Skip to content

Commit 89b26b8

Browse files
corymhallcorymhall
authored
fix(core): crossRegionReferences doesn't work when exporting to multiple regions (#25190)
The cross region export writer was only being given permissions to the first region it would export to. Fixing this by adding each consuming region to the IAM policy. fixes #24464 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 02e8758 commit 89b26b8

File tree

22 files changed

+2387
-1111
lines changed

22 files changed

+2387
-1111
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/asset.27f8287125ebe89b1cb7f97768a61c84b3f3221450e0a22c152addc630ab2430/__entrypoint__.js

+147
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/asset.27f8287125ebe89b1cb7f97768a61c84b3f3221450e0a22c152addc630ab2430/index.js

+152
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/asset.ae370e1010629b78f494346f49ceef3ab2875718f20e6c808114e6aa770c7bf3.bundle/index.js

+1,295
Large diffs are not rendered by default.

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/asset.b54b99043c35bd080b9d9d1afce31e3541cf15b679799ba980ed40c837dcb03b.bundle/index.js

-768
This file was deleted.

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/asset.f86f86755c3b2013542fc4f9405bfe145a86c0bec508dd0b37baabe2055d33f3/__entrypoint__.js

-144
This file was deleted.

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/asset.f86f86755c3b2013542fc4f9405bfe145a86c0bec508dd0b37baabe2055d33f3/index.js

-148
This file was deleted.

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/cdk.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"21.0.0"}
1+
{"version":"31.0.0"}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/cross-region-consumer.assets.json

+6-6
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "21.0.0",
2+
"version": "31.0.0",
33
"files": {
4-
"4607a5d8b4a4167cb2ff3c986ec884e3eb44c22626b7bce07ac9807730147741": {
4+
"4b6a500a9b63c31028b69751201d80225328cfb9df5c4a6abaac18e7d4c48a8c": {
55
"source": {
6-
"path": "asset.4607a5d8b4a4167cb2ff3c986ec884e3eb44c22626b7bce07ac9807730147741",
6+
"path": "asset.4b6a500a9b63c31028b69751201d80225328cfb9df5c4a6abaac18e7d4c48a8c",
77
"packaging": "zip"
88
},
99
"destinations": {
1010
"current_account-us-east-2": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-us-east-2",
12-
"objectKey": "4607a5d8b4a4167cb2ff3c986ec884e3eb44c22626b7bce07ac9807730147741.zip",
12+
"objectKey": "4b6a500a9b63c31028b69751201d80225328cfb9df5c4a6abaac18e7d4c48a8c.zip",
1313
"region": "us-east-2",
1414
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-us-east-2"
1515
}
@@ -29,15 +29,15 @@
2929
}
3030
}
3131
},
32-
"33212ba7662e584fce97d4b64b2b7d157f5f1bac2b2ffe4e25e18545b514ec8b": {
32+
"6ca479488b1cdd2429244a95639246ddc89aaa458989ff2526645df63a2953b2": {
3333
"source": {
3434
"path": "cross-region-consumer.template.json",
3535
"packaging": "file"
3636
},
3737
"destinations": {
3838
"current_account-us-east-2": {
3939
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-us-east-2",
40-
"objectKey": "33212ba7662e584fce97d4b64b2b7d157f5f1bac2b2ffe4e25e18545b514ec8b.json",
40+
"objectKey": "6ca479488b1cdd2429244a95639246ddc89aaa458989ff2526645df63a2953b2.json",
4141
"region": "us-east-2",
4242
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-us-east-2"
4343
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/cross-region-consumer.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@
143143
"S3Bucket": {
144144
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-us-east-2"
145145
},
146-
"S3Key": "4607a5d8b4a4167cb2ff3c986ec884e3eb44c22626b7bce07ac9807730147741.zip"
146+
"S3Key": "4b6a500a9b63c31028b69751201d80225328cfb9df5c4a6abaac18e7d4c48a8c.zip"
147147
},
148148
"Timeout": 900,
149149
"MemorySize": 128,

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/cross-region-consumer2.assets.json

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"4b6a500a9b63c31028b69751201d80225328cfb9df5c4a6abaac18e7d4c48a8c": {
5+
"source": {
6+
"path": "asset.4b6a500a9b63c31028b69751201d80225328cfb9df5c4a6abaac18e7d4c48a8c",
7+
"packaging": "zip"
8+
},
9+
"destinations": {
10+
"current_account-us-west-2": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-us-west-2",
12+
"objectKey": "4b6a500a9b63c31028b69751201d80225328cfb9df5c4a6abaac18e7d4c48a8c.zip",
13+
"region": "us-west-2",
14+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-us-west-2"
15+
}
16+
}
17+
},
18+
"84d9dca339aba67f809c2fc9e42e0446ec4e7ed0bce437a58a7e4edabf6bdd02": {
19+
"source": {
20+
"path": "crossregionconsumer2IntegNested80DBA5D8.nested.template.json",
21+
"packaging": "file"
22+
},
23+
"destinations": {
24+
"current_account-us-west-2": {
25+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-us-west-2",
26+
"objectKey": "84d9dca339aba67f809c2fc9e42e0446ec4e7ed0bce437a58a7e4edabf6bdd02.json",
27+
"region": "us-west-2",
28+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-us-west-2"
29+
}
30+
}
31+
},
32+
"7314b777fac2e8baea2214fe1ce9c17ad4b1ef6ce74c41da04349ea1c754d8f3": {
33+
"source": {
34+
"path": "cross-region-consumer2.template.json",
35+
"packaging": "file"
36+
},
37+
"destinations": {
38+
"current_account-us-west-2": {
39+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-us-west-2",
40+
"objectKey": "7314b777fac2e8baea2214fe1ce9c17ad4b1ef6ce74c41da04349ea1c754d8f3.json",
41+
"region": "us-west-2",
42+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-us-west-2"
43+
}
44+
}
45+
}
46+
},
47+
"dockerImages": {}
48+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/cross-region-consumer2.template.json

+198
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
{
2+
"Resources": {
3+
"IntegNestedNestedStackIntegNestedNestedStackResource168C5881": {
4+
"Type": "AWS::CloudFormation::Stack",
5+
"Properties": {
6+
"TemplateURL": {
7+
"Fn::Join": [
8+
"",
9+
[
10+
"https://s3.us-west-2.",
11+
{
12+
"Ref": "AWS::URLSuffix"
13+
},
14+
"/",
15+
{
16+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-us-west-2"
17+
},
18+
"/84d9dca339aba67f809c2fc9e42e0446ec4e7ed0bce437a58a7e4edabf6bdd02.json"
19+
]
20+
]
21+
},
22+
"Parameters": {
23+
"referencetocrossregionconsumer2ExportsReader29C6F905cdkexportscrossregionconsumer2crossregionproduceruseast1FnGetAttIntegQueue3A18718AQueueName8D8D3C9B": {
24+
"Fn::GetAtt": [
25+
"ExportsReader8B249524",
26+
"/cdk/exports/cross-region-consumer2/crossregionproduceruseast1FnGetAttIntegQueue3A18718AQueueName8D8D3C9B"
27+
]
28+
},
29+
"referencetocrossregionconsumer2ExportsReader29C6F905cdkexportscrossregionconsumer2crossregionproduceruseast1FnGetAttIntegNestedNestedStackIntegNestedNestedStackResource168C5881OutputscrossregionproducerIntegNestedNestedIntegQueueD686DB69QueueNameC1C9C99E": {
30+
"Fn::GetAtt": [
31+
"ExportsReader8B249524",
32+
"/cdk/exports/cross-region-consumer2/crossregionproduceruseast1FnGetAttIntegNestedNestedStackIntegNestedNestedStackResource168C5881OutputscrossregionproducerIntegNestedNestedIntegQueueD686DB69QueueNameC1C9C99E"
33+
]
34+
}
35+
}
36+
},
37+
"UpdateReplacePolicy": "Delete",
38+
"DeletionPolicy": "Delete"
39+
},
40+
"IntegParameter02A1817A4": {
41+
"Type": "AWS::SSM::Parameter",
42+
"Properties": {
43+
"Type": "String",
44+
"Value": {
45+
"Fn::GetAtt": [
46+
"ExportsReader8B249524",
47+
"/cdk/exports/cross-region-consumer2/crossregionproduceruseast1FnGetAttIntegQueue3A18718AQueueName8D8D3C9B"
48+
]
49+
},
50+
"Name": "integ-parameter0"
51+
}
52+
},
53+
"IntegParameter1EDBEF1C6": {
54+
"Type": "AWS::SSM::Parameter",
55+
"Properties": {
56+
"Type": "String",
57+
"Value": {
58+
"Fn::GetAtt": [
59+
"ExportsReader8B249524",
60+
"/cdk/exports/cross-region-consumer2/crossregionproduceruseast1FnGetAttIntegNestedNestedStackIntegNestedNestedStackResource168C5881OutputscrossregionproducerIntegNestedNestedIntegQueueD686DB69QueueNameC1C9C99E"
61+
]
62+
},
63+
"Name": "integ-parameter1"
64+
}
65+
},
66+
"ExportsReader8B249524": {
67+
"Type": "Custom::CrossRegionExportReader",
68+
"Properties": {
69+
"ServiceToken": {
70+
"Fn::GetAtt": [
71+
"CustomCrossRegionExportReaderCustomResourceProviderHandler46647B68",
72+
"Arn"
73+
]
74+
},
75+
"ReaderProps": {
76+
"region": "us-west-2",
77+
"prefix": "cross-region-consumer2",
78+
"imports": {
79+
"/cdk/exports/cross-region-consumer2/crossregionproduceruseast1FnGetAttIntegQueue3A18718AQueueName8D8D3C9B": "{{resolve:ssm:/cdk/exports/cross-region-consumer2/crossregionproduceruseast1FnGetAttIntegQueue3A18718AQueueName8D8D3C9B}}",
80+
"/cdk/exports/cross-region-consumer2/crossregionproduceruseast1FnGetAttIntegNestedNestedStackIntegNestedNestedStackResource168C5881OutputscrossregionproducerIntegNestedNestedIntegQueueD686DB69QueueNameC1C9C99E": "{{resolve:ssm:/cdk/exports/cross-region-consumer2/crossregionproduceruseast1FnGetAttIntegNestedNestedStackIntegNestedNestedStackResource168C5881OutputscrossregionproducerIntegNestedNestedIntegQueueD686DB69QueueNameC1C9C99E}}"
81+
}
82+
}
83+
},
84+
"UpdateReplacePolicy": "Delete",
85+
"DeletionPolicy": "Delete"
86+
},
87+
"CustomCrossRegionExportReaderCustomResourceProviderRole10531BBD": {
88+
"Type": "AWS::IAM::Role",
89+
"Properties": {
90+
"AssumeRolePolicyDocument": {
91+
"Version": "2012-10-17",
92+
"Statement": [
93+
{
94+
"Action": "sts:AssumeRole",
95+
"Effect": "Allow",
96+
"Principal": {
97+
"Service": "lambda.amazonaws.com"
98+
}
99+
}
100+
]
101+
},
102+
"ManagedPolicyArns": [
103+
{
104+
"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
105+
}
106+
],
107+
"Policies": [
108+
{
109+
"PolicyName": "Inline",
110+
"PolicyDocument": {
111+
"Version": "2012-10-17",
112+
"Statement": [
113+
{
114+
"Effect": "Allow",
115+
"Resource": {
116+
"Fn::Join": [
117+
"",
118+
[
119+
"arn:aws:ssm:us-west-2:",
120+
{
121+
"Ref": "AWS::AccountId"
122+
},
123+
":parameter/cdk/exports/cross-region-consumer2/*"
124+
]
125+
]
126+
},
127+
"Action": [
128+
"ssm:AddTagsToResource",
129+
"ssm:RemoveTagsFromResource",
130+
"ssm:GetParameters"
131+
]
132+
}
133+
]
134+
}
135+
}
136+
]
137+
}
138+
},
139+
"CustomCrossRegionExportReaderCustomResourceProviderHandler46647B68": {
140+
"Type": "AWS::Lambda::Function",
141+
"Properties": {
142+
"Code": {
143+
"S3Bucket": {
144+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-us-west-2"
145+
},
146+
"S3Key": "4b6a500a9b63c31028b69751201d80225328cfb9df5c4a6abaac18e7d4c48a8c.zip"
147+
},
148+
"Timeout": 900,
149+
"MemorySize": 128,
150+
"Handler": "__entrypoint__.handler",
151+
"Role": {
152+
"Fn::GetAtt": [
153+
"CustomCrossRegionExportReaderCustomResourceProviderRole10531BBD",
154+
"Arn"
155+
]
156+
},
157+
"Runtime": "nodejs14.x"
158+
},
159+
"DependsOn": [
160+
"CustomCrossRegionExportReaderCustomResourceProviderRole10531BBD"
161+
]
162+
}
163+
},
164+
"Parameters": {
165+
"BootstrapVersion": {
166+
"Type": "AWS::SSM::Parameter::Value<String>",
167+
"Default": "/cdk-bootstrap/hnb659fds/version",
168+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
169+
}
170+
},
171+
"Rules": {
172+
"CheckBootstrapVersion": {
173+
"Assertions": [
174+
{
175+
"Assert": {
176+
"Fn::Not": [
177+
{
178+
"Fn::Contains": [
179+
[
180+
"1",
181+
"2",
182+
"3",
183+
"4",
184+
"5"
185+
],
186+
{
187+
"Ref": "BootstrapVersion"
188+
}
189+
]
190+
}
191+
]
192+
},
193+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
194+
}
195+
]
196+
}
197+
}
198+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudformation/test/integ.core-cross-region-references.js.snapshot/cross-region-producer.assets.json

