Skip to content

Commit e53352d

Browse files
watany-devwatany-dev
authored
fix(kinesis): read permissions for stream do not include kinesis:DescribeStreamConsumer (#22794)
reopen [22727](#22727) Grant Read(Write) Permission Action "kinesis:DescribeStreamConsumer" It appears that the following actions had already been added "kinesis:SubscribeToShard", ref. https://docs.aws.amazon.com/streams/latest/dev/tutorial-stock-data-kplkcl2-iam.html Fixes #22184 ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent d13b64a commit e53352d

32 files changed

+246
-133
lines changed

‎packages/@aws-cdk/aws-kinesis/lib/stream.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ const READ_OPERATIONS = [
1414
'kinesis:SubscribeToShard',
1515
'kinesis:DescribeStream',
1616
'kinesis:ListStreams',
17+
'kinesis:DescribeStreamConsumer',
1718
];
1819

1920
const WRITE_OPERATIONS = [

‎packages/@aws-cdk/aws-kinesis/test/integ.stream.js.snapshot/cdk.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"20.0.0"}
1+
{"version":"21.0.0"}

‎packages/@aws-cdk/aws-kinesis/test/integ.stream.js.snapshot/integ-kinesis-stream.assets.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"files": {
4-
"3ad098f5c98b05c98dae3ab17e026e847d893a37bfb1b6f11947f8bcd4d590f1": {
4+
"7e1b7553b1023955c746737c40526eec80647a61c7c3d6e5b414a50d72ef99f5": {
55
"source": {
66
"path": "integ-kinesis-stream.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "3ad098f5c98b05c98dae3ab17e026e847d893a37bfb1b6f11947f8bcd4d590f1.json",
12+
"objectKey": "7e1b7553b1023955c746737c40526eec80647a61c7c3d6e5b414a50d72ef99f5.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk/aws-kinesis/test/integ.stream.js.snapshot/integ-kinesis-stream.template.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040
{
4141
"Action": [
4242
"kinesis:DescribeStream",
43+
"kinesis:DescribeStreamConsumer",
4344
"kinesis:DescribeStreamSummary",
4445
"kinesis:GetRecords",
4546
"kinesis:GetShardIterator",

‎packages/@aws-cdk/aws-kinesis/test/integ.stream.js.snapshot/integ.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"testCases": {
44
"integ.stream": {
55
"stacks": [

‎packages/@aws-cdk/aws-kinesis/test/integ.stream.js.snapshot/manifest.json

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"artifacts": {
4-
"Tree": {
5-
"type": "cdk:tree",
6-
"properties": {
7-
"file": "tree.json"
8-
}
9-
},
104
"integ-kinesis-stream.assets": {
115
"type": "cdk:asset-manifest",
126
"properties": {
@@ -23,7 +17,7 @@
2317
"validateOnSynth": false,
2418
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
2519
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/3ad098f5c98b05c98dae3ab17e026e847d893a37bfb1b6f11947f8bcd4d590f1.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/7e1b7553b1023955c746737c40526eec80647a61c7c3d6e5b414a50d72ef99f5.json",
2721
"requiresBootstrapStackVersion": 6,
2822
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2923
"additionalDependencies": [
@@ -77,6 +71,12 @@
7771
]
7872
},
7973
"displayName": "integ-kinesis-stream"
74+
},
75+
"Tree": {
76+
"type": "cdk:tree",
77+
"properties": {
78+
"file": "tree.json"
79+
}
8080
}
8181
}
8282
}

‎packages/@aws-cdk/aws-kinesis/test/integ.stream.js.snapshot/tree.json

Lines changed: 30 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,6 @@
44
"id": "App",
55
"path": "",
66
"children": {
7-
"Tree": {
8-
"id": "Tree",
9-
"path": "Tree",
10-
"constructInfo": {
11-
"fqn": "constructs.Construct",
12-
"version": "10.1.85"
13-
}
14-
},
157
"integ-kinesis-stream": {
168
"id": "integ-kinesis-stream",
179
"path": "integ-kinesis-stream",
@@ -75,6 +67,7 @@
7567
{
7668
"Action": [
7769
"kinesis:DescribeStream",
70+
"kinesis:DescribeStreamConsumer",
7871
"kinesis:DescribeStreamSummary",
7972
"kinesis:GetRecords",
8073
"kinesis:GetShardIterator",
@@ -164,20 +157,44 @@
164157
"id": "AwsCdkKinesisEncryptedStreamsUnsupportedRegions",
165158
"path": "integ-kinesis-stream/AwsCdkKinesisEncryptedStreamsUnsupportedRegions",
166159
"constructInfo": {
167-
"fqn": "constructs.Construct",
168-
"version": "10.1.85"
160+
"fqn": "@aws-cdk/core.CfnCondition",
161+
"version": "0.0.0"
162+
}
163+
},
164+
"BootstrapVersion": {
165+
"id": "BootstrapVersion",
166+
"path": "integ-kinesis-stream/BootstrapVersion",
167+
"constructInfo": {
168+
"fqn": "@aws-cdk/core.CfnParameter",
169+
"version": "0.0.0"
170+
}
171+
},
172+
"CheckBootstrapVersion": {
173+
"id": "CheckBootstrapVersion",
174+
"path": "integ-kinesis-stream/CheckBootstrapVersion",
175+
"constructInfo": {
176+
"fqn": "@aws-cdk/core.CfnRule",
177+
"version": "0.0.0"
169178
}
170179
}
171180
},
181+
"constructInfo": {
182+
"fqn": "@aws-cdk/core.Stack",
183+
"version": "0.0.0"
184+
}
185+
},
186+
"Tree": {
187+
"id": "Tree",
188+
"path": "Tree",
172189
"constructInfo": {
173190
"fqn": "constructs.Construct",
174-
"version": "10.1.85"
191+
"version": "10.1.140"
175192
}
176193
}
177194
},
178195
"constructInfo": {
179-
"fqn": "constructs.Construct",
180-
"version": "10.1.85"
196+
"fqn": "@aws-cdk/core.App",
197+
"version": "0.0.0"
181198
}
182199
}
183200
}

