20.x" + }, + "il-central-1": { + "value": "nodejs20.x" + }, + "me-central-1": { + "value": "nodejs20.x" + }, + "me-south-1": { + "value": "nodejs20.x" + }, + "sa-east-1": { + "value": "nodejs20.x" + }, + "us-east-1": { + "value": "nodejs20.x" + }, + "us-east-2": { + "value": "nodejs20.x" + }, + "us-gov-east-1": { + "value": "nodejs18.x" + }, + "us-gov-west-1": { + "value": "nodejs18.x" + }, + "us-iso-east-1": { + "value": "nodejs18.x" + }, + "us-iso-west-1": { + "value": "nodejs18.x" + }, + "us-isob-east-1": { + "value": "nodejs18.x" + }, + "us-west-1": { + "value": "nodejs20.x" + }, + "us-west-2": { + "value": "nodejs20.x" + } + } + }, "Parameters": { "BootstrapVersion": { "Type": "AWS::SSM::Parameter::Value", diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json index 7e7ced9cc20b7..fc8ea38e9ff04 100644 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json @@ -18,7 +18,7 @@ "validateOnSynth": false, "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}", "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}", - "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/83d99b596872351cd17d1d60c0a3a9101239b2549fc1cf97334218abfe09ef9e.json", + "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/06251d94ac81322a48b2d311299132baa16357fe5d1bfb49933c04ce1afd7b56.json", "requiresBootstrapStackVersion": 6, "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version", "additionalDependencies": [ @@ -52,6 +52,12 @@ "data": "MyTestBucketAutoDeleteObjectsCustomResource1E1AC890" } ], + "/canary-artifact-s3-encryption/LatestNodeRuntimeMap": [ + { + "type": "aws:cdk:logicalId", + "data": "LatestNodeRuntimeMap" + } + ], "/canary-artifact-s3-encryption/Custom::S3AutoDeleteObjectsCustomResourceProvider/Role": [ { "type": "aws:cdk:logicalId", diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/tree.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/tree.json index 90a88a1478dc0..4cfdc833562e1 100644 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/tree.json +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/tree.json @@ -27,8 +27,8 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_s3.CfnBucket", + "version": "0.0.0" } }, "Policy": { @@ -91,14 +91,14 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_s3.CfnBucketPolicy", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_s3.BucketPolicy", + "version": "0.0.0" } }, "AutoDeleteObjectsCustomResource": { @@ -109,20 +109,28 @@ "id": "Default", "path": "canary-artifact-s3-encryption/MyTestBucket/AutoDeleteObjectsCustomResource/Default", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CustomResource", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_s3.Bucket", + "version": "0.0.0" + } + }, + "LatestNodeRuntimeMap": { + "id": "LatestNodeRuntimeMap", + "path": "canary-artifact-s3-encryption/LatestNodeRuntimeMap", + "constructInfo": { + "fqn": "aws-cdk-lib.CfnMapping", + "version": "0.0.0" } }, "Custom::S3AutoDeleteObjectsCustomResourceProvider": { @@ -133,30 +141,30 @@ "id": "Staging", "path": "canary-artifact-s3-encryption/Custom::S3AutoDeleteObjectsCustomResourceProvider/Staging", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" } }, "Role": { "id": "Role", "path": "canary-artifact-s3-encryption/Custom::S3AutoDeleteObjectsCustomResourceProvider/Role", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" } }, "Handler": { "id": "Handler", "path": "canary-artifact-s3-encryption/Custom::S3AutoDeleteObjectsCustomResourceProvider/Handler", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CustomResourceProviderBase", + "version": "0.0.0" } }, "CanarySseS3": { @@ -171,8 +179,8 @@ "id": "ImportServiceRole", "path": "canary-artifact-s3-encryption/CanarySseS3/ServiceRole/ImportServiceRole", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.Resource", + "version": "0.0.0" } }, "Resource": { @@ -277,14 +285,14 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_iam.CfnRole", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_iam.Role", + "version": "0.0.0" } }, "Resource": { @@ -336,8 +344,8 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_synthetics.CfnCanary", + "version": "0.0.0" } }, "AutoDeleteUnderlyingResourcesCustomResource": { @@ -348,20 +356,20 @@ "id": "Default", "path": "canary-artifact-s3-encryption/CanarySseS3/AutoDeleteUnderlyingResourcesCustomResource/Default", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CustomResource", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_synthetics.Canary", + "version": "0.0.0" } }, "Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider": { @@ -372,30 +380,30 @@ "id": "Staging", "path": "canary-artifact-s3-encryption/Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider/Staging", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" } }, "Role": { "id": "Role", "path": "canary-artifact-s3-encryption/Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider/Role", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" } }, "Handler": { "id": "Handler", "path": "canary-artifact-s3-encryption/Custom::SyntheticsAutoDeleteUnderlyingResourcesCustomResourceProvider/Handler", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CustomResourceProviderBase", + "version": "0.0.0" } }, "CanarySseKmsWithoutKeySetting": { @@ -410,8 +418,8 @@ "id": "ImportServiceRole", "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/ServiceRole/ImportServiceRole", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.Resource", + "version": "0.0.0" } }, "Resource": { @@ -516,8 +524,8 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_iam.CfnRole", + "version": "0.0.0" } }, "DefaultPolicy": { @@ -559,20 +567,20 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_iam.CfnPolicy", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_iam.Policy", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_iam.Role", + "version": "0.0.0" } }, "Key": { @@ -617,14 +625,14 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_kms.CfnKey", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_kms.Key", + "version": "0.0.0" } }, "Resource": { @@ -682,8 +690,8 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_synthetics.CfnCanary", + "version": "0.0.0" } }, "AutoDeleteUnderlyingResourcesCustomResource": { @@ -694,20 +702,20 @@ "id": "Default", "path": "canary-artifact-s3-encryption/CanarySseKmsWithoutKeySetting/AutoDeleteUnderlyingResourcesCustomResource/Default", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CustomResource", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_synthetics.Canary", + "version": "0.0.0" } }, "Key": { @@ -751,14 +759,14 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_kms.CfnKey", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_kms.Key", + "version": "0.0.0" } }, "CanarySseKmsWith": { @@ -773,8 +781,8 @@ "id": "ImportServiceRole", "path": "canary-artifact-s3-encryption/CanarySseKmsWith/ServiceRole/ImportServiceRole", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.Resource", + "version": "0.0.0" } }, "Resource": { @@ -879,8 +887,8 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_iam.CfnRole", + "version": "0.0.0" } }, "DefaultPolicy": { @@ -922,20 +930,20 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_iam.CfnPolicy", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_iam.Policy", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_iam.Role", + "version": "0.0.0" } }, "Resource": { @@ -993,8 +1001,8 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_synthetics.CfnCanary", + "version": "0.0.0" } }, "AutoDeleteUnderlyingResourcesCustomResource": { @@ -1005,42 +1013,42 @@ "id": "Default", "path": "canary-artifact-s3-encryption/CanarySseKmsWith/AutoDeleteUnderlyingResourcesCustomResource/Default", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CustomResource", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.aws_synthetics.Canary", + "version": "0.0.0" } }, "BootstrapVersion": { "id": "BootstrapVersion", "path": "canary-artifact-s3-encryption/BootstrapVersion", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnParameter", + "version": "0.0.0" } }, "CheckBootstrapVersion": { "id": "CheckBootstrapVersion", "path": "canary-artifact-s3-encryption/CheckBootstrapVersion", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnRule", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.Stack", + "version": "0.0.0" } }, "IntegCanaryTest": { @@ -1067,22 +1075,22 @@ "id": "BootstrapVersion", "path": "IntegCanaryTest/DefaultTest/DeployAssert/BootstrapVersion", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnParameter", + "version": "0.0.0" } }, "CheckBootstrapVersion": { "id": "CheckBootstrapVersion", "path": "IntegCanaryTest/DefaultTest/DeployAssert/CheckBootstrapVersion", "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.CfnRule", + "version": "0.0.0" } } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.Stack", + "version": "0.0.0" } } }, @@ -1107,8 +1115,8 @@ } }, "constructInfo": { - "fqn": "constructs.Construct", - "version": "10.3.0" + "fqn": "aws-cdk-lib.App", + "version": "0.0.0" } } } \ No newline at end of file From fd44f6f19ed0fa1f6242ef34da2dc0ba46e4cc05 Mon Sep 17 00:00:00 2001 From: maz Date: Sun, 16 Jun 2024 14:46:52 +0900 Subject: [PATCH 07/16] fix: incorporat review comments and refactor --- .../integ.canary-artifact-s3-encryption.ts | 16 ++-- packages/aws-cdk-lib/aws-synthetics/README.md | 10 +-- .../aws-cdk-lib/aws-synthetics/lib/canary.ts | 80 +++++++++---------- .../aws-synthetics/test/canary.test.ts | 26 ++---- 4 files changed, 55 insertions(+), 77 deletions(-) diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts index a324b8e874205..29de5ae865cef 100644 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts @@ -1,7 +1,7 @@ /// !cdk-integ canary-one import * as s3 from 'aws-cdk-lib/aws-s3'; import * as cdk from 'aws-cdk-lib/core'; -import { Canary, Cleanup, Code, EncryptionMode, Runtime, Schedule, Test } from 'aws-cdk-lib/aws-synthetics'; +import { ArtifactsEncryptionMode, Canary, Cleanup, Code, Runtime, Schedule, Test } from 'aws-cdk-lib/aws-synthetics'; import { IntegTest } from '@aws-cdk/integ-tests-alpha'; import { RemovalPolicy } from 'aws-cdk-lib'; import { Key } from 'aws-cdk-lib/aws-kms'; @@ -27,9 +27,7 @@ new Canary(stack, 'CanarySseS3', { artifactsBucketLocation: { bucket, prefix }, runtime: Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, cleanup: Cleanup.LAMBDA, - artifactS3Encryption: { - encryptionMode: EncryptionMode.S3_MANAGED, - }, + artifactS3EncryptionMode: ArtifactsEncryptionMode.S3_MANAGED, }); new Canary(stack, 'CanarySseKmsWithoutKeySetting', { @@ -44,9 +42,7 @@ new Canary(stack, 'CanarySseKmsWithoutKeySetting', { artifactsBucketLocation: { bucket, prefix }, runtime: Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, cleanup: Cleanup.LAMBDA, - artifactS3Encryption: { - encryptionMode: EncryptionMode.KMS, - }, + artifactS3EncryptionMode: ArtifactsEncryptionMode.KMS, }); const encryptKey = new Key(stack, 'Key', { removalPolicy: RemovalPolicy.DESTROY }); @@ -63,10 +59,8 @@ new Canary(stack, 'CanarySseKmsWith', { artifactsBucketLocation: { bucket, prefix }, runtime: Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, cleanup: Cleanup.LAMBDA, - artifactS3Encryption: { - encryptionMode: EncryptionMode.KMS, - kmsKey: encryptKey, - }, + artifactS3EncryptionMode: ArtifactsEncryptionMode.KMS, + kmsKey: encryptKey, }); new IntegTest(app, 'IntegCanaryTest', { diff --git a/packages/aws-cdk-lib/aws-synthetics/README.md b/packages/aws-cdk-lib/aws-synthetics/README.md index 1fd33e30b47c8..9f84b77d3c02b 100644 --- a/packages/aws-cdk-lib/aws-synthetics/README.md +++ b/packages/aws-cdk-lib/aws-synthetics/README.md @@ -251,9 +251,9 @@ const canary = new synthetics.Canary(this, 'MyCanary', { Canary artifacts are encrypted at rest using an AWS-managed key by default. -Additionally, you can choose the encryption options SSE-S3 or SSE-KMS by setting the `artifactS3Encryption` property. +Additionally, you can choose the encryption options SSE-S3 or SSE-KMS by setting the `artifactS3EncryptionMode` property. -You can also supply your own external KMS key by specifying the `kmsKey` property. If you don't, a KMS key will be automatically created and associated with the canary. +When you use SSE-KMS, you can also supply your own external KMS key by specifying the `kmsKey` property. If you don't, a KMS key will be automatically created and associated with the canary. ```ts import * as kms from 'aws-cdk-lib/aws-kms'; @@ -270,9 +270,7 @@ const canary = new synthetics.Canary(this, 'MyCanary', { artifactsBucketLifecycleRules: [{ expiration: Duration.days(30), }], - artifactS3Encryption: { - encryptionMode: synthetics.EncryptionMode.KMS, - kmsKey: key, // external KMS Key set - }, + artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.KMS, + kmsKey: key, }); ``` \ No newline at end of file diff --git a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts index f24d64ec5ba44..2cb51c8536668 100644 --- a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts +++ b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts @@ -232,30 +232,20 @@ export interface CanaryProps { readonly artifactsBucketLifecycleRules?: Array; /** - * Canary Artifacts in S3 encryption configuration. - * Artifact encryption is only supported for Node.js runtime. + * Canary Artifacts in S3 encryption mode. + * Artifact encryption is only supported for canaries that use Synthetics runtime + * version `syn-nodejs-puppeteer-3.3` or later. * * @default - Artifacts are encrypted at rest using an AWS managed key * * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_artifact_encryption.html */ - readonly artifactS3Encryption?: ArtifactS3Encryption; -} - -/** - * Canary Artifacts in S3 encryption