+6-6
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "21.0.0",
2+
"version": "31.0.0",
33
"files": {
4-
"f86f86755c3b2013542fc4f9405bfe145a86c0bec508dd0b37baabe2055d33f3": {
4+
"27f8287125ebe89b1cb7f97768a61c84b3f3221450e0a22c152addc630ab2430": {
55
"source": {
6-
"path": "asset.f86f86755c3b2013542fc4f9405bfe145a86c0bec508dd0b37baabe2055d33f3",
6+
"path": "asset.27f8287125ebe89b1cb7f97768a61c84b3f3221450e0a22c152addc630ab2430",
77
"packaging": "zip"
88
},
99
"destinations": {
1010
"current_account-us-east-1": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-us-east-1",
12-
"objectKey": "f86f86755c3b2013542fc4f9405bfe145a86c0bec508dd0b37baabe2055d33f3.zip",
12+
"objectKey": "27f8287125ebe89b1cb7f97768a61c84b3f3221450e0a22c152addc630ab2430.zip",
1313
"region": "us-east-1",
1414
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-us-east-1"
1515
}
@@ -29,15 +29,15 @@
2929
}
3030
}
3131
},
32-
"70e0b1af0ea278adf024d80a32c2797554d527123f1dc1eb9f2a894a6d46bc7a": {
32+
"f4f423c120bb2c3118761133362f056c498404cb31d1528f2ea55ebc825579df": {
3333
"source": {
3434
"path": "cross-region-producer.template.json",
3535
"packaging": "file"
3636
},
3737
"destinations": {
3838
"current_account-us-east-1": {
3939
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-us-east-1",
40-
"objectKey": "70e0b1af0ea278adf024d80a32c2797554d527123f1dc1eb9f2a894a6d46bc7a.json",
40+
"objectKey": "f4f423c120bb2c3118761133362f056c498404cb31d1528f2ea55ebc825579df.json",
4141
"region": "us-east-1",
4242
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-us-east-1"
4343
}

0 commit comments

Comments
 (0)