Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: remove incorrect logic from complete example #671

Closed
wants to merge 1 commit into from
Closed

fix: remove incorrect logic from complete example #671

wants to merge 1 commit into from

Conversation

DavidJFelix
Copy link

  • Replace aws:SourceVpce conditions
  • Remove aws_vpc_endpoint_service data objects

Description

Fix Complete VPC example code by removing several incorrect examples.

Motivation and Context

  • Firstly, it makes no sense to use aws:SourceVpce in a VPC endpoint IAM policy; all traffic that the VPC endpoint will receive will always have its own id here. You can read more about this key here under the section titled "Use IAM policies to control access to DynamoDB", in which the document states (emphasis mine):

"You can create an IAM policy for your IAM users, groups, or roles to restrict access to DynamoDB tables from a specific VPC endpoint only. To do this, you can use the aws:sourceVpce condition key for the table resource in your IAM policy."

  • Secondly, at some point there was a change from the data aws_vpc_endpoint to aws_vpc_endpoint_service. It's important to note this because previously the code used data.aws_vpc_endpoint.dynamodb.id which does exist and provides an id like vpce-12345 but was later replaced by data.aws_vpc_endpoint_service.dynamodb.id. You can see here that id is not a valid attribute and the output of this data type was a numerical id like 1234 that seemed to have no bearing to vpc, vpc endpoint or any other active resource.

The changes I've made continue to provide a policy for an example case, but the example now provides a somewhat more sensible value. In the new example code, the deny rule is set to reject any users who are outside of the current account.

Breaking Changes

This does not break any module code as it only affects an example

How Has This Been Tested?

  • I have tested and validated these changes using one or more of the provided examples/* projects
    I had to extensively debug why the example wasn't working and have cited all of my documentation.

- Replace `aws:SourceVpce` conditions
- Remove `aws_vpc_endpoint_service` data objects
@github-actions
Copy link

This PR has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this PR will be closed in 10 days

@antonbabenko
Copy link
Member

This issue has been resolved in version 3.11.3 🎉

@github-actions
Copy link

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Oct 29, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants