fix(events): Batch target does not work

The AWS Batch Event Rule target recently added actually did not emit BatchParameters, and so did not work. Unclear why this passed integration test previously, maybe the service has added validation in the mean time. Fixes #7137.
aws · Apr 6, 2020 · b2e57fb · b2e57fb
1 parent 2f6bd74
commit b2e57fb
Show file tree

Hide file tree

Showing 4 changed files with 189 additions and 198 deletions.
diff --git a/packages/@aws-cdk/aws-events-targets/lib/batch.ts b/packages/@aws-cdk/aws-events-targets/lib/batch.ts
@@ -32,6 +32,13 @@ export interface BatchJobProps {
    * @default no retryStrategy is set
    */
   readonly attempts?: number;
+
+  /**
+   * The name of the submitted job
+   *
+   * @default - Automatically generated
+   */
+  readonly jobName?: string;
 }
 
 /**
@@ -49,33 +56,26 @@ export class BatchJob implements events.IRuleTarget {
    * Returns a RuleTarget that can be used to trigger queue this batch job as a
    * result from a CloudWatch event.
    */
-  public bind(_rule: events.IRule, _id?: string): events.RuleTargetConfig {
-    const baseBatchParameters: any = {
+  public bind(rule: events.IRule, _id?: string): events.RuleTargetConfig {
+    const batchParameters: events.CfnRule.BatchParametersProperty = {
       jobDefinition: this.jobDefinition.jobDefinitionArn,
-      jobName: this.jobDefinition.jobDefinitionName
+      jobName: this.props.jobName ?? rule.node.uniqueId,
+      arrayProperties: this.props.size ? { size: this.props.size } : undefined,
+      retryStrategy: this.props.attempts ? { attempts: this.props.attempts } : undefined,
     };
 
-    if (this.props.size) {
-      baseBatchParameters.arrayProperties = {
-        size: this.props.size
-      };
-    }
-
-    if (this.props.attempts) {
-      baseBatchParameters.retryStrategy = {
-        attempts: this.props.attempts
-      };
-    }
-
-    const batchParameters: events.CfnRule.BatchParametersProperty = baseBatchParameters;
-
     return {
       id: '',
       arn: this.jobQueue.jobQueueArn,
+      // When scoping resource-level access for job submission, you must provide both job queue and job definition resource types.
+      // https://docs.aws.amazon.com/batch/latest/userguide/ExamplePolicies_BATCH.html#iam-example-restrict-job-def
       role: singletonEventRole(this.jobDefinition, [
         new iam.PolicyStatement({
           actions: ['batch:SubmitJob'],
-          resources: [this.jobDefinition.jobDefinitionArn]
+          resources: [
+            this.jobDefinition.jobDefinitionArn,
+            this.jobQueue.jobQueueArn,
+          ]
         })
       ]),
       input: this.props.event,

diff --git a/packages/@aws-cdk/aws-events-targets/test/batch/batch.test.ts b/packages/@aws-cdk/aws-events-targets/test/batch/batch.test.ts
@@ -45,35 +45,11 @@ test('use aws batch job as an eventrule target', () => {
             'MyJobEventsRoleCF43C336',
             'Arn'
           ]
-        }
-      }
-    ]
-  }));
-  expect(stack).to(haveResource('AWS::IAM::Role', {
-    AssumeRolePolicyDocument: {
-      Statement: [
-        {
-          Action: 'sts:AssumeRole',
-          Effect: 'Allow',
-          Principal: {
-            Service: 'batch.amazonaws.com'
-          }
-        }
-      ],
-      Version: '2012-10-17'
-    },
-    ManagedPolicyArns: [
-      {
-        'Fn::Join': [
-          '',
-          [
-            'arn:',
-            {
-              Ref: 'AWS::Partition'
-            },
-            ':iam::aws:policy/service-role/AWSBatchServiceRole'
-          ]
-        ]
+        },
+        BatchParameters: {
+          JobDefinition: { Ref: 'MyJob8719E923' },
+          JobName: 'Rule'
+        },
       }
     ]
   }));
@@ -84,18 +60,16 @@ test('use aws batch job as an eventrule target', () => {
         {
           Action: 'batch:SubmitJob',
           Effect: 'Allow',
-          Resource: {
-            Ref: 'MyJob8719E923'
-          }
+          Resource: [
+            { Ref: 'MyJob8719E923' },
+            { Ref: 'MyQueueE6CA6235' }
+          ],
         }
       ],
       Version: '2012-10-17'
     },
-    PolicyName: 'MyJobEventsRoleDefaultPolicy7266D3A7',
     Roles: [
-      {
-        Ref: 'MyJobEventsRoleCF43C336'
-      }
+      { Ref: 'MyJobEventsRoleCF43C336' }
     ]
   }));
 });