Skip to content

Commit dde8a4a

Browse files
authored
docs(iam): explain service principal behavior with feature flag (#25484)
There recently was some confusion on how CDK calculates service principal names. Will it add region-specific suffixes, will it not? It depends on a feature flag; document that now. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent c2ef657 commit dde8a4a

File tree

1 file changed

+14
-5
lines changed

1 file changed

+14
-5
lines changed

packages/aws-cdk-lib/aws-iam/lib/principals.ts

+14-5
Original file line numberDiff line numberDiff line change
@@ -513,16 +513,25 @@ export interface ServicePrincipalOpts {
513513
}
514514

515515
/**
516-
* An IAM principal that represents an AWS service (i.e. sqs.amazonaws.com).
516+
* An IAM principal that represents an AWS service (i.e. `sqs.amazonaws.com`).
517517
*/
518518
export class ServicePrincipal extends PrincipalBase {
519519
/**
520-
* Translate the given service principal name based on the region it's used in.
520+
* Return the service principal name based on the region it's used in.
521521
*
522-
* For example, for Chinese regions this may (depending on whether that's necessary
523-
* for the given service principal) append `.cn` to the name.
522+
* Some service principal names used to be different for different partitions,
523+
* and some were not. This method would return the appropriate region-specific
524+
* service principal name, getting that information from the `region-info`
525+
* module.
524526
*
525-
* The `region-info` module is used to obtain this information.
527+
* These days all service principal names are standardized, and they are all
528+
* of the form `<servicename>.amazonaws.com`.
529+
*
530+
* If the feature flag `@aws-cdk/aws-iam:standardizedServicePrincipals` is set, this
531+
* method will always return its input. If this feature flag is not set, this
532+
* method will perform the legacy behavior, which appends the region-specific
533+
* domain suffix for some select services (for example, it would append `.cn`
534+
* to some service principal names).
526535
*
527536
* @example
528537
* const principalName = iam.ServicePrincipal.servicePrincipalName('ec2.amazonaws.com');

0 commit comments

Comments
 (0)