-
Notifications
You must be signed in to change notification settings - Fork 3.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
(aws-event-targets): Clarify that adding an imported SNS Topic as an event target does not set required permissions #25583
Comments
I think the better solution here is to clearly call this out in the |
I think we can focus on auditing/logging improvement, for example the reason why the rule fails. Not sure if it can be found from Cloudtrail or CloudWatch log. If the two resources are defined in two separate stacks, it makes sense to me to have "no-op" to comply with separate of concern. |
…event target does not set required permissions (#30279) ### Issue #25583 Closes #25583 ### Reason for this change Add documentation to clarify that imported topics have to have the required permissions set manually. ### Description of changes Added docstring. ### Description of how you validated changes ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
|
…event target does not set required permissions (aws#30279) ### Issue aws#25583 Closes aws#25583 ### Reason for this change Add documentation to clarify that imported topics have to have the required permissions set manually. ### Description of changes Added docstring. ### Description of how you validated changes ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…event target does not set required permissions (aws#30279) ### Issue aws#25583 Closes aws#25583 ### Reason for this change Add documentation to clarify that imported topics have to have the required permissions set manually. ### Description of changes Added docstring. ### Description of how you validated changes ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Describe the bug
aws_events_targets.SnsTopic
implicitly grants publish permissions on the Topic to the EventBus service principal.However, this silently is a no-op when the Topic is imported.
This is a particularly painful experience because there's very little visibility as to what is going on. All you see is FailedInvocations for your EventBus Rule, with no indication as to what is going on.
Expected Behavior
I expected using
aws_events_targets.SnsTopic
to wire up a working integration.Current Behavior
My integration didn't work because required permissions were not granted.
Reproduction Steps
Declare an SNS Topic in one stack. In another stack, import and use that Topic in a rule.
You'll see your rule has a failed invocation every minute.
Possible Solution
If I understand how permissions are granted via Resource Policy, it's either not possible or very complex to grant access to a Topic that's not declared in our current stack. However the silent failure is confusing, and in an ideal world you'd opt into having to set up permissions yourself. Something like:
And without setting
configure_permissions
toFalse
, synthesis would fail for an imported Topic.Additional Information/Context
No response
CDK CLI Version
2.79.1 (build 2e7f8b7)
Framework Version
2.79.1
Node.js Version
v16.18.1
OS
Ubuntu (Windows Subsystem for Linux)
Language
Python
Language Version
3.9.7
Other information
No response
The text was updated successfully, but these errors were encountered: