Skip to content

Commit 2902043

Browse files
zorrofoxzorrofox
authored
fix(iam): SamlConsolePrincipal does not work in China #22091 (#24034)
Support SamlConsolePrincipal for China and GOV partitions. Closes #22091. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 1e8926f commit 2902043

File tree

9 files changed

+81
-30
lines changed

9 files changed

+81
-30
lines changed

‎packages/@aws-cdk/aws-iam/lib/principals.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -736,7 +736,7 @@ export class SamlConsolePrincipal extends SamlPrincipal {
736736
super(samlProvider, {
737737
...conditions,
738738
StringEquals: {
739-
'SAML:aud': 'https://signin.aws.amazon.com/saml',
739+
'SAML:aud': cdk.Aws.PARTITION==='aws-cn'? 'https://signin.amazonaws.cn/saml': `https://signin.${cdk.Aws.URL_SUFFIX}/saml`,
740740
},
741741
});
742742
}

‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/cdk-saml-provider.assets.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "20.0.0",
2+
"version": "29.0.0",
33
"files": {
4-
"3b60cda5eb73f658ff1ab1a242bd0e399cc5307d4d6493cea0171e543c6f1cc8": {
4+
"adc0eedec883653ef9cbd8c66ae68791bf952df8f678cf586e78e02997e2674c": {
55
"source": {
66
"path": "cdk-saml-provider.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "3b60cda5eb73f658ff1ab1a242bd0e399cc5307d4d6493cea0171e543c6f1cc8.json",
12+
"objectKey": "adc0eedec883653ef9cbd8c66ae68791bf952df8f678cf586e78e02997e2674c.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/cdk-saml-provider.template.json

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,18 @@
1515
"Action": "sts:AssumeRoleWithSAML",
1616
"Condition": {
1717
"StringEquals": {
18-
"SAML:aud": "https://signin.aws.amazon.com/saml"
18+
"SAML:aud": {
19+
"Fn::Join": [
20+
"",
21+
[
22+
"https://signin.",
23+
{
24+
"Ref": "AWS::URLSuffix"
25+
},
26+
"/saml"
27+
]
28+
]
29+
}
1930
}
2031
},
2132
"Effect": "Allow",
@@ -27,7 +38,8 @@
2738
}
2839
],
2940
"Version": "2012-10-17"
30-
}
41+
},
42+
"Description": "fix the partition issue"
3143
}
3244
}
3345
},

‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/cdk.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"20.0.0"}
1+
{"version":"29.0.0"}

‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/integ.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "20.0.0",
2+
"version": "29.0.0",
33
"testCases": {
44
"integ.saml-provider": {
55
"stacks": [

‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/manifest.json

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
{
2-
"version": "20.0.0",
2+
"version": "29.0.0",
33
"artifacts": {
4-
"Tree": {
5-
"type": "cdk:tree",
6-
"properties": {
7-
"file": "tree.json"
8-
}
9-
},
104
"cdk-saml-provider.assets": {
115
"type": "cdk:asset-manifest",
126
"properties": {
@@ -23,7 +17,7 @@
2317
"validateOnSynth": false,
2418
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
2519
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/3b60cda5eb73f658ff1ab1a242bd0e399cc5307d4d6493cea0171e543c6f1cc8.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/adc0eedec883653ef9cbd8c66ae68791bf952df8f678cf586e78e02997e2674c.json",
2721
"requiresBootstrapStackVersion": 6,
2822
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2923
"additionalDependencies": [
@@ -65,6 +59,12 @@
6559
]
6660
},
6761
"displayName": "cdk-saml-provider"
62+
},
63+
"Tree": {
64+
"type": "cdk:tree",
65+
"properties": {
66+
"file": "tree.json"
67+
}
6868
}
6969
}
7070
}

‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/tree.json

Lines changed: 49 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,6 @@
44
"id": "App",
55
"path": "",
66
"children": {
7-
"Tree": {
8-
"id": "Tree",
9-
"path": "Tree",
10-
"constructInfo": {
11-
"fqn": "constructs.Construct",
12-
"version": "10.1.85"
13-
}
14-
},
157
"cdk-saml-provider": {
168
"id": "cdk-saml-provider",
179
"path": "cdk-saml-provider",
@@ -44,6 +36,14 @@
4436
"id": "Role",
4537
"path": "cdk-saml-provider/Role",
4638
"children": {
39+
"ImportRole": {
40+
"id": "ImportRole",
41+
"path": "cdk-saml-provider/Role/ImportRole",
42+
"constructInfo": {
43+
"fqn": "@aws-cdk/core.Resource",
44+
"version": "0.0.0"
45+
}
46+
},
4747
"Resource": {
4848
"id": "Resource",
4949
"path": "cdk-saml-provider/Role/Resource",
@@ -56,7 +56,18 @@
5656
"Action": "sts:AssumeRoleWithSAML",
5757
"Condition": {
5858
"StringEquals": {
59-
"SAML:aud": "https://signin.aws.amazon.com/saml"
59+
"SAML:aud": {
60+
"Fn::Join": [
61+
"",
62+
[
63+
"https://signin.",
64+
{
65+
"Ref": "AWS::URLSuffix"
66+
},
67+
"/saml"
68+
]
69+
]
70+
}
6071
}
6172
},
6273
"Effect": "Allow",
@@ -68,7 +79,8 @@
6879
}
6980
],
7081
"Version": "2012-10-17"
71-
}
82+
},
83+
"description": "fix the partition issue"
7284
}
7385
},
7486
"constructInfo": {
@@ -81,17 +93,41 @@
8193
"fqn": "@aws-cdk/aws-iam.Role",
8294
"version": "0.0.0"
8395
}
96+
},
97+
"BootstrapVersion": {
98+
"id": "BootstrapVersion",
99+
"path": "cdk-saml-provider/BootstrapVersion",
100+
"constructInfo": {
101+
"fqn": "@aws-cdk/core.CfnParameter",
102+
"version": "0.0.0"
103+
}
104+
},
105+
"CheckBootstrapVersion": {
106+
"id": "CheckBootstrapVersion",
107+
"path": "cdk-saml-provider/CheckBootstrapVersion",
108+
"constructInfo": {
109+
"fqn": "@aws-cdk/core.CfnRule",
110+
"version": "0.0.0"
111+
}
84112
}
85113
},
114+
"constructInfo": {
115+
"fqn": "@aws-cdk/core.Stack",
116+
"version": "0.0.0"
117+
}
118+
},
119+
"Tree": {
120+
"id": "Tree",
121+
"path": "Tree",
86122
"constructInfo": {
87123
"fqn": "constructs.Construct",
88-
"version": "10.1.85"
124+
"version": "10.1.237"
89125
}
90126
}
91127
},
92128
"constructInfo": {
93-
"fqn": "constructs.Construct",
94-
"version": "10.1.85"
129+
"fqn": "@aws-cdk/core.App",
130+
"version": "0.0.0"
95131
}
96132
}
97133
}

‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ class TestStack extends Stack {
1313

1414
new iam.Role(this, 'Role', {
1515
assumedBy: new iam.SamlConsolePrincipal(provider),
16+
description: 'fix the partition issue',
1617
});
1718
}
1819
}

‎packages/@aws-cdk/aws-iam/test/principals.test.ts

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,9 @@ test('SAML principal', () => {
166166
Action: 'sts:AssumeRoleWithSAML',
167167
Condition: {
168168
StringEquals: {
169-
'SAML:aud': 'https://signin.aws.amazon.com/saml',
169+
'SAML:aud': {
170+
'Fn::Join': ['', ['https://signin.', { Ref: 'AWS::URLSuffix' }, '/saml']],
171+
},
170172
},
171173
},
172174
Effect: 'Allow',

0 commit comments

Comments
 (0)