Skip to content

Commit e47646c

Browse files
NaumelNaumel
authored
fix: Correct SamlConsolePrincipal for non-China (#24277)
Closes #24243. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 0b822b3 commit e47646c

10 files changed

+14
-41
lines changed

Diff for: ‎packages/@aws-cdk/aws-iam/lib/principals.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -737,7 +737,7 @@ export class SamlConsolePrincipal extends SamlPrincipal {
737737
super(samlProvider, {
738738
...conditions,
739739
StringEquals: {
740-
'SAML:aud': cdk.Aws.PARTITION==='aws-cn'? 'https://signin.amazonaws.cn/saml': `https://signin.${cdk.Aws.URL_SUFFIX}/saml`,
740+
'SAML:aud': cdk.Aws.PARTITION==='aws-cn'? 'https://signin.amazonaws.cn/saml': 'https://signin.aws.amazon.com/saml',
741741
},
742742
});
743743
}

Diff for: ‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/cdk-saml-provider.assets.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "30.0.0",
2+
"version": "30.1.0",
33
"files": {
4-
"adc0eedec883653ef9cbd8c66ae68791bf952df8f678cf586e78e02997e2674c": {
4+
"3b60cda5eb73f658ff1ab1a242bd0e399cc5307d4d6493cea0171e543c6f1cc8": {
55
"source": {
66
"path": "cdk-saml-provider.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "adc0eedec883653ef9cbd8c66ae68791bf952df8f678cf586e78e02997e2674c.json",
12+
"objectKey": "3b60cda5eb73f658ff1ab1a242bd0e399cc5307d4d6493cea0171e543c6f1cc8.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

Diff for: ‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/cdk-saml-provider.template.json

+2-14
Original file line numberDiff line numberDiff line change
@@ -15,18 +15,7 @@
1515
"Action": "sts:AssumeRoleWithSAML",
1616
"Condition": {
1717
"StringEquals": {
18-
"SAML:aud": {
19-
"Fn::Join": [
20-
"",
21-
[
22-
"https://signin.",
23-
{
24-
"Ref": "AWS::URLSuffix"
25-
},
26-
"/saml"
27-
]
28-
]
29-
}
18+
"SAML:aud": "https://signin.aws.amazon.com/saml"
3019
}
3120
},
3221
"Effect": "Allow",
@@ -38,8 +27,7 @@
3827
}
3928
],
4029
"Version": "2012-10-17"
41-
},
42-
"Description": "fix the partition issue"
30+
}
4331
}
4432
}
4533
},

Diff for: ‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/cdk.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"30.0.0"}
1+
{"version":"30.1.0"}

Diff for: ‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/integ.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "30.0.0",
2+
"version": "30.1.0",
33
"testCases": {
44
"saml-provider-test/DefaultTest": {
55
"stacks": [

Diff for: ‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/manifest.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "30.0.0",
2+
"version": "30.1.0",
33
"artifacts": {
44
"cdk-saml-provider.assets": {
55
"type": "cdk:asset-manifest",
@@ -17,7 +17,7 @@
1717
"validateOnSynth": false,
1818
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
1919
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/adc0eedec883653ef9cbd8c66ae68791bf952df8f678cf586e78e02997e2674c.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/3b60cda5eb73f658ff1ab1a242bd0e399cc5307d4d6493cea0171e543c6f1cc8.json",
2121
"requiresBootstrapStackVersion": 6,
2222
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2323
"additionalDependencies": [

Diff for: ‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/samlprovidertestDefaultTestDeployAssert29A1AF64.assets.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "30.0.0",
2+
"version": "30.1.0",
33
"files": {
44
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
55
"source": {

Diff for: ‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.js.snapshot/tree.json

+2-14
Original file line numberDiff line numberDiff line change
@@ -56,18 +56,7 @@
5656
"Action": "sts:AssumeRoleWithSAML",
5757
"Condition": {
5858
"StringEquals": {
59-
"SAML:aud": {
60-
"Fn::Join": [
61-
"",
62-
[
63-
"https://signin.",
64-
{
65-
"Ref": "AWS::URLSuffix"
66-
},
67-
"/saml"
68-
]
69-
]
70-
}
59+
"SAML:aud": "https://signin.aws.amazon.com/saml"
7160
}
7261
},
7362
"Effect": "Allow",
@@ -79,8 +68,7 @@
7968
}
8069
],
8170
"Version": "2012-10-17"
82-
},
83-
"description": "fix the partition issue"
71+
}
8472
}
8573
},
8674
"constructInfo": {

Diff for: ‎packages/@aws-cdk/aws-iam/test/integ.saml-provider.ts

-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ class TestStack extends Stack {
1414

1515
new iam.Role(this, 'Role', {
1616
assumedBy: new iam.SamlConsolePrincipal(provider),
17-
description: 'fix the partition issue',
1817
});
1918
}
2019
}

Diff for: ‎packages/@aws-cdk/aws-iam/test/principals.test.ts

+1-3
Original file line numberDiff line numberDiff line change
@@ -166,9 +166,7 @@ test('SAML principal', () => {
166166
Action: 'sts:AssumeRoleWithSAML',
167167
Condition: {
168168
StringEquals: {
169-
'SAML:aud': {
170-
'Fn::Join': ['', ['https://signin.', { Ref: 'AWS::URLSuffix' }, '/saml']],
171-
},
169+
'SAML:aud': 'https://signin.aws.amazon.com/saml',
172170
},
173171
},
174172
Effect: 'Allow',

0 commit comments

Comments
 (0)