Skip to content

Commit c62eeb7

Browse files
TietewTietew
authored
fix(aws-cognito): Lambda::Permission of lambdaTrigger should have a SourceArn (#19622)
Fixes #19604 ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/master/INTEGRATION_TESTS.md)? * [ ] Did you use `cdk-integ` to deploy the infrastructure and generate the snapshot (i.e. `cdk-integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent e817381 commit c62eeb7

File tree

4 files changed

+85
-15
lines changed

4 files changed

+85
-15
lines changed

‎packages/@aws-cdk/aws-cognito/lib/user-pool.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -936,7 +936,7 @@ export class UserPool extends UserPoolBase {
936936
const capitalize = name.charAt(0).toUpperCase() + name.slice(1);
937937
fn.addPermission(`${capitalize}Cognito`, {
938938
principal: new ServicePrincipal('cognito-idp.amazonaws.com'),
939-
sourceArn: this.userPoolArn,
939+
sourceArn: Lazy.string({ produce: () => this.userPoolArn }),
940940
});
941941
}
942942

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-custom-sender.expected.json

+7-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,13 @@
6060
"Arn"
6161
]
6262
},
63-
"Principal": "cognito-idp.amazonaws.com"
63+
"Principal": "cognito-idp.amazonaws.com",
64+
"SourceArn": {
65+
"Fn::GetAtt": [
66+
"pool056F3F7E",
67+
"Arn"
68+
]
69+
}
6470
}
6571
},
6672
"keyFEDD6EC0": {

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-explicit-props.expected.json

+70-10
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,13 @@
6161
"Arn"
6262
]
6363
},
64-
"Principal": "cognito-idp.amazonaws.com"
64+
"Principal": "cognito-idp.amazonaws.com",
65+
"SourceArn": {
66+
"Fn::GetAtt": [
67+
"myuserpool01998219",
68+
"Arn"
69+
]
70+
}
6571
}
6672
},
6773
"customMessageServiceRoleB4AE7F17": {
@@ -125,7 +131,13 @@
125131
"Arn"
126132
]
127133
},
128-
"Principal": "cognito-idp.amazonaws.com"
134+
"Principal": "cognito-idp.amazonaws.com",
135+
"SourceArn": {
136+
"Fn::GetAtt": [
137+
"myuserpool01998219",
138+
"Arn"
139+
]
140+
}
129141
}
130142
},
131143
"defineAuthChallengeServiceRole9E2D15DF": {
@@ -189,7 +201,13 @@
189201
"Arn"
190202
]
191203
},
192-
"Principal": "cognito-idp.amazonaws.com"
204+
"Principal": "cognito-idp.amazonaws.com",
205+
"SourceArn": {
206+
"Fn::GetAtt": [
207+
"myuserpool01998219",
208+
"Arn"
209+
]
210+
}
193211
}
194212
},
195213
"postAuthenticationServiceRole5B3B242A": {
@@ -253,7 +271,13 @@
253271
"Arn"
254272
]
255273
},
256-
"Principal": "cognito-idp.amazonaws.com"
274+
"Principal": "cognito-idp.amazonaws.com",
275+
"SourceArn": {
276+
"Fn::GetAtt": [
277+
"myuserpool01998219",
278+
"Arn"
279+
]
280+
}
257281
}
258282
},
259283
"postConfirmationServiceRole864BE5F9": {
@@ -317,7 +341,13 @@
317341
"Arn"
318342
]
319343
},
320-
"Principal": "cognito-idp.amazonaws.com"
344+
"Principal": "cognito-idp.amazonaws.com",
345+
"SourceArn": {
346+
"Fn::GetAtt": [
347+
"myuserpool01998219",
348+
"Arn"
349+
]
350+
}
321351
}
322352
},
323353
"preAuthenticationServiceRole9712F4D8": {
@@ -381,7 +411,13 @@
381411
"Arn"
382412
]
383413
},
384-
"Principal": "cognito-idp.amazonaws.com"
414+
"Principal": "cognito-idp.amazonaws.com",
415+
"SourceArn": {
416+
"Fn::GetAtt": [
417+
"myuserpool01998219",
418+
"Arn"
419+
]
420+
}
385421
}
386422
},
387423
"preSignUpServiceRole0A7E91EB": {
@@ -445,7 +481,13 @@
445481
"Arn"
446482
]
447483
},
448-
"Principal": "cognito-idp.amazonaws.com"
484+
"Principal": "cognito-idp.amazonaws.com",
485+
"SourceArn": {
486+
"Fn::GetAtt": [
487+
"myuserpool01998219",
488+
"Arn"
489+
]
490+
}
449491
}
450492
},
451493
"preTokenGenerationServiceRole430C3D14": {
@@ -509,7 +551,13 @@
509551
"Arn"
510552
]
511553
},
512-
"Principal": "cognito-idp.amazonaws.com"
554+
"Principal": "cognito-idp.amazonaws.com",
555+
"SourceArn": {
556+
"Fn::GetAtt": [
557+
"myuserpool01998219",
558+
"Arn"
559+
]
560+
}
513561
}
514562
},
515563
"userMigrationServiceRole091766B0": {
@@ -573,7 +621,13 @@
573621
"Arn"
574622
]
575623
},
576-
"Principal": "cognito-idp.amazonaws.com"
624+
"Principal": "cognito-idp.amazonaws.com",
625+
"SourceArn": {
626+
"Fn::GetAtt": [
627+
"myuserpool01998219",
628+
"Arn"
629+
]
630+
}
577631
}
578632
},
579633
"verifyAuthChallengeResponseServiceRole7077884C": {
@@ -637,7 +691,13 @@
637691
"Arn"
638692
]
639693
},
640-
"Principal": "cognito-idp.amazonaws.com"
694+
"Principal": "cognito-idp.amazonaws.com",
695+
"SourceArn": {
696+
"Fn::GetAtt": [
697+
"myuserpool01998219",
698+
"Arn"
699+
]
700+
}
641701
}
642702
},
643703
"myuserpoolsmsRole0E16FDD9": {

