Skip to content

Commit 9c12199

Browse files
WinterYukkyWinterYukky
authored
feat(efs): add grantRead and grantReadWrite, grantRootAccess to FileSystem (#25486)
## What change I added `grantRead()` and `grantReadWrite()`, `grantRootAccess()` to `efs.FileSystem` as Beta1 method. ## Why need this change? To make IAM authentication easier for clients. Currently, v2.78.0 has implemented `grant()` method in `efs.FileSystem`. However, EFS can't restrict only granted client even when customers only use the `grant()` method. Because EFS default file system policy grants full access to any anonymous client that can connect to the file system using a mount target. To avoid this issue, customers must set file system policies that not grant anonymous clients, to EFS. In this PR, when using the `grantXxx` method that allows IAM authentication for clients, a file system policy that does not allow anonymous clients is set to `efs.FileSystem` by default to suit the customer's use case. Next example is grant read and write access to EC2 Instance. ```ts declare const client: ec2.Instance; const fileSystem = new efs.FileSystem(this, 'FileSystem', { vpc: new ec2.Vpc(this, 'VPC'), }); fileSystem.grantReadWrite(client); ``` ## How do I continue to allow anonymous access? You can use `allowAnonymousAccess` props for allow anonymous access. ```ts declare const client: ec2.Instance; const fileSystem = new efs.FileSystem(this, 'FileSystem', { vpc: new ec2.Vpc(this, 'VPC'), allowAnonymousAccess: true, }); fileSystem.grantRead(client); ``` ## Others The file system policies created to prevent anonymous clients are based on the AWS Management Console. <img width="1326" alt="image" src="https://user-images.githubusercontent.com/49480575/236891324-e0aa4caf-91e2-45dc-9cfe-50cae0ca67bb.png"> ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 0dbcea8 commit 9c12199

File tree

55 files changed

+70200
-517
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+70200
-517
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.fargate-with-efs.js.snapshot/aws-ecs-fargate-efs.assets.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "32.0.0",
2+
"version": "33.0.0",
33
"files": {
4-
"05d98682f5d66455a18d98d3c7e029a00681556556eee8d8afa4dd1f954b184a": {
4+
"63486a0554805ca4072510e265297dd8bf9ff2a0cf9819ae857eebfe1e6f89f9": {
55
"source": {
66
"path": "aws-ecs-fargate-efs.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "05d98682f5d66455a18d98d3c7e029a00681556556eee8d8afa4dd1f954b184a.json",
12+
"objectKey": "63486a0554805ca4072510e265297dd8bf9ff2a0cf9819ae857eebfe1e6f89f9.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.fargate-with-efs.js.snapshot/aws-ecs-fargate-efs.template.json

+73-53
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,6 @@
1818
"VpcPublicSubnet1Subnet5C2D37C4": {
1919
"Type": "AWS::EC2::Subnet",
2020
"Properties": {
21-
"VpcId": {
22-
"Ref": "Vpc8378EB38"
23-
},
2421
"AvailabilityZone": {
2522
"Fn::Select": [
2623
0,
@@ -44,21 +41,24 @@
4441
"Key": "Name",
4542
"Value": "aws-ecs-fargate-efs/Vpc/PublicSubnet1"
4643
}
47-
]
44+
],
45+
"VpcId": {
46+
"Ref": "Vpc8378EB38"
47+
}
4848
}
4949
},
5050
"VpcPublicSubnet1RouteTable6C95E38E": {
5151
"Type": "AWS::EC2::RouteTable",
5252
"Properties": {
53-
"VpcId": {
54-
"Ref": "Vpc8378EB38"
55-
},
5653
"Tags": [
5754
{
5855
"Key": "Name",
5956
"Value": "aws-ecs-fargate-efs/Vpc/PublicSubnet1"
6057
}
61-
]
58+
],
59+
"VpcId": {
60+
"Ref": "Vpc8378EB38"
61+
}
6262
}
6363
},
6464
"VpcPublicSubnet1RouteTableAssociation97140677": {
@@ -75,12 +75,12 @@
7575
"VpcPublicSubnet1DefaultRoute3DA9E72A": {
7676
"Type": "AWS::EC2::Route",
7777
"Properties": {
78-
"RouteTableId": {
79-
"Ref": "VpcPublicSubnet1RouteTable6C95E38E"
80-
},
8178
"DestinationCidrBlock": "0.0.0.0/0",
8279
"GatewayId": {
8380
"Ref": "VpcIGWD7BA715C"
81+
},
82+
"RouteTableId": {
83+
"Ref": "VpcPublicSubnet1RouteTable6C95E38E"
8484
}
8585
},
8686
"DependsOn": [
@@ -102,15 +102,15 @@
102102
"VpcPublicSubnet1NATGateway4D7517AA": {
103103
"Type": "AWS::EC2::NatGateway",
104104
"Properties": {
105-
"SubnetId": {
106-
"Ref": "VpcPublicSubnet1Subnet5C2D37C4"
107-
},
108105
"AllocationId": {
109106
"Fn::GetAtt": [
110107
"VpcPublicSubnet1EIPD7E02669",
111108
"AllocationId"
112109
]
113110
},
111+
"SubnetId": {
112+
"Ref": "VpcPublicSubnet1Subnet5C2D37C4"
113+
},
114114
"Tags": [
115115
{
116116
"Key": "Name",
@@ -126,9 +126,6 @@
126126
"VpcPublicSubnet2Subnet691E08A3": {
127127
"Type": "AWS::EC2::Subnet",
128128
"Properties": {
129-
"VpcId": {
130-
"Ref": "Vpc8378EB38"
131-
},
132129
"AvailabilityZone": {
133130
"Fn::Select": [
134131
1,
@@ -152,21 +149,24 @@
152149
"Key": "Name",
153150
"Value": "aws-ecs-fargate-efs/Vpc/PublicSubnet2"
154151
}
155-
]
152+
],
153+
"VpcId": {
154+
"Ref": "Vpc8378EB38"
155+
}
156156
}
157157
},
158158
"VpcPublicSubnet2RouteTable94F7E489": {
159159
"Type": "AWS::EC2::RouteTable",
160160
"Properties": {
161-
"VpcId": {
162-
"Ref": "Vpc8378EB38"
163-
},
164161
"Tags": [
165162
{
166163
"Key": "Name",
167164
"Value": "aws-ecs-fargate-efs/Vpc/PublicSubnet2"
168165
}
169-
]
166+
],
167+
"VpcId": {
168+
"Ref": "Vpc8378EB38"
169+
}
170170
}
171171
},
172172
"VpcPublicSubnet2RouteTableAssociationDD5762D8": {
@@ -183,12 +183,12 @@
183183
"VpcPublicSubnet2DefaultRoute97F91067": {
184184
"Type": "AWS::EC2::Route",
185185
"Properties": {
186-
"RouteTableId": {
187-
"Ref": "VpcPublicSubnet2RouteTable94F7E489"
188-
},
189186
"DestinationCidrBlock": "0.0.0.0/0",
190187
"GatewayId": {
191188
"Ref": "VpcIGWD7BA715C"
189+
},
190+
"RouteTableId": {
191+
"Ref": "VpcPublicSubnet2RouteTable94F7E489"
192192
}
193193
},
194194
"DependsOn": [
@@ -210,15 +210,15 @@
210210
"VpcPublicSubnet2NATGateway9182C01D": {
211211
"Type": "AWS::EC2::NatGateway",
212212
"Properties": {
213-
"SubnetId": {
214-
"Ref": "VpcPublicSubnet2Subnet691E08A3"
215-
},
216213
"AllocationId": {
217214
"Fn::GetAtt": [
218215
"VpcPublicSubnet2EIP3C605A87",
219216
"AllocationId"
220217
]
221218
},
219+
"SubnetId": {
220+
"Ref": "VpcPublicSubnet2Subnet691E08A3"
221+
},
222222
"Tags": [
223223
{
224224
"Key": "Name",
@@ -234,9 +234,6 @@
234234
"VpcPrivateSubnet1Subnet536B997A": {
235235
"Type": "AWS::EC2::Subnet",
236236
"Properties": {
237-
"VpcId": {
238-
"Ref": "Vpc8378EB38"
239-
},
240237
"AvailabilityZone": {
241238
"Fn::Select": [
242239
0,
@@ -260,21 +257,24 @@
260257
"Key": "Name",
261258
"Value": "aws-ecs-fargate-efs/Vpc/PrivateSubnet1"
262259
}
263-
]
260+
],
261+
"VpcId": {
262+
"Ref": "Vpc8378EB38"
263+
}
264264
}
265265
},
266266
"VpcPrivateSubnet1RouteTableB2C5B500": {
267267
"Type": "AWS::EC2::RouteTable",
268268
"Properties": {
269-
"VpcId": {
270-
"Ref": "Vpc8378EB38"
271-
},
272269
"Tags": [
273270
{
274271
"Key": "Name",
275272
"Value": "aws-ecs-fargate-efs/Vpc/PrivateSubnet1"
276273
}
277-
]
274+
],
275+
"VpcId": {
276+
"Ref": "Vpc8378EB38"
277+
}
278278
}
279279
},
280280
"VpcPrivateSubnet1RouteTableAssociation70C59FA6": {
@@ -291,21 +291,18 @@
291291
"VpcPrivateSubnet1DefaultRouteBE02A9ED": {
292292
"Type": "AWS::EC2::Route",
293293
"Properties": {
294-
"RouteTableId": {
295-
"Ref": "VpcPrivateSubnet1RouteTableB2C5B500"
296-
},
297294
"DestinationCidrBlock": "0.0.0.0/0",
298295
"NatGatewayId": {
299296
"Ref": "VpcPublicSubnet1NATGateway4D7517AA"
297+
},
298+
"RouteTableId": {
299+
"Ref": "VpcPrivateSubnet1RouteTableB2C5B500"
300300
}
301301
}
302302
},
303303
"VpcPrivateSubnet2Subnet3788AAA1": {
304304
"Type": "AWS::EC2::Subnet",
305305
"Properties": {
306-
"VpcId": {
307-
"Ref": "Vpc8378EB38"
308-
},
309306
"AvailabilityZone": {
310307
"Fn::Select": [
311308
1,
@@ -329,21 +326,24 @@
329326
"Key": "Name",
330327
"Value": "aws-ecs-fargate-efs/Vpc/PrivateSubnet2"
331328
}
332-
]
329+
],
330+
"VpcId": {
331+
"Ref": "Vpc8378EB38"
332+
}
333333
}
334334
},
335335
"VpcPrivateSubnet2RouteTableA678073B": {
336336
"Type": "AWS::EC2::RouteTable",
337337
"Properties": {
338-
"VpcId": {
339-
"Ref": "Vpc8378EB38"
340-
},
341338
"Tags": [
342339
{
343340
"Key": "Name",
344341
"Value": "aws-ecs-fargate-efs/Vpc/PrivateSubnet2"
345342
}
346-
]
343+
],
344+
"VpcId": {
345+
"Ref": "Vpc8378EB38"
346+
}
347347
}
348348
},
349349
"VpcPrivateSubnet2RouteTableAssociationA89CAD56": {
@@ -360,12 +360,12 @@
360360
"VpcPrivateSubnet2DefaultRoute060D2087": {
361361
"Type": "AWS::EC2::Route",
362362
"Properties": {
363-
"RouteTableId": {
364-
"Ref": "VpcPrivateSubnet2RouteTableA678073B"
365-
},
366363
"DestinationCidrBlock": "0.0.0.0/0",
367364
"NatGatewayId": {
368365
"Ref": "VpcPublicSubnet2NATGateway9182C01D"
366+
},
367+
"RouteTableId": {
368+
"Ref": "VpcPrivateSubnet2RouteTableA678073B"
369369
}
370370
}
371371
},
@@ -383,18 +383,38 @@
383383
"VpcVPCGWBF912B6E": {
384384
"Type": "AWS::EC2::VPCGatewayAttachment",
385385
"Properties": {
386-
"VpcId": {
387-
"Ref": "Vpc8378EB38"
388-
},
389386
"InternetGatewayId": {
390387
"Ref": "VpcIGWD7BA715C"
388+
},
389+
"VpcId": {
390+
"Ref": "Vpc8378EB38"
391391
}
392392
}
393393
},
394394
"etcdata80702D7D": {
395395
"Type": "AWS::EFS::FileSystem",
396396
"Properties": {
397397
"Encrypted": true,
398+
"FileSystemPolicy": {
399+
"Statement": [
400+
{
401+
"Action": [
402+
"elasticfilesystem:ClientRootAccess",
403+
"elasticfilesystem:ClientWrite"
404+
],
405+
"Condition": {
406+
"Bool": {
407+
"elasticfilesystem:AccessedViaMountTarget": "true"
408+
}
409+
},
410+
"Effect": "Allow",
411+
"Principal": {
412+
"AWS": "*"
413+
}
414+
}
415+
],
416+
"Version": "2012-10-17"
417+
},
398418
"FileSystemTags": [
399419
{
400420
"Key": "Name",

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.fargate-with-efs.js.snapshot/awsecsfargatetestDefaultTestDeployAssert78ECD46B.assets.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "32.0.0",
2+
"version": "33.0.0",
33
"files": {
44
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
55
"source": {

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.fargate-with-efs.js.snapshot/cdk.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"32.0.0"}
1+
{"version":"33.0.0"}

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.fargate-with-efs.js.snapshot/integ.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "32.0.0",
2+
"version": "33.0.0",
33
"testCases": {
44
"aws-ecs-fargate-test/DefaultTest": {
55
"stacks": [

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.fargate-with-efs.js.snapshot/manifest.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "32.0.0",
2+
"version": "33.0.0",
33
"artifacts": {
44
"aws-ecs-fargate-efs.assets": {
55
"type": "cdk:asset-manifest",
@@ -17,7 +17,7 @@
1717
"validateOnSynth": false,
1818
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
1919
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/05d98682f5d66455a18d98d3c7e029a00681556556eee8d8afa4dd1f954b184a.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/63486a0554805ca4072510e265297dd8bf9ff2a0cf9819ae857eebfe1e6f89f9.json",
2121
"requiresBootstrapStackVersion": 6,
2222
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2323
"additionalDependencies": [

0 commit comments

Comments
 (0)