configuration. - */ -export interface ArtifactS3Encryption { - /** - * Encryption mode. - * @default - Artifacts are encrypted at rest using an AWS managed key - */ - readonly encryptionMode?: EncryptionMode; + readonly artifactS3EncryptionMode?: ArtifactsEncryptionMode; /** * The KMS key to be used to encrypt the data. - * @default - no kms key if mode = S3_MANAGED. - * A key will be created if one is not provided and mode = KMS. + * + * @default - no kms key if mode = S3_MANAGED. A key will be created if one is not provided and mode = KMS. */ readonly kmsKey?: kms.IKey; } @@ -263,16 +253,14 @@ export interface ArtifactS3Encryption { /** * Encryption mode for canary artifacts. */ -export enum EncryptionMode { +export enum ArtifactsEncryptionMode { /** * Server-side encryption (SSE) with an Amazon S3-managed key. - * */ S3_MANAGED = 'SSE_S3', /** * Server-side encryption (SSE) with an AWS KMS customer managed key. - * */ KMS = 'SSE_KMS', } @@ -347,29 +335,16 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { this._connections = new ec2.Connections({}); } - if (props.runtime.family !== RuntimeFamily.NODEJS && props.artifactS3Encryption) { - throw new Error('Artifact encryption is only supported for Node.js runtime.'); - } - - if (props.artifactS3Encryption?.encryptionMode !== EncryptionMode.KMS && props.artifactS3Encryption?.kmsKey) { + if (!cdk.Token.isUnresolved(props.artifactS3EncryptionMode) && + props.artifactS3EncryptionMode !== ArtifactsEncryptionMode.KMS && + !cdk.Token.isUnresolved(props.kmsKey) && + props.kmsKey) { throw new Error('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS.'); } - let encryptionKey; - if (props.artifactS3Encryption?.encryptionMode === EncryptionMode.KMS) { - encryptionKey = props.artifactS3Encryption?.kmsKey ?? new kms.Key(this, 'Key', { description: `Created by ${this.node.path}` }); - } - - encryptionKey?.grantEncryptDecrypt(this.role); - - let artifactConfig; - if (props.artifactS3Encryption) { - artifactConfig = { - s3Encryption: { - encryptionMode: props.artifactS3Encryption.encryptionMode, - kmsKeyArn: encryptionKey?.keyArn ?? undefined, - }, - }; + if (props.artifactS3EncryptionMode === ArtifactsEncryptionMode.KMS) { + // Kms Key is set or generated for using `createArtifactConfig` + this.encryptionKey = props.kmsKey ?? new kms.Key(this, 'Key', { description: `Created by ${this.node.path}` }); } const resource: CfnCanary = new CfnCanary(this, 'Resource', { @@ -384,7 +359,7 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { code: this.createCode(props), runConfig: this.createRunConfig(props), vpcConfig: this.createVpcConfig(props), - artifactConfig, + artifactConfig: this.createArticatConfig(props), }); this._resource = resource; @@ -392,8 +367,6 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { this.canaryState = resource.attrState; this.canaryName = this.getResourceNameAttribute(resource.ref); - this.encryptionKey = encryptionKey; - if (props.cleanup === Cleanup.LAMBDA) { this.cleanupUnderlyingResources(); } @@ -643,6 +616,29 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { }; } + private createArticatConfig(props: CanaryProps): CfnCanary.ArtifactConfigProperty | undefined { + if (!props.artifactS3EncryptionMode) { + return undefined; + } + + const isNodeRuntime = !cdk.Token.isUnresolved(props.runtime) && props.runtime.family === RuntimeFamily.NODEJS; + const isArtifactS3EncryptionModeDefined = !cdk.Token.isUnresolved(props.artifactS3EncryptionMode) && props.artifactS3EncryptionMode; + + // Only check runtime family is nodejs because versions prior to syn-nodejs-puppeteer-3.3 are deprecated and can no longer be configured. + if (!isNodeRuntime && isArtifactS3EncryptionModeDefined) { + throw new Error(`Artifact encryption is only supported for canaries that use Synthetics runtime version syn-nodejs-puppeteer-3.3 or later, got ${props.runtime.name}.`); + } + + this.encryptionKey?.grantEncryptDecrypt(this.role); + + return { + s3Encryption: { + encryptionMode: props.artifactS3EncryptionMode, + kmsKeyArn: this.encryptionKey?.keyArn ?? undefined, + }, + }; + } + /** * Creates a unique name for the canary. The generated name is the physical ID of the canary. */ diff --git a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts index 94ef853960145..24fed87840f01 100644 --- a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts +++ b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts @@ -804,9 +804,7 @@ describe('artifact encryption test', () => { };`), }), runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, - artifactS3Encryption: { - encryptionMode: synthetics.EncryptionMode.S3_MANAGED, - }, + artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.S3_MANAGED, }); // THEN @@ -834,9 +832,7 @@ describe('artifact encryption test', () => { };`), }), runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, - artifactS3Encryption: { - encryptionMode: synthetics.EncryptionMode.KMS, - }, + artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.KMS, }); Template.fromStack(stack).hasResourceProperties('AWS::KMS::Key', { @@ -869,10 +865,8 @@ describe('artifact encryption test', () => { };`), }), runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, - artifactS3Encryption: { - encryptionMode: synthetics.EncryptionMode.KMS, - kmsKey: key, - }, + artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.KMS, + kmsKey: key, }); // THEN @@ -897,10 +891,8 @@ describe('artifact encryption test', () => { code: synthetics.Code.fromAsset(path.join(__dirname, 'canaries')), }), runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, - artifactS3Encryption: { - encryptionMode: synthetics.EncryptionMode.S3_MANAGED, - kmsKey: key, - }, + artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.S3_MANAGED, + kmsKey: key, }); }).toThrow('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS.'); }); @@ -915,10 +907,8 @@ describe('artifact encryption test', () => { handler: 'index.handler', code: synthetics.Code.fromInline('# Synthetics handler code'), }), - artifactS3Encryption: { - encryptionMode: synthetics.EncryptionMode.S3_MANAGED, - }, + artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.S3_MANAGED, }); - }).toThrow('Artifact encryption is only supported for Node.js runtime.'); + }).toThrow('Artifact encryption is only supported for canaries that use Synthetics runtime version syn-nodejs-puppeteer-3.3 or later, got syn-python-selenium-3.0.'); }); }); From 4ca916c7522c77be8fd0e8e44544ca1dba551dd8 Mon Sep 17 00:00:00 2001 From: mazyu36 Date: Mon, 17 Jun 2024 12:16:40 +0900 Subject: [PATCH 08/16] fix: incorporate review comments --- .../integ.canary-artifact-s3-encryption.ts | 2 +- packages/aws-cdk-lib/aws-synthetics/README.md | 2 +- .../aws-cdk-lib/aws-synthetics/lib/canary.ts | 49 +++++++++---------- .../aws-synthetics/test/canary.test.ts | 17 ++++--- 4 files changed, 36 insertions(+), 34 deletions(-) diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts index 29de5ae865cef..33a8e4e910996 100644 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts @@ -60,7 +60,7 @@ new Canary(stack, 'CanarySseKmsWith', { runtime: Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, cleanup: Cleanup.LAMBDA, artifactS3EncryptionMode: ArtifactsEncryptionMode.KMS, - kmsKey: encryptKey, + artifactS3KmsKey: encryptKey, }); new IntegTest(app, 'IntegCanaryTest', { diff --git a/packages/aws-cdk-lib/aws-synthetics/README.md b/packages/aws-cdk-lib/aws-synthetics/README.md index 9f84b77d3c02b..a1ccc985f8173 100644 --- a/packages/aws-cdk-lib/aws-synthetics/README.md +++ b/packages/aws-cdk-lib/aws-synthetics/README.md @@ -271,6 +271,6 @@ const canary = new synthetics.Canary(this, 'MyCanary', { expiration: Duration.days(30), }], artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.KMS, - kmsKey: key, + artifactS3KmsKey: key, }); ``` \ No newline at end of file diff --git a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts index 2cb51c8536668..04bd6abfbca77 100644 --- a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts +++ b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts @@ -243,11 +243,11 @@ export interface CanaryProps { readonly artifactS3EncryptionMode?: ArtifactsEncryptionMode; /** - * The KMS key to be used to encrypt the data. + * The KMS key used to encrypt canary artifacts. * - * @default - no kms key if mode = S3_MANAGED. A key will be created if one is not provided and mode = KMS. + * @default - no kms key if `artifactS3EncryptionMode` is set to `S3_MANAGED`. A key will be created if one is not provided and `artifactS3EncryptionMode` is set to `KMS`. */ - readonly kmsKey?: kms.IKey; + readonly artifactS3KmsKey?: kms.IKey; } /** @@ -297,11 +297,6 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { */ public readonly artifactsBucket: s3.IBucket; - /** - * Optional KMS encryption key associated with this canary. - */ - public readonly encryptionKey?: kms.IKey; - /** * Actual connections object for the underlying Lambda * @@ -335,18 +330,6 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { this._connections = new ec2.Connections({}); } - if (!cdk.Token.isUnresolved(props.artifactS3EncryptionMode) && - props.artifactS3EncryptionMode !== ArtifactsEncryptionMode.KMS && - !cdk.Token.isUnresolved(props.kmsKey) && - props.kmsKey) { - throw new Error('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS.'); - } - - if (props.artifactS3EncryptionMode === ArtifactsEncryptionMode.KMS) { - // Kms Key is set or generated for using `createArtifactConfig` - this.encryptionKey = props.kmsKey ?? new kms.Key(this, 'Key', { description: `Created by ${this.node.path}` }); - } - const resource: CfnCanary = new CfnCanary(this, 'Resource', { artifactS3Location: this.artifactsBucket.s3UrlForObject(props.artifactsBucketLocation?.prefix), executionRoleArn: this.role.roleArn, @@ -359,7 +342,7 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { code: this.createCode(props), runConfig: this.createRunConfig(props), vpcConfig: this.createVpcConfig(props), - artifactConfig: this.createArticatConfig(props), + artifactConfig: this.createArtifactConfig(props), }); this._resource = resource; @@ -616,25 +599,39 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { }; } - private createArticatConfig(props: CanaryProps): CfnCanary.ArtifactConfigProperty | undefined { + private createArtifactConfig(props: CanaryProps): CfnCanary.ArtifactConfigProperty | undefined { if (!props.artifactS3EncryptionMode) { return undefined; } const isNodeRuntime = !cdk.Token.isUnresolved(props.runtime) && props.runtime.family === RuntimeFamily.NODEJS; const isArtifactS3EncryptionModeDefined = !cdk.Token.isUnresolved(props.artifactS3EncryptionMode) && props.artifactS3EncryptionMode; + const isArtifactS3KmsKeyDefined = !cdk.Token.isUnresolved(props.artifactS3KmsKey) && props.artifactS3KmsKey; + + if ( + isArtifactS3EncryptionModeDefined && + props.artifactS3EncryptionMode !== ArtifactsEncryptionMode.KMS && + isArtifactS3KmsKeyDefined + ) { + throw new Error('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS.'); + } - // Only check runtime family is nodejs because versions prior to syn-nodejs-puppeteer-3.3 are deprecated and can no longer be configured. + // Only check runtime family is Node.js because versions prior to `syn-nodejs-puppeteer-3.3` are deprecated and can no longer be configured. if (!isNodeRuntime && isArtifactS3EncryptionModeDefined) { - throw new Error(`Artifact encryption is only supported for canaries that use Synthetics runtime version syn-nodejs-puppeteer-3.3 or later, got ${props.runtime.name}.`); + throw new Error(`Artifact encryption is only supported for canaries that use Synthetics runtime version \`syn-nodejs-puppeteer-3.3\` or later, got \`${props.runtime.name}\`.`); + } + + let encryptionKey: kms.IKey | undefined; + if (props.artifactS3EncryptionMode === ArtifactsEncryptionMode.KMS) { + encryptionKey = props.artifactS3KmsKey ?? new kms.Key(this, 'Key', { description: `Created by ${this.node.path}` }); } - this.encryptionKey?.grantEncryptDecrypt(this.role); + encryptionKey?.grantEncryptDecrypt(this.role); return { s3Encryption: { encryptionMode: props.artifactS3EncryptionMode, - kmsKeyArn: this.encryptionKey?.keyArn ?? undefined, + kmsKeyArn: encryptionKey?.keyArn, }, }; } diff --git a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts index 24fed87840f01..3fcba96e4036b 100644 --- a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts +++ b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts @@ -844,7 +844,12 @@ describe('artifact encryption test', () => { ArtifactConfig: { S3Encryption: { EncryptionMode: 'SSE_KMS', - KmsKeyArn: stack.resolve(canary.encryptionKey?.keyArn), + KmsKeyArn: { + 'Fn::GetAtt': [ + 'CanaryKey36A631B4', + 'Arn', + ], + }, }, }, }); @@ -866,7 +871,7 @@ describe('artifact encryption test', () => { }), runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.KMS, - kmsKey: key, + artifactS3KmsKey: key, }); // THEN @@ -887,12 +892,12 @@ describe('artifact encryption test', () => { expect(() => { new synthetics.Canary(stack, 'Canary', { test: synthetics.Test.custom({ - handler: 'index.functionName', - code: synthetics.Code.fromAsset(path.join(__dirname, 'canaries')), + handler: 'index.handler', + code: synthetics.Code.fromInline('/* Synthetics handler code */'), }), runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.S3_MANAGED, - kmsKey: key, + artifactS3KmsKey: key, }); }).toThrow('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS.'); }); @@ -909,6 +914,6 @@ describe('artifact encryption test', () => { }), artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.S3_MANAGED, }); - }).toThrow('Artifact encryption is only supported for canaries that use Synthetics runtime version syn-nodejs-puppeteer-3.3 or later, got syn-python-selenium-3.0.'); + }).toThrow('Artifact encryption is only supported for canaries that use Synthetics runtime version `syn-nodejs-puppeteer-3.3` or later, got `syn-python-selenium-3.0`.'); }); }); From 32368cf6cd47fdb183852c67d5d57d6fcb64519f Mon Sep 17 00:00:00 2001 From: mazyu36 Date: Fri, 21 Jun 2024 07:25:38 +0900 Subject: [PATCH 09/16] Update integ.canary-artifact-s3-encryption.ts --- .../aws-synthetics/test/integ.canary-artifact-s3-encryption.ts | 2 -- 1 file changed, 2 deletions(-) diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts index 33a8e4e910996..bacc2cc1492b1 100644 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.ts @@ -66,5 +66,3 @@ new Canary(stack, 'CanarySseKmsWith', { new IntegTest(app, 'IntegCanaryTest', { testCases: [stack], }); - -app.synth(); From 55f42c8b0d0c63e1d34fbd613dd57dc7895142ad Mon Sep 17 00:00:00 2001 From: mazyu36 Date: Fri, 21 Jun 2024 08:44:34 +0900 Subject: [PATCH 10/16] Update packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts Co-authored-by: Calvin Combs <66279577+comcalvi@users.noreply.github.com> --- packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts index 3fcba96e4036b..34d34dcce597d 100644 --- a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts +++ b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts @@ -885,7 +885,7 @@ describe('artifact encryption test', () => { }); }); - test('SSE-S3 with a key throw an error', () => { + test('SSE-S3 with a key throws', () => { const stack = new Stack(); const key = new kms.Key(stack, 'myKey'); From a0c8a0a4be721653205d091c382d4f801a76a847 Mon Sep 17 00:00:00 2001 From: mazyu36 Date: Fri, 21 Jun 2024 08:44:47 +0900 Subject: [PATCH 11/16] Update packages/aws-cdk-lib/aws-synthetics/README.md Co-authored-by: Calvin Combs <66279577+comcalvi@users.noreply.github.com> --- packages/aws-cdk-lib/aws-synthetics/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/aws-cdk-lib/aws-synthetics/README.md b/packages/aws-cdk-lib/aws-synthetics/README.md index a1ccc985f8173..68edcc5c943f0 100644 --- a/packages/aws-cdk-lib/aws-synthetics/README.md +++ b/packages/aws-cdk-lib/aws-synthetics/README.md @@ -251,7 +251,7 @@ const canary = new synthetics.Canary(this, 'MyCanary', { Canary artifacts are encrypted at rest using an AWS-managed key by default. -Additionally, you can choose the encryption options SSE-S3 or SSE-KMS by setting the `artifactS3EncryptionMode` property. +You can choose the encryption options SSE-S3 or SSE-KMS by setting the `artifactS3EncryptionMode` property. When you use SSE-KMS, you can also supply your own external KMS key by specifying the `kmsKey` property. If you don't, a KMS key will be automatically created and associated with the canary. From 47911d6ec3e299d07f359f26eb2236e83d4680b2 Mon Sep 17 00:00:00 2001 From: maz Date: Fri, 21 Jun 2024 08:46:02 +0900 Subject: [PATCH 12/16] remove condition --- packages/aws-cdk-lib/aws-synthetics/lib/canary.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts index 04bd6abfbca77..56f1724447eab 100644 --- a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts +++ b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts @@ -604,7 +604,7 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { return undefined; } - const isNodeRuntime = !cdk.Token.isUnresolved(props.runtime) && props.runtime.family === RuntimeFamily.NODEJS; + const isNodeRuntime = props.runtime.family === RuntimeFamily.NODEJS; const isArtifactS3EncryptionModeDefined = !cdk.Token.isUnresolved(props.artifactS3EncryptionMode) && props.artifactS3EncryptionMode; const isArtifactS3KmsKeyDefined = !cdk.Token.isUnresolved(props.artifactS3KmsKey) && props.artifactS3KmsKey; From 54c6c9f179300c42f70d4ca55ac3f931d4779785 Mon Sep 17 00:00:00 2001 From: maz Date: Sat, 6 Jul 2024 19:29:04 +0900 Subject: [PATCH 13/16] update integ tests --- .../index.js | 1 + .../index.js | 1 - .../canary-artifact-s3-encryption.assets.json | 10 +++++----- .../canary-artifact-s3-encryption.template.json | 17 ++++++++++++++++- .../manifest.json | 2 +- 5 files changed, 23 insertions(+), 8 deletions(-) create mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.44e9c4d7a5d3fd2d677e1a7e416b2b56f6b0104bd5eff9cac5557b4c65a9dc61/index.js delete mode 100644 packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d/index.js diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.44e9c4d7a5d3fd2d677e1a7e416b2b56f6b0104bd5eff9cac5557b4c65a9dc61/index.js b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.44e9c4d7a5d3fd2d677e1a7e416b2b56f6b0104bd5eff9cac5557b4c65a9dc61/index.js new file mode 100644 index 0000000000000..1002ba018e9fb --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.44e9c4d7a5d3fd2d677e1a7e416b2b56f6b0104bd5eff9cac5557b4c65a9dc61/index.js @@ -0,0 +1 @@ +"use strict";var f=Object.create;var i=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var C=Object.getOwnPropertyNames;var w=Object.getPrototypeOf,P=Object.prototype.hasOwnProperty;var A=(t,e)=>{for(var o in e)i(t,o,{get:e[o],enumerable:!0})},d=(t,e,o,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of C(e))!P.call(t,s)&&s!==o&&i(t,s,{get:()=>e[s],enumerable:!(r=I(e,s))||r.enumerable});return t};var l=(t,e,o)=>(o=t!=null?f(w(t)):{},d(e||!t||!t.__esModule?i(o,"default",{value:t,enumerable:!0}):o,t)),B=t=>d(i({},"__esModule",{value:!0}),t);var q={};A(q,{autoDeleteHandler:()=>S,handler:()=>H});module.exports=B(q);var h=require("@aws-sdk/client-s3");var y=l(require("https")),m=l(require("url")),a={sendHttpRequest:D,log:T,includeStackTraces:!0,userHandlerIndex:"./index"},p="AWSCDK::CustomResourceProviderFramework::CREATE_FAILED",L="AWSCDK::CustomResourceProviderFramework::MISSING_PHYSICAL_ID";function R(t){return async(e,o)=>{let r={...e,ResponseURL:"..."};if(a.log(JSON.stringify(r,void 0,2)),e.RequestType==="Delete"&&e.PhysicalResourceId===p){a.log("ignoring DELETE event caused by a failed CREATE event"),await u("SUCCESS",e);return}try{let s=await t(r,o),n=k(e,s);await u("SUCCESS",n)}catch(s){let n={...e,Reason:a.includeStackTraces?s.stack:s.message};n.PhysicalResourceId||(e.RequestType==="Create"?(a.log("CREATE failed, responding with a marker physical resource id so that the subsequent DELETE will be ignored"),n.PhysicalResourceId=p):a.log(`ERROR: Malformed event. "PhysicalResourceId" is required: ${JSON.stringify(e)}`)),await u("FAILED",n)}}}function k(t,e={}){let o=e.PhysicalResourceId??t.PhysicalResourceId??t.RequestId;if(t.RequestType==="Delete"&&o!==t.PhysicalResourceId)throw new Error(`DELETE: cannot change the physical resource ID from "${t.PhysicalResourceId}" to "${e.PhysicalResourceId}" during deletion`);return{...t,...e,PhysicalResourceId:o}}async function u(t,e){let o={Status:t,Reason:e.Reason??t,StackId:e.StackId,RequestId:e.RequestId,PhysicalResourceId:e.PhysicalResourceId||L,LogicalResourceId:e.LogicalResourceId,NoEcho:e.NoEcho,Data:e.Data},r=m.parse(e.ResponseURL),s=`${r.protocol}//${r.hostname}/${r.pathname}?