‎packages/@aws-cdk/aws-kinesis/test/stream.test.ts

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -603,6 +603,7 @@ describe('Kinesis data streams', () => {
603603
'kinesis:SubscribeToShard',
604604
'kinesis:DescribeStream',
605605
'kinesis:ListStreams',
606+
'kinesis:DescribeStreamConsumer',
606607
],
607608
Effect: 'Allow',
608609
Resource: {
@@ -775,6 +776,7 @@ describe('Kinesis data streams', () => {
775776
'kinesis:SubscribeToShard',
776777
'kinesis:DescribeStream',
777778
'kinesis:ListStreams',
779+
'kinesis:DescribeStreamConsumer',
778780
'kinesis:PutRecord',
779781
'kinesis:PutRecords',
780782
],

‎packages/@aws-cdk/aws-kinesisfirehose/test/integ.delivery-stream.source-stream.js.snapshot/aws-cdk-firehose-delivery-stream-source-stream.assets.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
22
"version": "21.0.0",
33
"files": {
4-
"a29f224cc0c6a912790804d03fd575433b70747d51ecaee20fdca915ad05b006": {
4+
"2f4e60312984ef4ca44937d8f3e578fa321f70ee8539a44440450bb169a0cadb": {
55
"source": {
66
"path": "aws-cdk-firehose-delivery-stream-source-stream.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "a29f224cc0c6a912790804d03fd575433b70747d51ecaee20fdca915ad05b006.json",
12+
"objectKey": "2f4e60312984ef4ca44937d8f3e578fa321f70ee8539a44440450bb169a0cadb.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk/aws-kinesisfirehose/test/integ.delivery-stream.source-stream.js.snapshot/aws-cdk-firehose-delivery-stream-source-stream.template.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@
122122
{
123123
"Action": [
124124
"kinesis:DescribeStream",
125+
"kinesis:DescribeStreamConsumer",
125126
"kinesis:DescribeStreamSummary",
126127
"kinesis:GetRecords",
127128
"kinesis:GetShardIterator",

‎packages/@aws-cdk/aws-kinesisfirehose/test/integ.delivery-stream.source-stream.js.snapshot/manifest.json

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
{
22
"version": "21.0.0",
33
"artifacts": {
4-
"Tree": {
5-
"type": "cdk:tree",
6-
"properties": {
7-
"file": "tree.json"
8-
}
9-
},
104
"aws-cdk-firehose-delivery-stream-source-stream.assets": {
115
"type": "cdk:asset-manifest",
126
"properties": {
@@ -23,7 +17,7 @@
2317
"validateOnSynth": false,
2418
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
2519
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/a29f224cc0c6a912790804d03fd575433b70747d51ecaee20fdca915ad05b006.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/2f4e60312984ef4ca44937d8f3e578fa321f70ee8539a44440450bb169a0cadb.json",
2721
"requiresBootstrapStackVersion": 6,
2822
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2923
"additionalDependencies": [
@@ -107,6 +101,12 @@
107101
]
108102
},
109103
"displayName": "aws-cdk-firehose-delivery-stream-source-stream"
104+
},
105+
"Tree": {
106+
"type": "cdk:tree",
107+
"properties": {
108+
"file": "tree.json"
109+
}
110110
}
111111
}
112112
}

‎packages/@aws-cdk/aws-kinesisfirehose/test/integ.delivery-stream.source-stream.js.snapshot/tree.json

