feat(iotevents): add grant method to Input class

packages/@aws-cdk/aws-iotevents/README.md

@@ -67,3 +67,11 @@ new iotevents.DetectorModel(this, 'MyDetectorModel', {
   initialState: onlineState,
 });
 ```
+
+For grant the permittion to put message to the input, you can use
+`grantPutMessage()` as following;
+
+```ts
+declare const principal: iam.AnyPrincipal;
+input.grantPutMessage(principal);
+```

packages/@aws-cdk/aws-iotevents/lib/input.ts

@@ -1,3 +1,4 @@
+import * as iam from '@aws-cdk/aws-iam';
 import { Resource, IResource } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { CfnInput } from './iotevents.generated';
@@ -11,8 +12,66 @@ export interface IInput extends IResource {
    * @attribute
    */
   readonly inputName: string;
+
+  /**
+   * The ARN of the input
+   * @attribute
+   */
+  readonly inputArn: string;
+
+  /**
+   * Grant the indicated permissions on this input to the given IAM principal (Role/Group/User).
+   *
+   * @param grantee The principal (no-op if undefined)
+   * @param actions The set of actions to allow (i.e. "iotevents:BatchPutMessage")
+   */
+  grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant
+
+  /**
+   * Grant the putting message permission to the given IAM principal (Role/Group/User).
+   *
+   * @param grantee The principal (no-op if undefined)
+   */
+  grantPutMessage(grantee: iam.IGrantable): iam.Grant
 }
 
+
+abstract class InputBase extends Resource implements IInput {
+  /**
+   * @attribute
+   */
+  public abstract readonly inputName: string;
+  /**
+   * @attribute
+   */
+  public abstract readonly inputArn: string;
+
+  /**
+   * Grant the indicated permissions on this input to the given IAM principal (Role/Group/User).
+   *
+   * @param grantee The principal (no-op if undefined)
+   * @param actions The set of actions to allow (i.e. "iotevents:BatchPutMessage")
+   */
+  public grant(grantee: iam.IGrantable, ...actions: string[]) {
+    return iam.Grant.addToPrincipal({
+      grantee,
+      actions,
+      resourceArns: [this.inputArn],
+      scope: this,
+    });
+  }
+
+  /**
+   * Grant the putting message permission to the given IAM principal (Role/Group/User).
+   *
+   * @param grantee The principal (no-op if undefined)
+   */
+  public grantPutMessage(grantee: iam.IGrantable) {
+    return this.grant(grantee, 'iotevents:BatchPutMessage');
+  }
+}
+
+
 /**
  * Properties for defining an AWS IoT Events input
  */
@@ -37,18 +96,23 @@ export interface InputProps {
 /**
  * Defines an AWS IoT Events input in this stack.
  */
-export class Input extends Resource implements IInput {
+export class Input extends InputBase {
   /**
    * Import an existing input
    */
   public static fromInputName(scope: Construct, id: string, inputName: string): IInput {
-    class Import extends Resource implements IInput {
+    return new class Import extends InputBase {
       public readonly inputName = inputName;
-    }
-    return new Import(scope, id);
+      public readonly inputArn = this.stack.formatArn({
+        service: 'iotevents',
+        resource: 'input',
+        resourceName: inputName,
+      });
+    }(scope, id);
   }
 
   public readonly inputName: string;
+  public readonly inputArn: string;
 
   constructor(scope: Construct, id: string, props: InputProps) {
     super(scope, id, {
@@ -67,5 +131,10 @@ export class Input extends Resource implements IInput {
     });
 
     this.inputName = this.getResourceNameAttribute(resource.ref);
+    this.inputArn = this.stack.formatArn({
+      service: 'iotevents',
+      resource: 'input',
+      resourceName: this.inputName,
+    });
   }
 }

packages/@aws-cdk/aws-iotevents/test/input.test.ts

@@ -1,10 +1,14 @@
 import { Template } from '@aws-cdk/assertions';
+import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
 import * as iotevents from '../lib';
 
-test('Default property', () => {
-  const stack = new cdk.Stack();
+let stack: cdk.Stack;
+beforeEach(() => {
+  stack = new cdk.Stack();
+});
 
+test('Default property', () => {
   // WHEN
   new iotevents.Input(stack, 'MyInput', {
     attributeJsonPaths: ['payload.temperature'],
@@ -19,7 +23,6 @@ test('Default property', () => {
 });
 
 test('can get input name', () => {
-  const stack = new cdk.Stack();
   // GIVEN
   const input = new iotevents.Input(stack, 'MyInput', {
     attributeJsonPaths: ['payload.temperature'],
@@ -39,9 +42,41 @@ test('can get input name', () => {
   });
 });
 
-test('can set physical name', () => {
-  const stack = new cdk.Stack();
+test('can get input ARN', () => {
+  // GIVEN
+  const input = new iotevents.Input(stack, 'MyInput', {
+    attributeJsonPaths: ['payload.temperature'],
+  });
 
+  // WHEN
+  new cdk.CfnResource(stack, 'Res', {
+    type: 'Test::Resource',
+    properties: {
+      InputArn: input.inputArn,
+    },
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('Test::Resource', {
+    InputArn: {
+      'Fn::Join': [
+        '',
+        [
+          'arn:',
+          { Ref: 'AWS::Partition' },
+          ':iotevents:',
+          { Ref: 'AWS::Region' },
+          ':',
+          { Ref: 'AWS::AccountId' },
+          ':input/',
+          { Ref: 'MyInput08947B23' },
+        ],
+      ],
+    },
+  });
+});
+
+test('can set physical name', () => {
   // WHEN
   new iotevents.Input(stack, 'MyInput', {
     inputName: 'test_input',
@@ -55,8 +90,6 @@ test('can set physical name', () => {
 });
 
 test('can import a Input by inputName', () => {
-  const stack = new cdk.Stack();
-
   // WHEN
   const inputName = 'test-input-name';
   const topicRule = iotevents.Input.fromInputName(stack, 'InputFromInputName', inputName);
@@ -68,11 +101,48 @@ test('can import a Input by inputName', () => {
 });
 
 test('cannot be created with an empty array of attributeJsonPaths', () => {
-  const stack = new cdk.Stack();
-
   expect(() => {
     new iotevents.Input(stack, 'MyInput', {
       attributeJsonPaths: [],
     });
   }).toThrow('attributeJsonPaths property cannot be empty');
 });
+
+
+test('can grant the permission to put message', () => {
+  const role = iam.Role.fromRoleArn(stack, 'MyRole', 'arn:aws:iam::account-id:role/role-name');
+  const input = new iotevents.Input(stack, 'MyInput', {
+    inputName: 'test_input',
+    attributeJsonPaths: ['payload.temperature'],
+  });
+
+  // WHEN
+  input.grantPutMessage(role);
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+    PolicyDocument: {
+      Statement: [
+        {
+          Action: 'iotevents:BatchPutMessage',
+          Effect: 'Allow',
+          Resource: {
+            'Fn::Join': [
+              '',
+              [
+                'arn:',
+                { Ref: 'AWS::Partition' },
+                ':iotevents:',
+                { Ref: 'AWS::Region' },
+                ':',
+                { Ref: 'AWS::AccountId' },
+                ':input/',
+                { Ref: 'MyInput08947B23' },
+              ],
+            ],
+          },
+        },
+      ],
+    },
+  });
+});