Skip to content

Commit f3f4814

Browse files
RaphaelMankeRaphaelManke
authored
fix(events): additional plaintext header are not set on eventbridge connection (#21857)
Fixes: #21855 While creating a Eventbridge connection to make api calls to an external api one sometimes have to add additional header parameters like `Content-Type = application/json` These additional headers can be either be a secret value or a plaintext value specified at deploy time. The connection class provides a HttpParameter class that alows you to set a static/unsecure/plaintext value for a header key ```javascript const connection = new Connection(this, "connection", { authorization: Authorization.apiKey( "authorization", secret.secretValue), headerParameters: { "Content-Type": HttpParameter.fromString("application/json"), }, }); ``` This should lead to api calls made with the connection have a Header present with key/value `"Content-Type": "application/json"`, The actual behavior was prior to this Fix that the header wasn't present in the api calls made with this connection. While debugging the issue I used the following aws cli commands to check what has been deployed by cdk/cloudformation `aws events describe-connection --name <name-of-the-connection> ` which result was similair to this ```JSON { "ConnectionArn": "arn:aws:events:eu-west-1:XXXXXXX:connection/SomeConnection/0848ec46-413a-4d40-8834-XXXXXX", "Name": "SomeConnection", "ConnectionState": "AUTHORIZED", "AuthorizationType": "API_KEY", "SecretArn": "arn:aws:secretsmanager:eu-west-1:XXXXXXX:secret:events!connection/SomeSecret/1e74cbb0-dfc6-4b77-a49f-b204e6b74a46-XXXXXX", "AuthParameters": { "ApiKeyAuthParameters": { "ApiKeyName": "authorization" }, "InvocationHttpParameters": { "HeaderParameters": [ { "Key": "Content-Type", "IsValueSecret": true } ] } }, "CreationTime": "2022-08-29T16:57:35+02:00", "LastModifiedTime": "2022-08-29T16:57:35+02:00", "LastAuthorizedTime": "2022-08-29T16:57:35+02:00" } ``` Which indicates that the header value is not set because it is treated as secret value and needs to be provided by the referenced secret. Then i checked the Cloudformation spec https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-connection-parameter.html There it is indicated that there is the property `isValueSecret` which indicates if the value is a secret or not. The next step was to check why cdk generates a template that doesn't work and thereby checked the HttpParameter class. This class is responsible for generating the `AWS::Events::Connection Parameter` properties. I noticed that only the `HttpParameter.fromSecret()` sets the `isValueSecret` flag. But it seems to be the case that for this property the default value is true by cloudformation, so omiting this attribute in the _render function results to `isValueSecret: true` at deploy time. After that i explicity set the value to false for the case the user specifies a plaintext value throught the `HttpParameter.fromString()` method. To make sure the correct values are deployed by cloudformation I added a integration test including an assertion that the deployed connection has the correct isValueSecret flag set and the value for the header is set. ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent e1794e3 commit f3f4814

File tree

12 files changed

+1411
-0
lines changed

12 files changed

+1411
-0
lines changed

‎packages/@aws-cdk/aws-events/lib/connection.ts

+1
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,7 @@ export abstract class HttpParameter {
199199
return {
200200
key: name,
201201
value,
202+
isValueSecret: false,
202203
} as CfnConnection.ParameterProperty;
203204
}
204205
}();

‎packages/@aws-cdk/aws-events/test/connection.integ.snapshot/ConnectionTestDefaultTestDeployAssertBA181C0F.assets.json

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"version": "21.0.0",
3+
"files": {
4+
"84802aa01d2d2c9e7d8d69705ee832c97f1ebad2d73c72be5c32d53f16cf90a7": {
5+
"source": {
6+
"path": "asset.84802aa01d2d2c9e7d8d69705ee832c97f1ebad2d73c72be5c32d53f16cf90a7.bundle",
7+
"packaging": "zip"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "84802aa01d2d2c9e7d8d69705ee832c97f1ebad2d73c72be5c32d53f16cf90a7.zip",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
},
17+
"b67eb2559673644d8bc867113ad588bb685a8a274e1fcb3b8d226be5d9fd6d2e": {
18+
"source": {
19+
"path": "ConnectionTestDefaultTestDeployAssertBA181C0F.template.json",
20+
"packaging": "file"
21+
},
22+
"destinations": {
23+
"current_account-current_region": {
24+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25+
"objectKey": "b67eb2559673644d8bc867113ad588bb685a8a274e1fcb3b8d226be5d9fd6d2e.json",
26+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
27+
}
28+
}
29+
}
30+
},
31+
"dockerImages": {}
32+
}

