fix(cli): add validation of --notification-arns structure

packages/aws-cdk/lib/cdk-toolkit.ts

@@ -20,6 +20,7 @@ import { data, debug, error, highlight, print, success, warning } from './loggin
 import { deserializeStructure, serializeStructure } from './serialize';
 import { Configuration, PROJECT_CONFIG } from './settings';
 import { numberFromBool, partition } from './util';
+import { validateSnsTopicArn } from './util/validate-notification-arn';
 
 export interface CdkToolkitProps {
 
@@ -127,6 +128,14 @@ export class CdkToolkit {
       return this.watch(options);
     }
 
+    if (options.notificationArns) {
+      options.notificationArns.map( arn => {
+        if (!validateSnsTopicArn(arn)) {
+          throw new Error(`Notification arn ${arn} is not a valid arn for an SNS topic`);
+        }
+      });
+    }
+
     const startSynthTime = new Date().getTime();
     const stacks = await this.selectStacksForDeploy(options.selector, options.exclusively, options.cacheCloudAssembly);
     const elapsedSynthTime = new Date().getTime() - startSynthTime;

packages/aws-cdk/lib/util/validate-notification-arn.ts

@@ -0,0 +1,6 @@
+/**
+ * Validate SNS topic arn
+ */
+export function validateSnsTopicArn(arn: string): boolean {
+  return /^arn:aws:sns:[a-z0-9\-]+:[0-9]+:[a-z0-9\-\_]+$/i.test(arn);
+}

packages/aws-cdk/test/cdk-toolkit.test.ts

@@ -457,7 +457,10 @@ describe('deploy', () => {
 
     test('with sns notification arns', async () => {
       // GIVEN
-      const notificationArns = ['arn:aws:sns:::cfn-notifications', 'arn:aws:sns:::my-cool-topic'];
+      const notificationArns = [
+        'arn:aws:sns:us-east-2:444455556666:MyTopic',
+        'arn:aws:sns:eu-west-1:111155556666:my-great-topic',
+      ];
       const toolkit = new CdkToolkit({
         cloudExecutable,
         configuration: cloudExecutable.configuration,
@@ -475,8 +478,30 @@ describe('deploy', () => {
       });
     });
 
-    test('globless bootstrap uses environment without question', async () => {
+    test('fail with incorrect sns notification arns', async () => {
       // GIVEN
+      const notificationArns = ['arn:::cfn-my-cool-topic'];
+      const toolkit = new CdkToolkit({
+        cloudExecutable,
+        configuration: cloudExecutable.configuration,
+        sdkProvider: cloudExecutable.sdkProvider,
+        cloudFormation: new FakeCloudFormation({
+          'Test-Stack-A': { Foo: 'Bar' },
+        }, notificationArns),
+      });
+
+      // WHEN
+      await expect(() =>
+        toolkit.deploy({
+          selector: { patterns: ['Test-Stack-A'] },
+          notificationArns,
+        }),
+      ).rejects.toThrow('Notification arn arn:::cfn-my-cool-topic is not a valid arn for an SNS topic');
+
+    });
+
+    test('globless bootstrap uses environment without question', async () => {
+    // GIVEN
       const toolkit = defaultToolkitSetup();
 
       // WHEN

packages/aws-cdk/test/util/validate-notification-arn.test.ts

@@ -0,0 +1,29 @@
+import { validateSnsTopicArn } from '../../lib/util/validate-notification-arn';
+
+describe('validate sns arns', () => {
+  test('empty string', () => {
+    const arn = '';
+    expect(validateSnsTopicArn(arn)).toEqual(false);
+  });
+
+  test('colon in topic name', () => {
+    const arn = 'arn:aws:sns:eu-west-1:abc:foo';
+    expect(validateSnsTopicArn(arn)).toEqual(false);
+  });
+
+  test('missing :aws: in arn', () => {
+    const arn = 'arn:sns:eu-west-1:foobar';
+    expect(validateSnsTopicArn(arn)).toEqual(false);
+  });
+
+  test('dash in topic name', () => {
+    const arn = 'arn:aws:sns:eu-west-1:123456789876:foo-bar';
+    expect(validateSnsTopicArn(arn)).toEqual(true);
+  });
+
+  test('underscore in topic name', () => {
+    const arn = 'arn:aws:sns:eu-west-1:123456789876:foo-bar_baz';
+    expect(validateSnsTopicArn(arn)).toEqual(true);
+  });
+});
+