***`;a.log("submit response to cloudformation",s,o);let n=JSON.stringify(o),E={hostname:r.hostname,path:r.path,method:"PUT",headers:{"content-type":"","content-length":Buffer.byteLength(n,"utf8")}};await O({attempts:5,sleep:1e3},a.sendHttpRequest)(E,n)}async function D(t,e){return new Promise((o,r)=>{try{let s=y.request(t,n=>{n.resume(),!n.statusCode||n.statusCode>=400?r(new Error(`Unsuccessful HTTP response: ${n.statusCode}`)):o()});s.on("error",r),s.write(e),s.end()}catch(s){r(s)}})}function T(t,...e){console.log(t,...e)}function O(t,e){return async(...o)=>{let r=t.attempts,s=t.sleep;for(;;)try{return await e(...o)}catch(n){if(r--<=0)throw n;await b(Math.floor(Math.random()*s)),s*=2}}}async function b(t){return new Promise(e=>setTimeout(e,t))}var g="aws-cdk:auto-delete-objects",x=JSON.stringify({Version:"2012-10-17",Statement:[]}),c=new h.S3({}),H=R(S);async function S(t){switch(t.RequestType){case"Create":return;case"Update":return{PhysicalResourceId:(await F(t)).PhysicalResourceId};case"Delete":return N(t.ResourceProperties?.BucketName)}}async function F(t){let e=t,o=e.OldResourceProperties?.BucketName;return{PhysicalResourceId:e.ResourceProperties?.BucketName??o}}async function _(t){try{let e=(await c.getBucketPolicy({Bucket:t}))?.Policy??x,o=JSON.parse(e);o.Statement.push({Principal:"*",Effect:"Deny",Action:["s3:PutObject"],Resource:[`arn:aws:s3:::${t}/*`]}),await c.putBucketPolicy({Bucket:t,Policy:JSON.stringify(o)})}catch(e){if(e.name==="NoSuchBucket")throw e;console.log(`Could not set new object deny policy on bucket '${t}' prior to deletion.`)}}async function U(t){let e;do{e=await c.listObjectVersions({Bucket:t});let o=[...e.Versions??[],...e.DeleteMarkers??[]];if(o.length===0)return;let r=o.map(s=>({Key:s.Key,VersionId:s.VersionId}));await c.deleteObjects({Bucket:t,Delete:{Objects:r}})}while(e?.IsTruncated)}async function N(t){if(!t)throw new Error("No BucketName was provided.");try{if(!await W(t)){console.log(`Bucket does not have '${g}' tag, skipping cleaning.`);return}await _(t),await U(t)}catch(e){if(e.name==="NoSuchBucket"){console.log(`Bucket '${t}' does not exist.`);return}throw e}}async function W(t){return(await c.getBucketTagging({Bucket:t})).TagSet?.some(o=>o.Key===g&&o.Value==="true")}0&&(module.exports={autoDeleteHandler,handler}); diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d/index.js b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d/index.js deleted file mode 100644 index d52c856d6a605..0000000000000 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/asset.96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d/index.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";var I=Object.create;var i=Object.defineProperty;var C=Object.getOwnPropertyDescriptor;var w=Object.getOwnPropertyNames;var P=Object.getPrototypeOf,A=Object.prototype.hasOwnProperty;var B=(e,t)=>{for(var o in t)i(e,o,{get:t[o],enumerable:!0})},d=(e,t,o,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of w(t))!A.call(e,s)&&s!==o&&i(e,s,{get:()=>t[s],enumerable:!(r=C(t,s))||r.enumerable});return e};var l=(e,t,o)=>(o=e!=null?I(P(e)):{},d(t||!e||!e.__esModule?i(o,"default",{value:e,enumerable:!0}):o,e)),L=e=>d(i({},"__esModule",{value:!0}),e);var q={};B(q,{autoDeleteHandler:()=>S,handler:()=>F});module.exports=L(q);var h=require("@aws-sdk/client-s3");var y=l(require("https")),m=l(require("url")),a={sendHttpRequest:T,log:O,includeStackTraces:!0,userHandlerIndex:"./index"},p="AWSCDK::CustomResourceProviderFramework::CREATE_FAILED",k="AWSCDK::CustomResourceProviderFramework::MISSING_PHYSICAL_ID";function R(e){return async(t,o)=>{let r={...t,ResponseURL:"..."};if(a.log(JSON.stringify(r,void 0,2)),t.RequestType==="Delete"&&t.PhysicalResourceId===p){a.log("ignoring DELETE event caused by a failed CREATE event"),await u("SUCCESS",t);return}try{let s=await e(r,o),n=D(t,s);await u("SUCCESS",n)}catch(s){let n={...t,Reason:a.includeStackTraces?s.stack:s.message};n.PhysicalResourceId||(t.RequestType==="Create"?(a.log("CREATE failed, responding with a marker physical resource id so that the subsequent DELETE will be ignored"),n.PhysicalResourceId=p):a.log(`ERROR: Malformed event. "PhysicalResourceId" is required: ${JSON.stringify(t)}`)),await u("FAILED",n)}}}function D(e,t={}){let o=t.PhysicalResourceId??e.PhysicalResourceId??e.RequestId;if(e.RequestType==="Delete"&&o!==e.PhysicalResourceId)throw new Error(`DELETE: cannot change the physical resource ID from "${e.PhysicalResourceId}" to "${t.PhysicalResourceId}" during deletion`);return{...e,...t,PhysicalResourceId:o}}async function u(e,t){let o={Status:e,Reason:t.Reason??e,StackId:t.StackId,RequestId:t.RequestId,PhysicalResourceId:t.PhysicalResourceId||k,LogicalResourceId:t.LogicalResourceId,NoEcho:t.NoEcho,Data:t.Data},r=m.parse(t.ResponseURL),s=`${r.protocol}//${r.hostname}/${r.pathname}?***`;a.log("submit response to cloudformation",s,o);let n=JSON.stringify(o),f={hostname:r.hostname,path:r.path,method:"PUT",headers:{"content-type":"","content-length":Buffer.byteLength(n,"utf8")}};await b({attempts:5,sleep:1e3},a.sendHttpRequest)(f,n)}async function T(e,t){return new Promise((o,r)=>{try{let s=y.request(e,n=>{n.resume(),!n.statusCode||n.statusCode>=400?r(new Error(`Unsuccessful HTTP response: ${n.statusCode}`)):o()});s.on("error",r),s.write(t),s.end()}catch(s){r(s)}})}function O(e,...t){console.log(e,...t)}function b(e,t){return async(...o)=>{let r=e.attempts,s=e.sleep;for(;;)try{return await t(...o)}catch(n){if(r--<=0)throw n;await x(Math.floor(Math.random()*s)),s*=2}}}async function x(e){return new Promise(t=>setTimeout(t,e))}var g="aws-cdk:auto-delete-objects",H=JSON.stringify({Version:"2012-10-17",Statement:[]}),c=new h.S3({}),F=R(S);async function S(e){switch(e.RequestType){case"Create":return;case"Update":return{PhysicalResourceId:(await _(e)).PhysicalResourceId};case"Delete":return W(e.ResourceProperties?.BucketName)}}async function _(e){let t=e,o=t.OldResourceProperties?.BucketName;return{PhysicalResourceId:t.ResourceProperties?.BucketName??o}}async function U(e){try{let t=(await c.getBucketPolicy({Bucket:e}))?.Policy??H,o=JSON.parse(t);o.Statement.push({Principal:"*",Effect:"Deny",Action:["s3:PutObject"],Resource:[`arn:aws:s3:::${e}/*`]}),await c.putBucketPolicy({Bucket:e,Policy:JSON.stringify(o)})}catch(t){if(t.name==="NoSuchBucket")throw t;console.log(`Could not set new object deny policy on bucket '${e}' prior to deletion.`)}}async function E(e){let t=await c.listObjectVersions({Bucket:e}),o=[...t.Versions??[],...t.DeleteMarkers??[]];if(o.length===0)return;let r=o.map(s=>({Key:s.Key,VersionId:s.VersionId}));await c.deleteObjects({Bucket:e,Delete:{Objects:r}}),t?.IsTruncated&&await E(e)}async function W(e){if(!e)throw new Error("No BucketName was provided.");try{if(!await N(e)){console.log(`Bucket does not have '${g}' tag, skipping cleaning.`);return}await U(e),await E(e)}catch(t){if(t.name==="NoSuchBucket"){console.log(`Bucket '${e}' does not exist.`);return}throw t}}async function N(e){return(await c.getBucketTagging({Bucket:e})).TagSet?.some(o=>o.Key===g&&o.Value==="true")}0&&(module.exports={autoDeleteHandler,handler}); diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json index abe9a88e9a32c..0dbbb97843db7 100644 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.assets.json @@ -1,15 +1,15 @@ { "version": "36.0.0", "files": { - "96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d": { + "44e9c4d7a5d3fd2d677e1a7e416b2b56f6b0104bd5eff9cac5557b4c65a9dc61": { "source": { - "path": "asset.96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d", + "path": "asset.44e9c4d7a5d3fd2d677e1a7e416b2b56f6b0104bd5eff9cac5557b4c65a9dc61", "packaging": "zip" }, "destinations": { "current_account-current_region": { "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}", - "objectKey": "96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d.zip", + "objectKey": "44e9c4d7a5d3fd2d677e1a7e416b2b56f6b0104bd5eff9cac5557b4c65a9dc61.zip", "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}" } } @@ -27,7 +27,7 @@ } } }, - "06251d94ac81322a48b2d311299132baa16357fe5d1bfb49933c04ce1afd7b56": { + "f6aad262db732f8a3d154c577c54fbd4f8d3a3ac9cf0ab7bcf5aa7bcc9f79f50": { "source": { "path": "canary-artifact-s3-encryption.template.json", "packaging": "file" @@ -35,7 +35,7 @@ "destinations": { "current_account-current_region": { "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}", - "objectKey": "06251d94ac81322a48b2d311299132baa16357fe5d1bfb49933c04ce1afd7b56.json", + "objectKey": "f6aad262db732f8a3d154c577c54fbd4f8d3a3ac9cf0ab7bcf5aa7bcc9f79f50.json", "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}" } } diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json index 2e0eaac6f73e9..99f1dca59faf3 100644 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/canary-artifact-s3-encryption.template.json @@ -113,7 +113,7 @@ "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, - "S3Key": "96ea260348625427bb7f28ab3b379f62da6f428bcd155cb13f9261aa6a404b0d.zip" + "S3Key": "44e9c4d7a5d3fd2d677e1a7e416b2b56f6b0104bd5eff9cac5557b4c65a9dc61.zip" }, "Timeout": 900, "MemorySize": 128, @@ -917,9 +917,18 @@ "ap-southeast-4": { "value": "nodejs20.x" }, + "ap-southeast-5": { + "value": "nodejs20.x" + }, + "ap-southeast-7": { + "value": "nodejs20.x" + }, "ca-central-1": { "value": "nodejs20.x" }, + "ca-west-1": { + "value": "nodejs20.x" + }, "cn-north-1": { "value": "nodejs18.x" }, @@ -932,6 +941,9 @@ "eu-central-2": { "value": "nodejs20.x" }, + "eu-isoe-west-1": { + "value": "nodejs18.x" + }, "eu-north-1": { "value": "nodejs20.x" }, @@ -959,6 +971,9 @@ "me-south-1": { "value": "nodejs20.x" }, + "mx-central-1": { + "value": "nodejs20.x" + }, "sa-east-1": { "value": "nodejs20.x" }, diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json index fc8ea38e9ff04..355bcc7683236 100644 --- a/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-synthetics/test/integ.canary-artifact-s3-encryption.js.snapshot/manifest.json @@ -18,7 +18,7 @@ "validateOnSynth": false, "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}", "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}", - "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/06251d94ac81322a48b2d311299132baa16357fe5d1bfb49933c04ce1afd7b56.json", + "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/f6aad262db732f8a3d154c577c54fbd4f8d3a3ac9cf0ab7bcf5aa7bcc9f79f50.json", "requiresBootstrapStackVersion": 6, "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version", "additionalDependencies": [ From e340755b74a631aaf004ed13f30e9b01d041f6c0 Mon Sep 17 00:00:00 2001 From: maz Date: Thu, 31 Oct 2024 10:16:04 +0900 Subject: [PATCH 14/16] update --- .../aws-cdk-lib/aws-synthetics/lib/canary.ts | 11 ++++------- .../aws-synthetics/test/canary.test.ts | 18 +++++++++++++++++- 2 files changed, 21 insertions(+), 8 deletions(-) diff --git a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts index 3d23cd98bef18..cc8e410803139 100644 --- a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts +++ b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts @@ -669,24 +669,21 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { } private createArtifactConfig(props: CanaryProps): CfnCanary.ArtifactConfigProperty | undefined { - if (!props.artifactS3EncryptionMode) { + if (!props.artifactS3EncryptionMode && !props.artifactS3KmsKey) { return undefined; } const isNodeRuntime = props.runtime.family === RuntimeFamily.NODEJS; - const isArtifactS3EncryptionModeDefined = !cdk.Token.isUnresolved(props.artifactS3EncryptionMode) && props.artifactS3EncryptionMode; - const isArtifactS3KmsKeyDefined = !cdk.Token.isUnresolved(props.artifactS3KmsKey) && props.artifactS3KmsKey; if ( - isArtifactS3EncryptionModeDefined && props.artifactS3EncryptionMode !== ArtifactsEncryptionMode.KMS && - isArtifactS3KmsKeyDefined + props.artifactS3KmsKey ) { - throw new Error('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS.'); + throw new Error(`A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS, got: ${props.artifactS3EncryptionMode}.`); } // Only check runtime family is Node.js because versions prior to `syn-nodejs-puppeteer-3.3` are deprecated and can no longer be configured. - if (!isNodeRuntime && isArtifactS3EncryptionModeDefined) { + if (!isNodeRuntime && props.artifactS3EncryptionMode) { throw new Error(`Artifact encryption is only supported for canaries that use Synthetics runtime version \`syn-nodejs-puppeteer-3.3\` or later, got \`${props.runtime.name}\`.`); } diff --git a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts index a97f3df99f089..0e8b202b2a0b3 100644 --- a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts +++ b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts @@ -1045,7 +1045,23 @@ describe('artifact encryption test', () => { artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.S3_MANAGED, artifactS3KmsKey: key, }); - }).toThrow('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS.'); + }).toThrow('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS, got: SSE_S3.'); + }); + + test('No artifactS3EncryptionMode setting with a key throws', () => { + const stack = new Stack(); + const key = new kms.Key(stack, 'myKey'); + + expect(() => { + new synthetics.Canary(stack, 'Canary', { + test: synthetics.Test.custom({ + handler: 'index.handler', + code: synthetics.Code.fromInline('/* Synthetics handler code */'), + }), + runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + artifactS3KmsKey: key, + }); + }).toThrow('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS, got: undefined.'); }); test('Artifact encryption for non-Node.js runtime throws an error', () => { From fa72ee29dab02886f4992e59d499c458a213f6cf Mon Sep 17 00:00:00 2001 From: maz Date: Tue, 5 Nov 2024 12:05:09 +0900 Subject: [PATCH 15/16] update --- .../aws-cdk-lib/aws-synthetics/lib/canary.ts | 20 +++++++--- .../aws-synthetics/test/canary.test.ts | 38 ++++++++++++------- 2 files changed, 39 insertions(+), 19 deletions(-) diff --git a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts index cc8e410803139..fea47741ed229 100644 --- a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts +++ b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts @@ -269,7 +269,7 @@ export interface CanaryProps { * Artifact encryption is only supported for canaries that use Synthetics runtime * version `syn-nodejs-puppeteer-3.3` or later. * - * @default - Artifacts are encrypted at rest using an AWS managed key + * @default - `ArtifactsEncryptionMode.KMS` is set if you specify `artifactS3KmsKey`, otherwise artifacts are encrypted at rest using an AWS managed key * * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_artifact_encryption.html */ @@ -676,7 +676,7 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { const isNodeRuntime = props.runtime.family === RuntimeFamily.NODEJS; if ( - props.artifactS3EncryptionMode !== ArtifactsEncryptionMode.KMS && + props.artifactS3EncryptionMode === ArtifactsEncryptionMode.S3_MANAGED && props.artifactS3KmsKey ) { throw new Error(`A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS, got: ${props.artifactS3EncryptionMode}.`); @@ -688,15 +688,25 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { } let encryptionKey: kms.IKey | undefined; - if (props.artifactS3EncryptionMode === ArtifactsEncryptionMode.KMS) { - encryptionKey = props.artifactS3KmsKey ?? new kms.Key(this, 'Key', { description: `Created by ${this.node.path}` }); + if (props.artifactS3EncryptionMode === ArtifactsEncryptionMode.KMS && !props.artifactS3KmsKey) { + encryptionKey = new kms.Key(this, 'Key', { description: `Created by ${this.node.path}` }); + } else { + encryptionKey = props.artifactS3KmsKey; } encryptionKey?.grantEncryptDecrypt(this.role); + let encryptionMode: ArtifactsEncryptionMode | undefined; + + if (props.artifactS3KmsKey && !props.artifactS3EncryptionMode) { + encryptionMode = ArtifactsEncryptionMode.KMS; + } else { + encryptionMode = props.artifactS3EncryptionMode; + } + return { s3Encryption: { - encryptionMode: props.artifactS3EncryptionMode, + encryptionMode, kmsKeyArn: encryptionKey?.keyArn, }, }; diff --git a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts index 0e8b202b2a0b3..286997bd98de9 100644 --- a/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts +++ b/packages/aws-cdk-lib/aws-synthetics/test/canary.test.ts @@ -1031,24 +1031,33 @@ describe('artifact encryption test', () => { }); }); - test('SSE-S3 with a key throws', () => { + test('No artifactS3EncryptionMode setting with a key is set to SSE_KMS', () => { + // GIVEN const stack = new Stack(); const key = new kms.Key(stack, 'myKey'); - expect(() => { - new synthetics.Canary(stack, 'Canary', { - test: synthetics.Test.custom({ - handler: 'index.handler', - code: synthetics.Code.fromInline('/* Synthetics handler code */'), - }), - runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, - artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.S3_MANAGED, - artifactS3KmsKey: key, - }); - }).toThrow('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS, got: SSE_S3.'); + // WHEN + new synthetics.Canary(stack, 'Canary', { + test: synthetics.Test.custom({ + handler: 'index.handler', + code: synthetics.Code.fromInline('/* Synthetics handler code */'), + }), + runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + artifactS3KmsKey: key, + }); + + // THEN + Template.fromStack(stack).hasResourceProperties('AWS::Synthetics::Canary', { + ArtifactConfig: { + S3Encryption: { + EncryptionMode: 'SSE_KMS', + KmsKeyArn: stack.resolve(key.keyArn), + }, + }, + }); }); - test('No artifactS3EncryptionMode setting with a key throws', () => { + test('SSE-S3 with a key throws', () => { const stack = new Stack(); const key = new kms.Key(stack, 'myKey'); @@ -1059,9 +1068,10 @@ describe('artifact encryption test', () => { code: synthetics.Code.fromInline('/* Synthetics handler code */'), }), runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_7_0, + artifactS3EncryptionMode: synthetics.ArtifactsEncryptionMode.S3_MANAGED, artifactS3KmsKey: key, }); - }).toThrow('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS, got: undefined.'); + }).toThrow('A customer-managed KMS key was provided, but the encryption mode is not set to SSE-KMS, got: SSE_S3.'); }); test('Artifact encryption for non-Node.js runtime throws an error', () => { From 45ccec07f8c1ca84f1d90fd91ff106ebab814b76 Mon Sep 17 00:00:00 2001 From: maz Date: Wed, 6 Nov 2024 19:45:11 +0900 Subject: [PATCH 16/16] update --- .../aws-cdk-lib/aws-synthetics/lib/canary.ts | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts index fea47741ed229..365b73882f810 100644 --- a/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts +++ b/packages/aws-cdk-lib/aws-synthetics/lib/canary.ts @@ -269,7 +269,7 @@ export interface CanaryProps { * Artifact encryption is only supported for canaries that use Synthetics runtime * version `syn-nodejs-puppeteer-3.3` or later. * - * @default - `ArtifactsEncryptionMode.KMS` is set if you specify `artifactS3KmsKey`, otherwise artifacts are encrypted at rest using an AWS managed key + * @default - Artifacts are encrypted at rest using an AWS managed key. `ArtifactsEncryptionMode.KMS` is set if you specify `artifactS3KmsKey`. * * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_artifact_encryption.html */ @@ -687,23 +687,16 @@ export class Canary extends cdk.Resource implements ec2.IConnectable { throw new Error(`Artifact encryption is only supported for canaries that use Synthetics runtime version \`syn-nodejs-puppeteer-3.3\` or later, got \`${props.runtime.name}\`.`); } + const encryptionMode = props.artifactS3EncryptionMode ? props.artifactS3EncryptionMode : + props.artifactS3KmsKey ? ArtifactsEncryptionMode.KMS : undefined; + let encryptionKey: kms.IKey | undefined; - if (props.artifactS3EncryptionMode === ArtifactsEncryptionMode.KMS && !props.artifactS3KmsKey) { - encryptionKey = new kms.Key(this, 'Key', { description: `Created by ${this.node.path}` }); - } else { - encryptionKey = props.artifactS3KmsKey; + if (encryptionMode === ArtifactsEncryptionMode.KMS) { + encryptionKey = props.artifactS3KmsKey ?? new kms.Key(this, 'Key', { description: `Created by ${this.node.path}` }); } encryptionKey?.grantEncryptDecrypt(this.role); - let encryptionMode: ArtifactsEncryptionMode | undefined; - - if (props.artifactS3KmsKey && !props.artifactS3EncryptionMode) { - encryptionMode = ArtifactsEncryptionMode.KMS; - } else { - encryptionMode = props.artifactS3EncryptionMode; - } - return { s3Encryption: { encryptionMode,