‎packages/@aws-cdk/aws-events/test/connection.integ.snapshot/ConnectionTestDefaultTestDeployAssertBA181C0F.template.json

+161
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
{
2+
"Resources": {
3+
"AwsApiCallEventBridgedescribeConnection": {
4+
"Type": "Custom::DeployAssert@SdkCallEventBridgedescribeConnection",
5+
"Properties": {
6+
"ServiceToken": {
7+
"Fn::GetAtt": [
8+
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F",
9+
"Arn"
10+
]
11+
},
12+
"service": "EventBridge",
13+
"api": "describeConnection",
14+
"parameters": {
15+
"Name": {
16+
"Fn::ImportValue": "IntegConnectionStack:ExportsOutputRefConnection07624BCD5A8A23C8"
17+
}
18+
},
19+
"flattenResponse": "false",
20+
"salt": "1662113441706"
21+
},
22+
"UpdateReplacePolicy": "Delete",
23+
"DeletionPolicy": "Delete"
24+
},
25+
"AwsApiCallEventBridgedescribeConnectionAssertEqualsEventBridgedescribeConnection641C4FA0": {
26+
"Type": "Custom::DeployAssert@AssertEquals",
27+
"Properties": {
28+
"ServiceToken": {
29+
"Fn::GetAtt": [
30+
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F",
31+
"Arn"
32+
]
33+
},
34+
"actual": {
35+
"Fn::GetAtt": [
36+
"AwsApiCallEventBridgedescribeConnection",
37+
"apiCallResponse"
38+
]
39+
},
40+
"expected": "{\"$ObjectLike\":{\"AuthParameters\":{\"ApiKeyAuthParameters\":{\"ApiKeyName\":\"keyname\"},\"InvocationHttpParameters\":{\"HeaderParameters\":[{\"Key\":\"content-type\",\"Value\":\"application/json\",\"IsValueSecret\":false}]}}}}",
41+
"salt": "1662113441706"
42+
},
43+
"UpdateReplacePolicy": "Delete",
44+
"DeletionPolicy": "Delete"
45+
},
46+
"SingletonFunction1488541a7b23466481b69b4408076b81Role37ABCE73": {
47+
"Type": "AWS::IAM::Role",
48+
"Properties": {
49+
"AssumeRolePolicyDocument": {
50+
"Version": "2012-10-17",
51+
"Statement": [
52+
{
53+
"Action": "sts:AssumeRole",
54+
"Effect": "Allow",
55+
"Principal": {
56+
"Service": "lambda.amazonaws.com"
57+
}
58+
}
59+
]
60+
},
61+
"ManagedPolicyArns": [
62+
{
63+
"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
64+
}
65+
],
66+
"Policies": [
67+
{
68+
"PolicyName": "Inline",
69+
"PolicyDocument": {
70+
"Version": "2012-10-17",
71+
"Statement": [
72+
{
73+
"Action": [
74+
"eventbridge:DescribeConnection"
75+
],
76+
"Effect": "Allow",
77+
"Resource": [
78+
"*"
79+
]
80+
},
81+
{
82+
"Action": [
83+
"events:DescribeConnection"
84+
],
85+
"Effect": "Allow",
86+
"Resource": [
87+
"*"
88+
]
89+
}
90+
]
91+
}
92+
}
93+
]
94+
}
95+
},
96+
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F": {
97+
"Type": "AWS::Lambda::Function",
98+
"Properties": {
99+
"Runtime": "nodejs14.x",
100+
"Code": {
101+
"S3Bucket": {
102+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
103+
},
104+
"S3Key": "84802aa01d2d2c9e7d8d69705ee832c97f1ebad2d73c72be5c32d53f16cf90a7.zip"
105+
},
106+
"Timeout": 120,
107+
"Handler": "index.handler",
108+
"Role": {
109+
"Fn::GetAtt": [
110+
"SingletonFunction1488541a7b23466481b69b4408076b81Role37ABCE73",
111+
"Arn"
112+
]
113+
}
114+
}
115+
}
116+
},
117+
"Outputs": {
118+
"AssertionResultsAssertEqualsEventBridgedescribeConnection": {
119+
"Value": {
120+
"Fn::GetAtt": [
121+
"AwsApiCallEventBridgedescribeConnectionAssertEqualsEventBridgedescribeConnection641C4FA0",
122+
"data"
123+
]
124+
}
125+
}
126+
},
127+
"Parameters": {
128+
"BootstrapVersion": {
129+
"Type": "AWS::SSM::Parameter::Value<String>",
130+
"Default": "/cdk-bootstrap/hnb659fds/version",
131+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
132+
}
133+
},
134+
"Rules": {
135+
"CheckBootstrapVersion": {
136+
"Assertions": [
137+
{
138+
"Assert": {
139+
"Fn::Not": [
140+
{
141+
"Fn::Contains": [
142+
[
143+
"1",
144+
"2",
145+
"3",
146+
"4",
147+
"5"
148+
],
149+
{
150+
"Ref": "BootstrapVersion"
151+
}
152+
]
153+
}
154+
]
155+
},
156+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
157+
}
158+
]
159+
}
160+
}
161+
}

‎packages/@aws-cdk/aws-events/test/connection.integ.snapshot/IntegConnectionStack.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "21.0.0",
3+
"files": {
4+
"e6e22d5747aaa38a1e1cec7566f5ac875bb6a03925a4a9fb46ef2d7315634d7a": {
5+
"source": {
6+
"path": "IntegConnectionStack.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "e6e22d5747aaa38a1e1cec7566f5ac875bb6a03925a4a9fb46ef2d7315634d7a.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-events/test/connection.integ.snapshot/IntegConnectionStack.template.json

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"Resources": {
3+
"Connection07624BCD": {
4+
"Type": "AWS::Events::Connection",
5+
"Properties": {
6+
"AuthorizationType": "API_KEY",
7+
"AuthParameters": {
8+
"ApiKeyAuthParameters": {
9+
"ApiKeyName": "keyname",
10+
"ApiKeyValue": "keyvalue"
11+
},
12+
"InvocationHttpParameters": {
13+
"HeaderParameters": [
14+
{
15+
"IsValueSecret": false,
16+
"Key": "content-type",
17+
"Value": "application/json"
18+
}
19+
]
20+
}
21+
}
22+
}
23+
}
24+
},
25+
"Outputs": {
26+
"ExportsOutputRefConnection07624BCD5A8A23C8": {
27+
"Value": {
28+
"Ref": "Connection07624BCD"
29+
},
30+
"Export": {
31+
"Name": "IntegConnectionStack:ExportsOutputRefConnection07624BCD5A8A23C8"
32+
}
33+
}
34+
},
35+
"Parameters": {
36+
"BootstrapVersion": {
37+
"Type": "AWS::SSM::Parameter::Value<String>",
38+
"Default": "/cdk-bootstrap/hnb659fds/version",
39+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
40+
}
41+
},
42+
"Rules": {
43+
"CheckBootstrapVersion": {
44+
"Assertions": [
45+
{
46+
"Assert": {
47+
"Fn::Not": [
48+
{
49+
"Fn::Contains": [
50+
[
51+
"1",
52+
"2",
53+
"3",
54+
"4",
55+
"5"
56+
],
57+
{
58+
"Ref": "BootstrapVersion"
59+
}
60+
]
61+
}
62+
]
63+
},
64+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
65+
}
66+
]
67+
}
68+
}
69+
}

0 commit comments

Comments
 (0)