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,6 @@
44
"id": "App",
55
"path": "",
66
"children": {
7-
"Tree": {
8-
"id": "Tree",
9-
"path": "Tree",
10-
"constructInfo": {
11-
"fqn": "constructs.Construct",
12-
"version": "10.1.129"
13-
}
14-
},
157
"aws-cdk-firehose-delivery-stream-source-stream": {
168
"id": "aws-cdk-firehose-delivery-stream-source-stream",
179
"path": "aws-cdk-firehose-delivery-stream-source-stream",
@@ -240,6 +232,7 @@
240232
{
241233
"Action": [
242234
"kinesis:DescribeStream",
235+
"kinesis:DescribeStreamConsumer",
243236
"kinesis:DescribeStreamSummary",
244237
"kinesis:GetRecords",
245238
"kinesis:GetShardIterator",
@@ -338,12 +331,36 @@
338331
"fqn": "@aws-cdk/core.CfnMapping",
339332
"version": "0.0.0"
340333
}
334+
},
335+
"BootstrapVersion": {
336+
"id": "BootstrapVersion",
337+
"path": "aws-cdk-firehose-delivery-stream-source-stream/BootstrapVersion",
338+
"constructInfo": {
339+
"fqn": "@aws-cdk/core.CfnParameter",
340+
"version": "0.0.0"
341+
}
342+
},
343+
"CheckBootstrapVersion": {
344+
"id": "CheckBootstrapVersion",
345+
"path": "aws-cdk-firehose-delivery-stream-source-stream/CheckBootstrapVersion",
346+
"constructInfo": {
347+
"fqn": "@aws-cdk/core.CfnRule",
348+
"version": "0.0.0"
349+
}
341350
}
342351
},
343352
"constructInfo": {
344353
"fqn": "@aws-cdk/core.Stack",
345354
"version": "0.0.0"
346355
}
356+
},
357+
"Tree": {
358+
"id": "Tree",
359+
"path": "Tree",
360+
"constructInfo": {
361+
"fqn": "constructs.Construct",
362+
"version": "10.1.140"
363+
}
347364
}
348365
},
349366
"constructInfo": {

‎packages/@aws-cdk/aws-lambda-event-sources/test/integ.kinesis-at-timestamp.js.snapshot/AtTimestampDefaultTestDeployAssert8000E9DC.assets.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"files": {
44
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
55
"source": {

‎packages/@aws-cdk/aws-lambda-event-sources/test/integ.kinesis-at-timestamp.js.snapshot/cdk.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"20.0.0"}
1+
{"version":"21.0.0"}

‎packages/@aws-cdk/aws-lambda-event-sources/test/integ.kinesis-at-timestamp.js.snapshot/integ.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"testCases": {
44
"AtTimestamp/DefaultTest": {
55
"stacks": [
66
"lambda-event-source-kinesis-at-timestamp"
77
],
8-
"assertionStack": "AtTimestamp/DefaultTest/DeployAssert"
8+
"assertionStack": "AtTimestamp/DefaultTest/DeployAssert",
9+
"assertionStackName": "AtTimestampDefaultTestDeployAssert8000E9DC"
910
}
1011
}
1112
}

‎packages/@aws-cdk/aws-lambda-event-sources/test/integ.kinesis-at-timestamp.js.snapshot/lambda-event-source-kinesis-at-timestamp.assets.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"files": {
4-
"c03d3d9d3bc82eedad69a8123bdb9624a92ff2623eac5d10b4213127be4942f5": {
4+
"fbcc195635fd8f1904f29d439573540020d8140bbc21d9a9d07071986b13cd44": {
55
"source": {
66
"path": "lambda-event-source-kinesis-at-timestamp.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "c03d3d9d3bc82eedad69a8123bdb9624a92ff2623eac5d10b4213127be4942f5.json",
12+
"objectKey": "fbcc195635fd8f1904f29d439573540020d8140bbc21d9a9d07071986b13cd44.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk/aws-lambda-event-sources/test/integ.kinesis-at-timestamp.js.snapshot/lambda-event-source-kinesis-at-timestamp.template.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
{
4040
"Action": [
4141
"kinesis:DescribeStream",
42+
"kinesis:DescribeStreamConsumer",
4243
"kinesis:DescribeStreamSummary",
4344
"kinesis:GetRecords",
4445
"kinesis:GetShardIterator",

‎packages/@aws-cdk/aws-lambda-event-sources/test/integ.kinesis-at-timestamp.js.snapshot/manifest.json

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"artifacts": {
4-
"Tree": {
5-
"type": "cdk:tree",
6-
"properties": {
7-
"file": "tree.json"
8-
}
9-
},
104
"lambda-event-source-kinesis-at-timestamp.assets": {
115
"type": "cdk:asset-manifest",
126
"properties": {
@@ -23,7 +17,7 @@
2317
"validateOnSynth": false,
2418
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
2519
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/c03d3d9d3bc82eedad69a8123bdb9624a92ff2623eac5d10b4213127be4942f5.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/fbcc195635fd8f1904f29d439573540020d8140bbc21d9a9d07071986b13cd44.json",
2721
"requiresBootstrapStackVersion": 6,
2822
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2923
"additionalDependencies": [
@@ -136,6 +130,12 @@
136130
]
137131
},
138132
"displayName": "AtTimestamp/DefaultTest/DeployAssert"
133+
},
134+
"Tree": {
135+
"type": "cdk:tree",
136+
"properties": {
137+
"file": "tree.json"
138+
}
139139
}
140140
}
141141
}

0 commit comments

Comments
 (0)