‎packages/@aws-cdk/aws-cognito/test/user-pool.test.ts

+7-3
Original file line numberDiff line numberDiff line change
@@ -335,7 +335,7 @@ describe('User Pool', () => {
335335
const fn = fooFunction(stack, 'preSignUp');
336336

337337
// WHEN
338-
new UserPool(stack, 'Pool', {
338+
const pool = new UserPool(stack, 'Pool', {
339339
lambdaTriggers: {
340340
preSignUp: fn,
341341
},
@@ -351,6 +351,7 @@ describe('User Pool', () => {
351351
Action: 'lambda:InvokeFunction',
352352
FunctionName: stack.resolve(fn.functionArn),
353353
Principal: 'cognito-idp.amazonaws.com',
354+
SourceArn: stack.resolve(pool.userPoolArn),
354355
});
355356
});
356357

@@ -362,7 +363,7 @@ describe('User Pool', () => {
362363
const smsFn = fooFunction(stack, 'customSmsSender');
363364

364365
// WHEN
365-
new UserPool(stack, 'Pool', {
366+
const pool = new UserPool(stack, 'Pool', {
366367
customSenderKmsKey: kmsKey,
367368
lambdaTriggers: {
368369
customEmailSender: emailFn,
@@ -387,11 +388,13 @@ describe('User Pool', () => {
387388
Action: 'lambda:InvokeFunction',
388389
FunctionName: stack.resolve(emailFn.functionArn),
389390
Principal: 'cognito-idp.amazonaws.com',
391+
SourceArn: stack.resolve(pool.userPoolArn),
390392
});
391393
Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Permission', {
392394
Action: 'lambda:InvokeFunction',
393395
FunctionName: stack.resolve(smsFn.functionArn),
394396
Principal: 'cognito-idp.amazonaws.com',
397+
SourceArn: stack.resolve(pool.userPoolArn),
395398
});
396399
});
397400

@@ -479,6 +482,7 @@ describe('User Pool', () => {
479482
Action: 'lambda:InvokeFunction',
480483
FunctionName: stack.resolve(fn.functionArn),
481484
Principal: 'cognito-idp.amazonaws.com',
485+
SourceArn: stack.resolve(pool.userPoolArn),
482486
});
483487
});
484488
});
@@ -1760,4 +1764,4 @@ function fooFunction(scope: Construct, name: string): lambda.IFunction {
17601764

17611765
function fooKey(scope: Construct, name: string): kms.Key {
17621766
return new kms.Key(scope, name);
1763-
}
1767+
}

0 commit comments

Comments
 (0)