Skip to content

Commit 5e0f44b

Browse files
zorrofoxzorrofox
authored
feat(efs): support file system policy (#24196)
Add support EFS File System Policy. Closes #24042. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 844d407 commit 5e0f44b

12 files changed

+1817
-0
lines changed

‎packages/@aws-cdk/aws-efs/README.md

+27
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,33 @@ const importedFileSystem = efs.FileSystem.fromFileSystemAttributes(this, 'existi
6161
});
6262
```
6363

64+
### IAM to control file system data access
65+
66+
You can use both IAM identity policies and resource policies to control client access to Amazon EFS resources in a way that is scalable and optimized for cloud environments. Using IAM, you can permit clients to perform specific actions on a file system, including read-only, write, and root access.
67+
68+
```ts
69+
const myFileSystemPolicy = new PolicyDocument({
70+
statements: [new PolicyStatement({
71+
actions: [
72+
'elasticfilesystem:ClientWrite',
73+
'elasticfilesystem:ClientMount',
74+
],
75+
principals: [new AccountRootPrincipal()],
76+
resources: ['*'],
77+
conditions: {
78+
Bool: {
79+
'elasticfilesystem:AccessedViaMountTarget': 'true',
80+
},
81+
},
82+
})],
83+
});
84+
85+
const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
86+
vpc: new ec2.Vpc(this, 'VPC'),
87+
fileSystemPolicy: myFileSystemPolicy,
88+
});
89+
```
90+
6491
### Permissions
6592

6693
If you need to grant file system permissions to another resource, you can use the `.grant()` API.

‎packages/@aws-cdk/aws-efs/lib/efs-file-system.ts

+8
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,13 @@ export interface FileSystemProps {
231231
* @default false
232232
*/
233233
readonly enableAutomaticBackups?: boolean;
234+
235+
/**
236+
* File system policy is an IAM resource policy used to control NFS access to an EFS file system.
237+
*
238+
* @default none
239+
*/
240+
readonly fileSystemPolicy?: iam.PolicyDocument;
234241
}
235242

236243
/**
@@ -371,6 +378,7 @@ export class FileSystem extends FileSystemBase {
371378
throughputMode: props.throughputMode,
372379
provisionedThroughputInMibps: props.provisionedThroughputPerSecond?.toMebibytes(),
373380
backupPolicy: props.enableAutomaticBackups ? { status: 'ENABLED' } : undefined,
381+
fileSystemPolicy: props.fileSystemPolicy,
374382
});
375383
filesystem.applyRemovalPolicy(props.removalPolicy);
376384

‎packages/@aws-cdk/aws-efs/test/efs-file-system.test.ts

+44
Original file line numberDiff line numberDiff line change
@@ -414,3 +414,47 @@ test('can create when using a VPC with multiple subnets per availability zone',
414414
// make sure only one mount target is created.
415415
Template.fromStack(stack).resourceCountIs('AWS::EFS::MountTarget', 1);
416416
});
417+
418+
test('can specify file system policy', () => {
419+
// WHEN
420+
const myFileSystemPolicy = new iam.PolicyDocument({
421+
statements: [new iam.PolicyStatement({
422+
actions: [
423+
'elasticfilesystem:ClientWrite',
424+
'elasticfilesystem:ClientMount',
425+
],
426+
principals: [new iam.ArnPrincipal('arn:aws:iam::111122223333:role/Testing_Role')],
427+
resources: ['arn:aws:elasticfilesystem:us-east-2:111122223333:file-system/fs-1234abcd'],
428+
conditions: {
429+
Bool: {
430+
'elasticfilesystem:AccessedViaMountTarget': 'true',
431+
},
432+
},
433+
})],
434+
});
435+
new FileSystem(stack, 'EfsFileSystem', { vpc, fileSystemPolicy: myFileSystemPolicy });
436+
437+
// THEN
438+
Template.fromStack(stack).hasResourceProperties('AWS::EFS::FileSystem', {
439+
FileSystemPolicy: {
440+
Statement: [
441+
{
442+
Effect: 'Allow',
443+
Principal: {
444+
AWS: 'arn:aws:iam::111122223333:role/Testing_Role',
445+
},
446+
Action: [
447+
'elasticfilesystem:ClientWrite',
448+
'elasticfilesystem:ClientMount',
449+
],
450+
Resource: 'arn:aws:elasticfilesystem:us-east-2:111122223333:file-system/fs-1234abcd',
451+
Condition: {
452+
Bool: {
453+
'elasticfilesystem:AccessedViaMountTarget': 'true',
454+
},
455+
},
456+
},
457+
],
458+
},
459+
});
460+
});

‎packages/@aws-cdk/aws-efs/test/integ.efs-filesystem-policy.js.snapshot/FileSystemPolicyTestDefaultTestDeployAssertD0596FC1.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "30.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "FileSystemPolicyTestDefaultTestDeployAssertD0596FC1.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-efs/test/integ.efs-filesystem-policy.js.snapshot/FileSystemPolicyTestDefaultTestDeployAssertD0596FC1.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk/aws-efs/test/integ.efs-filesystem-policy.js.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"30.0.0"}

‎packages/@aws-cdk/aws-efs/test/integ.efs-filesystem-policy.js.snapshot/integ.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "30.0.0",
3+
"testCases": {
4+
"FileSystemPolicyTest/DefaultTest": {
5+
"stacks": [
6+
"test-efs-integ"
7+
],
8+
"assertionStack": "FileSystemPolicyTest/DefaultTest/DeployAssert",
9+
"assertionStackName": "FileSystemPolicyTestDefaultTestDeployAssertD0596FC1"
10+
}
11+
}
12+
}

0 commit comments

Comments
 (0)