Skip to content

Commit 3d1c06e

Browse files
mergify[bot]mergify[bot]
authored
chore(release): 2.141.0 (#30111)
See [CHANGELOG](https://github.com/aws/aws-cdk/blob/bump/2.141.0/CHANGELOG.md)
2 parents 46168aa + 33d0ffb commit 3d1c06e

File tree

52 files changed

+1621
-168
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+1621
-168
lines changed

‎CHANGELOG.v2.alpha.md

+2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
44

5+
## [2.141.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.140.0-alpha.0...v2.141.0-alpha.0) (2024-05-08)
6+
57
## [2.140.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.139.1-alpha.0...v2.140.0-alpha.0) (2024-05-02)
68

79
## [2.139.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.139.0-alpha.0...v2.139.1-alpha.0) (2024-04-29)

‎CHANGELOG.v2.md

+15
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,21 @@
22

33
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
44

5+
## [2.141.0](https://github.com/aws/aws-cdk/compare/v2.140.0...v2.141.0) (2024-05-08)
6+
7+
8+
### Features
9+
10+
* **rds:** implement setting parameter group name ([#29965](https://github.com/aws/aws-cdk/issues/29965)) ([50331a1](https://github.com/aws/aws-cdk/commit/50331a19cfbe30e3d46f8eed15d74d5975fb1527))
11+
* support for IAM Identity Center in security diff ([#30009](https://github.com/aws/aws-cdk/issues/30009)) ([0a3cb94](https://github.com/aws/aws-cdk/commit/0a3cb94b9c3c945fa52d36f402b628a330066e5b)), closes [#29835](https://github.com/aws/aws-cdk/issues/29835)
12+
* update L1 CloudFormation resource definitions ([#30074](https://github.com/aws/aws-cdk/issues/30074)) ([8e98078](https://github.com/aws/aws-cdk/commit/8e98078a54896b7a9531ba4b11bb0c6221383e34))
13+
14+
15+
### Bug Fixes
16+
17+
* **ecr:** incorrect format for rule pattern ([#29243](https://github.com/aws/aws-cdk/issues/29243)) ([fff9cf6](https://github.com/aws/aws-cdk/commit/fff9cf694b14811682c8671a1e55afa53151df8b)), closes [#29225](https://github.com/aws/aws-cdk/issues/29225)
18+
* **pipelines:** pipeline asset role trust policy has account root principal ([#30084](https://github.com/aws/aws-cdk/issues/30084)) ([3928eae](https://github.com/aws/aws-cdk/commit/3928eae1ee92a03ba9959288f05f59d6bd5edcba))
19+
520
## [2.140.0](https://github.com/aws/aws-cdk/compare/v2.139.1...v2.140.0) (2024-05-02)
621

722

‎packages/@aws-cdk-testing/cli-integ/lib/aws.ts

+2
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ export class AwsClients {
1919
public readonly s3: AwsCaller<AWS.S3>;
2020
public readonly ecr: AwsCaller<AWS.ECR>;
2121
public readonly ecs: AwsCaller<AWS.ECS>;
22+
public readonly sso: AwsCaller<AWS.SSO>;
2223
public readonly sns: AwsCaller<AWS.SNS>;
2324
public readonly iam: AwsCaller<AWS.IAM>;
2425
public readonly lambda: AwsCaller<AWS.Lambda>;
@@ -36,6 +37,7 @@ export class AwsClients {
3637
this.s3 = makeAwsCaller(AWS.S3, this.config);
3738
this.ecr = makeAwsCaller(AWS.ECR, this.config);
3839
this.ecs = makeAwsCaller(AWS.ECS, this.config);
40+
this.sso = makeAwsCaller(AWS.SSO, this.config);
3941
this.sns = makeAwsCaller(AWS.SNS, this.config);
4042
this.iam = makeAwsCaller(AWS.IAM, this.config);
4143
this.lambda = makeAwsCaller(AWS.Lambda, this.config);

‎packages/@aws-cdk-testing/cli-integ/resources/cdk-apps/app/app.js

+65
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ if (process.env.PACKAGE_LAYOUT_VERSION === '1') {
1111
var sns = require('@aws-cdk/aws-sns');
1212
var sqs = require('@aws-cdk/aws-sqs');
1313
var lambda = require('@aws-cdk/aws-lambda');
14+
var sso = require('@aws-cdk/aws-sso');
1415
var docker = require('@aws-cdk/aws-ecr-assets');
1516
} else {
1617
var cdk = require('aws-cdk-lib');
@@ -19,6 +20,7 @@ if (process.env.PACKAGE_LAYOUT_VERSION === '1') {
1920
LegacyStackSynthesizer,
2021
aws_ec2: ec2,
2122
aws_ecs: ecs,
23+
aws_sso: sso,
2224
aws_s3: s3,
2325
aws_ssm: ssm,
2426
aws_iam: iam,
@@ -68,6 +70,62 @@ class YourStack extends cdk.Stack {
6870
}
6971
}
7072

73+
class SsoPermissionSetNoPolicy extends Stack {
74+
constructor(scope, id) {
75+
super(scope, id);
76+
77+
new sso.CfnPermissionSet(this, "permission-set-without-managed-policy", {
78+
instanceArn: 'arn:aws:sso:::instance/testvalue',
79+
name: 'testName',
80+
permissionsBoundary: { customerManagedPolicyReference: { name: 'why', path: '/how/' }},
81+
})
82+
}
83+
}
84+
85+
class SsoPermissionSetManagedPolicy extends Stack {
86+
constructor(scope, id) {
87+
super(scope, id);
88+
new sso.CfnPermissionSet(this, "permission-set-with-managed-policy", {
89+
managedPolicies: ['arn:aws:iam::aws:policy/administratoraccess'],
90+
customerManagedPolicyReferences: [{ name: 'forSSO' }],
91+
permissionsBoundary: { managedPolicyArn: 'arn:aws:iam::aws:policy/AdministratorAccess' },
92+
instanceArn: 'arn:aws:sso:::instance/testvalue',
93+
name: 'niceWork',
94+
})
95+
}
96+
}
97+
98+
class SsoAssignment extends Stack {
99+
constructor(scope, id) {
100+
super(scope, id);
101+
new sso.CfnAssignment(this, "assignment", {
102+
instanceArn: 'arn:aws:sso:::instance/testvalue',
103+
permissionSetArn: 'arn:aws:sso:::testvalue',
104+
principalId: '11111111-2222-3333-4444-test',
105+
principalType: 'USER',
106+
targetId: '111111111111',
107+
targetType: 'AWS_ACCOUNT'
108+
});
109+
}
110+
}
111+
112+
class SsoInstanceAccessControlConfig extends Stack {
113+
constructor(scope, id) {
114+
super(scope, id);
115+
new sso.CfnInstanceAccessControlAttributeConfiguration(this, 'instanceAccessControlConfig', {
116+
instanceArn: 'arn:aws:sso:::instance/testvalue',
117+
accessControlAttributes: [
118+
{ key: 'first', value: { source: ['a'] } },
119+
{ key: 'second', value: { source: ['b'] } },
120+
{ key: 'third', value: { source: ['c'] } },
121+
{ key: 'fourth', value: { source: ['d'] } },
122+
{ key: 'fifth', value: { source: ['e'] } },
123+
{ key: 'sixth', value: { source: ['f'] } },
124+
]
125+
})
126+
}
127+
}
128+
71129
class ListMultipleDependentStack extends Stack {
72130
constructor(scope, id) {
73131
super(scope, id);
@@ -591,6 +649,13 @@ switch (stackSet) {
591649
new EcsHotswapStack(app, `${stackPrefix}-ecs-hotswap`);
592650
new DockerStack(app, `${stackPrefix}-docker`);
593651
new DockerStackWithCustomFile(app, `${stackPrefix}-docker-with-custom-file`);
652+
653+
// SSO stacks
654+
new SsoInstanceAccessControlConfig(app, `${stackPrefix}-sso-access-control`);
655+
new SsoAssignment(app, `${stackPrefix}-sso-assignment`);
656+
new SsoPermissionSetManagedPolicy(app, `${stackPrefix}-sso-perm-set-with-managed-policy`);
657+
new SsoPermissionSetNoPolicy(app, `${stackPrefix}-sso-perm-set-without-managed-policy`);
658+
594659
const failed = new FailedStack(app, `${stackPrefix}-failed`)
595660

596661
// A stack that depends on the failed stack -- used to test that '-e' does not deploy the failing stack

‎packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts

+152
Original file line numberDiff line numberDiff line change
@@ -775,6 +775,158 @@ integTest('cdk diff --fail with multiple stack exits with if any of the stacks c
775775
await expect(fixture.cdk(['diff', '--fail', fixture.fullStackName('test-1'), fixture.fullStackName('test-2')])).rejects.toThrow('exited with error');
776776
}));
777777

778+
integTest('cdk diff --security-only successfully outputs sso-permission-set-without-managed-policy information', withDefaultFixture(async (fixture) => {
779+
const diff = await fixture.cdk(
780+
['diff', '--security-only', fixture.fullStackName('sso-perm-set-without-managed-policy')],
781+
);
782+
`┌───┬──────────────────────────────────────────┬──────────────────────────────────┬────────────────────┬───────────────────────────────────┬─────────────────────────────────┐
783+
│ │ Resource │ InstanceArn │ PermissionSet name │ PermissionsBoundary │ CustomerManagedPolicyReferences │
784+
├───┼──────────────────────────────────────────┼──────────────────────────────────┼────────────────────┼───────────────────────────────────┼─────────────────────────────────┤
785+
│ + │\${permission-set-without-managed-policy} │ arn:aws:sso:::instance/testvalue │ testName │ CustomerManagedPolicyReference: { │ │
786+
│ │ │ │ │ Name: why, Path: /how/ │ │
787+
│ │ │ │ │ } │ │
788+
`;
789+
expect(diff).toContain('Resource');
790+
expect(diff).toContain('permission-set-without-managed-policy');
791+
792+
expect(diff).toContain('InstanceArn');
793+
expect(diff).toContain('arn:aws:sso:::instance/testvalue');
794+
795+
expect(diff).toContain('PermissionSet name');
796+
expect(diff).toContain('testName');
797+
798+
expect(diff).toContain('PermissionsBoundary');
799+
expect(diff).toContain('CustomerManagedPolicyReference: {');
800+
expect(diff).toContain('Name: why, Path: /how/');
801+
expect(diff).toContain('}');
802+
803+
expect(diff).toContain('CustomerManagedPolicyReferences');
804+
}));
805+
806+
integTest('cdk diff --security-only successfully outputs sso-permission-set-with-managed-policy information', withDefaultFixture(async (fixture) => {
807+
const diff = await fixture.cdk(
808+
['diff', '--security-only', fixture.fullStackName('sso-perm-set-with-managed-policy')],
809+
);
810+
`┌───┬──────────────────────────────────────────┬──────────────────────────────────┬────────────────────┬───────────────────────────────────────────────────────────────┬─────────────────────────────────┐
811+
│ │ Resource │ InstanceArn │ PermissionSet name │ PermissionsBoundary │ CustomerManagedPolicyReferences │
812+
├───┼──────────────────────────────────────────┼──────────────────────────────────┼────────────────────┼───────────────────────────────────────────────────────────────┼─────────────────────────────────┤
813+
│ + │\${permission-set-with-managed-policy} │ arn:aws:sso:::instance/testvalue │ niceWork │ ManagedPolicyArn: arn:aws:iam::aws:policy/AdministratorAccess │ Name: forSSO, Path: │
814+
`;
815+
816+
expect(diff).toContain('Resource');
817+
expect(diff).toContain('permission-set-with-managed-policy');
818+
819+
expect(diff).toContain('InstanceArn');
820+
expect(diff).toContain('arn:aws:sso:::instance/testvalue');
821+
822+
expect(diff).toContain('PermissionSet name');
823+
expect(diff).toContain('niceWork');
824+
825+
expect(diff).toContain('PermissionsBoundary');
826+
expect(diff).toContain('ManagedPolicyArn: arn:aws:iam::aws:policy/AdministratorAccess');
827+
828+
expect(diff).toContain('CustomerManagedPolicyReferences');
829+
expect(diff).toContain('Name: forSSO, Path:');
830+
}));
831+
832+
integTest('cdk diff --security-only successfully outputs sso-assignment information', withDefaultFixture(async (fixture) => {
833+
const diff = await fixture.cdk(
834+
['diff', '--security-only', fixture.fullStackName('sso-assignment')],
835+
);
836+
`┌───┬───────────────┬──────────────────────────────────┬─────────────────────────┬──────────────────────────────┬───────────────┬──────────────┬─────────────┐
837+
│ │ Resource │ InstanceArn │ PermissionSetArn │ PrincipalId │ PrincipalType │ TargetId │ TargetType │
838+
├───┼───────────────┼──────────────────────────────────┼─────────────────────────┼──────────────────────────────┼───────────────┼──────────────┼─────────────┤
839+
│ + │\${assignment} │ arn:aws:sso:::instance/testvalue │ arn:aws:sso:::testvalue │ 11111111-2222-3333-4444-test │ USER │ 111111111111 │ AWS_ACCOUNT │
840+
└───┴───────────────┴──────────────────────────────────┴─────────────────────────┴──────────────────────────────┴───────────────┴──────────────┴─────────────┘
841+
`;
842+
expect(diff).toContain('Resource');
843+
expect(diff).toContain('assignment');
844+
845+
expect(diff).toContain('InstanceArn');
846+
expect(diff).toContain('arn:aws:sso:::instance/testvalue');
847+
848+
expect(diff).toContain('PermissionSetArn');
849+
expect(diff).toContain('arn:aws:sso:::testvalue');
850+
851+
expect(diff).toContain('PrincipalId');
852+
expect(diff).toContain('11111111-2222-3333-4444-test');
853+
854+
expect(diff).toContain('PrincipalType');
855+
expect(diff).toContain('USER');
856+
857+
expect(diff).toContain('TargetId');
858+
expect(diff).toContain('111111111111');
859+
860+
expect(diff).toContain('TargetType');
861+
expect(diff).toContain('AWS_ACCOUNT');
862+
}));
863+
864+
integTest('cdk diff --security-only successfully outputs sso-access-control information', withDefaultFixture(async (fixture) => {
865+
const diff = await fixture.cdk(
866+
['diff', '--security-only', fixture.fullStackName('sso-access-control')],
867+
);
868+
`┌───┬────────────────────────────────┬────────────────────────┬─────────────────────────────────┐
869+
│ │ Resource │ InstanceArn │ AccessControlAttributes │
870+
├───┼────────────────────────────────┼────────────────────────┼─────────────────────────────────┤
871+
│ + │\${instanceAccessControlConfig} │ arn:aws:test:testvalue │ Key: first, Values: [a] │
872+
│ │ │ │ Key: second, Values: [b] │
873+
│ │ │ │ Key: third, Values: [c] │
874+
│ │ │ │ Key: fourth, Values: [d] │
875+
│ │ │ │ Key: fifth, Values: [e] │
876+
│ │ │ │ Key: sixth, Values: [f] │
877+
└───┴────────────────────────────────┴────────────────────────┴─────────────────────────────────┘
878+
`;
879+
expect(diff).toContain('Resource');
880+
expect(diff).toContain('instanceAccessControlConfig');
881+
882+
expect(diff).toContain('InstanceArn');
883+
expect(diff).toContain('arn:aws:sso:::instance/testvalue');
884+
885+
expect(diff).toContain('AccessControlAttributes');
886+
expect(diff).toContain('Key: first, Values: [a]');
887+
expect(diff).toContain('Key: second, Values: [b]');
888+
expect(diff).toContain('Key: third, Values: [c]');
889+
expect(diff).toContain('Key: fourth, Values: [d]');
890+
expect(diff).toContain('Key: fifth, Values: [e]');
891+
expect(diff).toContain('Key: sixth, Values: [f]');
892+
}));
893+
894+
integTest('cdk diff --security-only --fail exits when security diff for sso access control config', withDefaultFixture(async (fixture) => {
895+
await expect(
896+
fixture.cdk(
897+
['diff', '--security-only', '--fail', fixture.fullStackName('sso-access-control')],
898+
),
899+
).rejects
900+
.toThrow('exited with error');
901+
}));
902+
903+
integTest('cdk diff --security-only --fail exits when security diff for sso-perm-set-without-managed-policy', withDefaultFixture(async (fixture) => {
904+
await expect(
905+
fixture.cdk(
906+
['diff', '--security-only', '--fail', fixture.fullStackName('sso-perm-set-without-managed-policy')],
907+
),
908+
).rejects
909+
.toThrow('exited with error');
910+
}));
911+
912+
integTest('cdk diff --security-only --fail exits when security diff for sso-perm-set-with-managed-policy', withDefaultFixture(async (fixture) => {
913+
await expect(
914+
fixture.cdk(
915+
['diff', '--security-only', '--fail', fixture.fullStackName('sso-perm-set-with-managed-policy')],
916+
),
917+
).rejects
918+
.toThrow('exited with error');
919+
}));
920+
921+
integTest('cdk diff --security-only --fail exits when security diff for sso-assignment', withDefaultFixture(async (fixture) => {
922+
await expect(
923+
fixture.cdk(
924+
['diff', '--security-only', '--fail', fixture.fullStackName('sso-assignment')],
925+
),
926+
).rejects
927+
.toThrow('exited with error');
928+
}));
929+
778930
integTest('cdk diff --security-only --fail exits when security changes are present', withDefaultFixture(async (fixture) => {
779931
const stackName = 'iam-test';
780932
await expect(fixture.cdk(['diff', '--security-only', '--fail', fixture.fullStackName(stackName)])).rejects.toThrow('exited with error');

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecr/test/integ.basic.js.snapshot/aws-ecr-integ-stack.assets.json

+3-3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)