Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(scheduler-targets-alpha): scope down permissions for sqs and kinesis stream targets #32122

Merged
merged 2 commits into from
Nov 15, 2024

Conversation

gracelu0
Copy link
Contributor

@gracelu0 gracelu0 commented Nov 14, 2024

Issue # (if applicable)

Tracking #31785

Reason for this change

We want to enforce principle of least privilege when granting target actions to the scheduler execution role. From the Scheduler docs, only kinesis:PutRecord and sqs:SendMessage are required. Previously we were using built-in grant methods for these targets that granted additional permissions. If wider permissions are needed the user can always provide their own IAM role for the scheduler to use.

KMS permissions references from service docs:

Description of changes

  • Explicitly grant only the necessary target permissions
  • If target uses customer-managed key for SSEKMS, grant key permissions to role as well

Description of how you validated changes

  • updated unit tests
  • deployed stacks with SSEKMS targets and verified the scheduled actions succeed

Checklist


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

BREAKING CHANGE: Extra permissions are removed from Schedule execution role for SQS and Kinesis Stream schedules.

@github-actions github-actions bot added the p2 label Nov 14, 2024
@aws-cdk-automation aws-cdk-automation requested a review from a team November 14, 2024 03:20
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Nov 14, 2024
Copy link

codecov bot commented Nov 14, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 77.19%. Comparing base (1bbb456) to head (49ab2f1).
Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main   #32122   +/-   ##
=======================================
  Coverage   77.19%   77.19%           
=======================================
  Files         105      105           
  Lines        7164     7164           
  Branches     1311     1311           
=======================================
  Hits         5530     5530           
  Misses       1454     1454           
  Partials      180      180           
Flag Coverage Δ
suite.unit 77.19% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components Coverage Δ
packages/aws-cdk 77.19% <ø> (ø)

@aws-cdk-automation aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Nov 14, 2024
@shikha372 shikha372 self-assigned this Nov 14, 2024
@shikha372
Copy link
Contributor

shikha372 commented Nov 14, 2024

Thanks Grace, changes are looking good, though I see there are some assertions added to integration tests, before approving want to confirm if we've also verified it in console that reducing these permissions is not affecting the functionality.

@gracelu0
Copy link
Contributor Author

Thanks Grace, changes are looking good, though I see there are some assertions added to integration tests, before approving want to confirm if we've also verified it in console that reducing these permissions is not affecting the functionality.

Thanks Shikha! Yes I deployed stacks from integ tests locally and verified in the console the schedule successfully invokes the targets (i.e. message is received by SQS queue and record is received by Kinesis stream).

Copy link
Contributor

mergify bot commented Nov 14, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Nov 14, 2024
Copy link
Contributor

mergify bot commented Nov 14, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Copy link
Contributor

mergify bot commented Nov 15, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 49ab2f1
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit 6bb142e into aws:main Nov 15, 2024
17 checks passed
Copy link
Contributor

mergify bot commented Nov 15, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Copy link

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 15, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
contribution/core This is a PR that came from AWS. p2
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants