Skip to content

Commit fadbfc1

Browse files
sennyeyasennyeya
authored
fix(aws-events): restrict eventbus statementId to 64 characters (#22296)
Fixes #22120, #21808. Current setup does not allow deployment of the EventBus support stack due to StatementId being larger than 64 characters. ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent e06d2e6 commit fadbfc1

16 files changed

+1790
-3
lines changed

‎packages/@aws-cdk/aws-events/lib/rule.ts

+4-1
Original file line numberDiff line numberDiff line change
@@ -368,9 +368,12 @@ export class Rule extends Resource implements IRule {
368368
// Leaving it in for backwards compatibility.
369369
stackName: `${targetStack.stackName}-EventBusPolicy-support-${targetRegion}-${sourceAccount}`,
370370
});
371+
const statementPrefix = `Allow-account-${sourceAccount}-`;
371372
new CfnEventBusPolicy(eventBusPolicyStack, 'GivePermToOtherAccount', {
372373
action: 'events:PutEvents',
373-
statementId: `Allow-account-${sourceAccount}-${this.node.addr}`,
374+
statementId: statementPrefix + Names.uniqueResourceName(this, {
375+
maxLength: 64 - statementPrefix.length,
376+
}),
374377
principal: sourceAccount,
375378
});
376379
}

‎packages/@aws-cdk/aws-events/test/cross-account-rule.integ.snapshot/CrossAccountDeployDefaultTestDeployAssertB5328BEF.assets.json

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"version": "21.0.0",
3+
"files": {
4+
"2a53dc40a7dae81c8850e125ab49e5f55d80b7b8ceac86976f2a4119393cab72": {
5+
"source": {
6+
"path": "asset.2a53dc40a7dae81c8850e125ab49e5f55d80b7b8ceac86976f2a4119393cab72.bundle",
7+
"packaging": "zip"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "2a53dc40a7dae81c8850e125ab49e5f55d80b7b8ceac86976f2a4119393cab72.zip",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
},
17+
"06c797cad62334a220096d2292d9e1028ba01ed3582f081c5ddee52bc7e0c494": {
18+
"source": {
19+
"path": "CrossAccountDeployDefaultTestDeployAssertB5328BEF.template.json",
20+
"packaging": "file"
21+
},
22+
"destinations": {
23+
"current_account-current_region": {
24+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25+
"objectKey": "06c797cad62334a220096d2292d9e1028ba01ed3582f081c5ddee52bc7e0c494.json",
26+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
27+
}
28+
}
29+
}
30+
},
31+
"dockerImages": {}
32+
}

‎packages/@aws-cdk/aws-events/test/cross-account-rule.integ.snapshot/CrossAccountDeployDefaultTestDeployAssertB5328BEF.template.json

+156
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
{
2+
"Resources": {
3+
"AwsApiCallEventBridgedescribeEventBus": {
4+
"Type": "Custom::DeployAssert@SdkCallEventBridgedescribeEventBus",
5+
"Properties": {
6+
"ServiceToken": {
7+
"Fn::GetAtt": [
8+
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F",
9+
"Arn"
10+
]
11+
},
12+
"service": "EventBridge",
13+
"api": "describeEventBus",
14+
"flattenResponse": "true",
15+
"salt": "1666817700798"
16+
},
17+
"UpdateReplacePolicy": "Delete",
18+
"DeletionPolicy": "Delete"
19+
},
20+
"AwsApiCallEventBridgedescribeEventBusAssertEqualsEventBridgedescribeEventBusB063C036": {
21+
"Type": "Custom::DeployAssert@AssertEquals",
22+
"Properties": {
23+
"ServiceToken": {
24+
"Fn::GetAtt": [
25+
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F",
26+
"Arn"
27+
]
28+
},
29+
"actual": {
30+
"Fn::GetAtt": [
31+
"AwsApiCallEventBridgedescribeEventBus",
32+
"apiCallResponse.Policy"
33+
]
34+
},
35+
"expected": "{\"$ObjectLike\":{\"Statement\":{\"$ArrayWith\":[{\"$ObjectLike\":{\"Sid\":{\"$StringLike\":\"Allow-account-987654321\"},\"Principal\":{\"AWS\":\"arn:aws:iam::987654321:root\"},\"Resource\":{\"$StringLike\":\"arn:aws:events:us-east-1:12345678\"}}}]}}}",
36+
"salt": "1666817700798"
37+
},
38+
"UpdateReplacePolicy": "Delete",
39+
"DeletionPolicy": "Delete"
40+
},
41+
"SingletonFunction1488541a7b23466481b69b4408076b81Role37ABCE73": {
42+
"Type": "AWS::IAM::Role",
43+
"Properties": {
44+
"AssumeRolePolicyDocument": {
45+
"Version": "2012-10-17",
46+
"Statement": [
47+
{
48+
"Action": "sts:AssumeRole",
49+
"Effect": "Allow",
50+
"Principal": {
51+
"Service": "lambda.amazonaws.com"
52+
}
53+
}
54+
]
55+
},
56+
"ManagedPolicyArns": [
57+
{
58+
"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
59+
}
60+
],
61+
"Policies": [
62+
{
63+
"PolicyName": "Inline",
64+
"PolicyDocument": {
65+
"Version": "2012-10-17",
66+
"Statement": [
67+
{
68+
"Action": [
69+
"eventbridge:DescribeEventBus"
70+
],
71+
"Effect": "Allow",
72+
"Resource": [
73+
"*"
74+
]
75+
},
76+
{
77+
"Action": [
78+
"events:DescribeEventBus"
79+
],
80+
"Effect": "Allow",
81+
"Resource": [
82+
"*"
83+
]
84+
}
85+
]
86+
}
87+
}
88+
]
89+
}
90+
},
91+
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F": {
92+
"Type": "AWS::Lambda::Function",
93+
"Properties": {
94+
"Runtime": "nodejs14.x",
95+
"Code": {
96+
"S3Bucket": {
97+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
98+
},
99+
"S3Key": "2a53dc40a7dae81c8850e125ab49e5f55d80b7b8ceac86976f2a4119393cab72.zip"
100+
},
101+
"Timeout": 120,
102+
"Handler": "index.handler",
103+
"Role": {
104+
"Fn::GetAtt": [
105+
"SingletonFunction1488541a7b23466481b69b4408076b81Role37ABCE73",
106+
"Arn"
107+
]
108+
}
109+
}
110+
}
111+
},
112+
"Outputs": {
113+
"AssertionResultsAssertEqualsEventBridgedescribeEventBusfd3cf7d971587606ecf8442a4cb30f1b": {
114+
"Value": {
115+
"Fn::GetAtt": [
116+
"AwsApiCallEventBridgedescribeEventBusAssertEqualsEventBridgedescribeEventBusB063C036",
117+
"data"
118+
]
119+
}
120+
}
121+
},
122+
"Parameters": {
123+
"BootstrapVersion": {
124+
"Type": "AWS::SSM::Parameter::Value<String>",
125+
"Default": "/cdk-bootstrap/hnb659fds/version",
126+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
127+
}
128+
},
129+
"Rules": {
130+
"CheckBootstrapVersion": {
131+
"Assertions": [
132+
{
133+
"Assert": {
134+
"Fn::Not": [
135+
{
136+
"Fn::Contains": [
137+
[
138+
"1",
139+
"2",
140+
"3",
141+
"4",
142+
"5"
143+
],
144+
{
145+
"Ref": "BootstrapVersion"
146+
}
147+
]
148+
}
149+
]
150+
},
151+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
152+
}
153+
]
154+
}
155+
}
156+
}

‎packages/@aws-cdk/aws-events/test/cross-account-rule.integ.snapshot/EventBusPolicy-987654321-test-region-12345678.assets.json

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{
2+
"version": "21.0.0",
3+
"files": {
4+
"462c696e4c93ec0e97ebd5917666e8ded21f0a81055e38f6683a27853ca79fd4": {
5+
"source": {
6+
"path": "EventBusPolicy-987654321-test-region-12345678.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"12345678-test-region": {
11+
"bucketName": "cdk-hnb659fds-assets-12345678-test-region",
12+
"objectKey": "462c696e4c93ec0e97ebd5917666e8ded21f0a81055e38f6683a27853ca79fd4.json",
13+
"region": "test-region",
14+
"assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region"
15+
}
16+
}
17+
}
18+
},
19+
"dockerImages": {}
20+
}

‎packages/@aws-cdk/aws-events/test/cross-account-rule.integ.snapshot/EventBusPolicy-987654321-test-region-12345678.template.json

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"Resources": {
3+
"GivePermToOtherAccount": {
4+
"Type": "AWS::Events::EventBusPolicy",
5+
"Properties": {
6+
"StatementId": "Allow-account-987654321-FromCrossAccountRuleStackMyRule68A189ED",
7+
"Action": "events:PutEvents",
8+
"Principal": "987654321"
9+
}
10+
}
11+
},
12+
"Parameters": {
13+
"BootstrapVersion": {
14+
"Type": "AWS::SSM::Parameter::Value<String>",
15+
"Default": "/cdk-bootstrap/hnb659fds/version",
16+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
17+
}
18+
},
19+
"Rules": {
20+
"CheckBootstrapVersion": {
21+
"Assertions": [
22+
{
23+
"Assert": {
24+
"Fn::Not": [
25+
{
26+
"Fn::Contains": [
27+
[
28+
"1",
29+
"2",
30+
"3",
31+
"4",
32+
"5"
33+
],
34+
{
35+
"Ref": "BootstrapVersion"
36+
}
37+
]
38+
}
39+
]
40+
},
41+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
42+
}
43+
]
44+
}
45+
}
46+
}

‎packages/@aws-cdk/aws-events/test/cross-account-rule.integ.snapshot/FromCrossAccountRuleStack.assets.json

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{
2+
"version": "21.0.0",
3+
"files": {
4+
"c6101587e135a4563e666bf1dd45e671ba4c4bc60130f3b8167502cbc174aa70": {
5+
"source": {
6+
"path": "FromCrossAccountRuleStack.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"987654321-test-region": {
11+
"bucketName": "cdk-hnb659fds-assets-987654321-test-region",
12+
"objectKey": "c6101587e135a4563e666bf1dd45e671ba4c4bc60130f3b8167502cbc174aa70.json",
13+
"region": "test-region",
14+
"assumeRoleArn": "arn:${AWS::Partition}:iam::987654321:role/cdk-hnb659fds-file-publishing-role-987654321-test-region"
15+
}
16+
}
17+
}
18+
},
19+
"dockerImages": {}
20+
}

‎packages/@aws-cdk/aws-events/test/cross-account-rule.integ.snapshot/FromCrossAccountRuleStack.template.json

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{
2+
"Resources": {
3+
"MyRuleA44AB831": {
4+
"Type": "AWS::Events::Rule",
5+
"Properties": {
6+
"EventPattern": {
7+
"detail": {
8+
"foo": [
9+
"bar"
10+
]
11+
},
12+
"detail-type": [
13+
"cdk-integ-custom-rule"
14+
],
15+
"source": [
16+
"cdk-integ"
17+
]
18+
},
19+
"State": "ENABLED",
20+
"Targets": [
21+
{
22+
"Arn": {
23+
"Fn::Join": [
24+
"",
25+
[
26+
"arn:",
27+
{
28+
"Ref": "AWS::Partition"
29+
},
30+
":events:test-region:12345678:event-bus/default"
31+
]
32+
]
33+
},
34+
"Id": "SQS"
35+
}
36+
]
37+
}
38+
}
39+
},
40+
"Parameters": {
41+
"BootstrapVersion": {
42+
"Type": "AWS::SSM::Parameter::Value<String>",
43+
"Default": "/cdk-bootstrap/hnb659fds/version",
44+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
45+
}
46+
},
47+
"Rules": {
48+
"CheckBootstrapVersion": {
49+
"Assertions": [
50+
{
51+
"Assert": {
52+
"Fn::Not": [
53+
{
54+
"Fn::Contains": [
55+
[
56+
"1",
57+
"2",
58+
"3",
59+
"4",
60+
"5"
61+
],
62+
{
63+
"Ref": "BootstrapVersion"
64+
}
65+
]
66+
}
67+
]
68+
},
69+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
70+
}
71+
]
72+
}
73+
}
74+
}

‎packages/@aws-cdk/aws-events/test/cross-account-rule.integ.snapshot/ToCrossAccountRuleStack.assets.json

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{
2+
"version": "21.0.0",
3+
"files": {
4+
"0d750187c0e1bc77f1edfc3af57e55036907d6dfaef463a7acfdc0c42325a18c": {
5+
"source": {
6+
"path": "ToCrossAccountRuleStack.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"12345678-test-region": {
11+
"bucketName": "cdk-hnb659fds-assets-12345678-test-region",
12+
"objectKey": "0d750187c0e1bc77f1edfc3af57e55036907d6dfaef463a7acfdc0c42325a18c.json",
13+
"region": "test-region",
14+
"assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region"
15+
}
16+
}
17+
}
18+
},
19+
"dockerImages": {}
20+
}

0 commit comments

Comments
 (0)