Merge branch 'main' into 28683-preTokenGeneration

CHANGELOG.v2.alpha.md

@@ -2,6 +2,8 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.126.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.125.0-alpha.0...v2.126.0-alpha.0) (2024-02-02)
+
 ## [2.125.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.124.0-alpha.0...v2.125.0-alpha.0) (2024-01-31)
 
 

CHANGELOG.v2.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.126.0](https://github.com/aws/aws-cdk/compare/v2.125.0...v2.126.0) (2024-02-02)
+
+
+### Features
+
+* **migrate:** Add CDK Migrate `--from-scan` functionality ([#28962](https://github.com/aws/aws-cdk/issues/28962)) ([bbc14b3](https://github.com/aws/aws-cdk/commit/bbc14b32801f103bc465fd910d507ffa0d06b7fe))
+
 ## [2.125.0](https://github.com/aws/aws-cdk/compare/v2.124.0...v2.125.0) (2024-01-31)
 
 

packages/@aws-cdk-testing/cli-integ/lib/with-cdk-app.ts

@@ -12,6 +12,7 @@ import { AwsContext, withAws } from './with-aws';
 import { withTimeout } from './with-timeout';
 
 export const DEFAULT_TEST_TIMEOUT_S = 10 * 60;
+export const EXTENDED_TEST_TIMEOUT_S = 30 * 60;
 
 /**
  * Higher order function to execute a block with a CDK app fixture
@@ -185,6 +186,10 @@ export function withDefaultFixture(block: (context: TestFixture) => Promise<void
   return withAws(withTimeout(DEFAULT_TEST_TIMEOUT_S, withCdkApp(block)));
 }
 
+export function withExtendedTimeoutFixture(block: (context: TestFixture) => Promise<void>) {
+  return withAws(withTimeout(EXTENDED_TEST_TIMEOUT_S, withCdkApp(block)));
+}
+
 export function withCDKMigrateFixture(language: string, block: (content: TestFixture) => Promise<void>) {
   return withAws(withTimeout(DEFAULT_TEST_TIMEOUT_S, withCdkMigrateApp(language, block)));
 }

packages/@aws-cdk-testing/cli-integ/resources/cdk-apps/app/app.js

@@ -86,7 +86,35 @@ class MigrateStack extends cdk.Stack {
         value: queue.node.defaultChild.logicalId,
       });
     }
+    if (process.env.SAMPLE_RESOURCES) {
+      const myTopic = new sns.Topic(this, 'migratetopic1', {
+        removalPolicy: cdk.RemovalPolicy.DESTROY,
+      });
+      cdk.Tags.of(myTopic).add('tag1', 'value1');
+      const myTopic2 = new sns.Topic(this, 'migratetopic2', {
+        removalPolicy: cdk.RemovalPolicy.DESTROY,
+      });
+      cdk.Tags.of(myTopic2).add('tag2', 'value2');
+      const myQueue = new sqs.Queue(this, 'migratequeue1', {
+        removalPolicy: cdk.RemovalPolicy.DESTROY,
+      });
+      cdk.Tags.of(myQueue).add('tag3', 'value3');
+    }
+    if (process.env.LAMBDA_RESOURCES) {
+      const myFunction = new lambda.Function(this, 'migratefunction1', {
+        code: lambda.Code.fromInline('console.log("hello world")'),
+        handler: 'index.handler',
+        runtime: lambda.Runtime.NODEJS_18_X,
+      });
+      cdk.Tags.of(myFunction).add('lambda-tag', 'lambda-value');
 
+      const myFunction2 = new lambda.Function(this, 'migratefunction2', {
+        code: lambda.Code.fromInline('console.log("hello world2")'),
+        handler: 'index.handler',
+        runtime: lambda.Runtime.NODEJS_18_X,
+      });
+      cdk.Tags.of(myFunction2).add('lambda-tag', 'lambda-value');
+    }
   }
 }
 

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts

@@ -1,7 +1,7 @@
 import { promises as fs, existsSync } from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { integTest, cloneDirectory, shell, withDefaultFixture, retry, sleep, randomInteger, withSamIntegrationFixture, RESOURCES_DIR, withCDKMigrateFixture } from '../../lib';
+import { integTest, cloneDirectory, shell, withDefaultFixture, retry, sleep, randomInteger, withSamIntegrationFixture, RESOURCES_DIR, withCDKMigrateFixture, withExtendedTimeoutFixture } from '../../lib';
 
 jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
 
@@ -571,9 +571,9 @@ integTest('deploy with role', withDefaultFixture(async (fixture) => {
   }
 }));
 
-// TODO add go back in when template synths properly
+// TODO add more testing that ensures the symmetry of the generated constructs to the resources.
 ['typescript', 'python', 'csharp', 'java'].forEach(language => {
-  integTest(`cdk migrate ${language}`, withCDKMigrateFixture(language, async (fixture) => {
+  integTest(`cdk migrate ${language} deploys successfully`, withCDKMigrateFixture(language, async (fixture) => {
     if (language === 'python') {
       await fixture.shell(['pip', 'install', '-r', 'requirements.txt']);
     }
@@ -588,6 +588,118 @@ integTest('deploy with role', withDefaultFixture(async (fixture) => {
   }));
 });
 
+integTest('cdk migrate generates migrate.json', withCDKMigrateFixture('typescript', async (fixture) => {
+
+  const migrateFile = await fs.readFile(path.join(fixture.integTestDir, 'migrate.json'), 'utf8');
+  const expectedFile = `{
+    \"//\": \"This file is generated by cdk migrate. It will be automatically deleted after the first successful deployment of this app to the environment of the original resources.\",
+    \"Source\": \"localfile\"
+  }`;
+  expect(JSON.parse(migrateFile)).toEqual(JSON.parse(expectedFile));
+  await fixture.cdkDestroy(fixture.stackNamePrefix);
+}));
+
+integTest('cdk migrate --from-scan with AND/OR filters correctly filters resources', withExtendedTimeoutFixture(async (fixture) => {
+  const stackName = `cdk-migrate-integ-${fixture.randomString}`;
+
+  await fixture.cdkDeploy('migrate-stack', {
+    modEnv: { SAMPLE_RESOURCES: '1' },
+  });
+  await fixture.cdk(
+    ['migrate', '--stack-name', stackName, '--from-scan', 'new', '--filter', 'type=AWS::SNS::Topic,tag-key=tag1', 'type=AWS::SQS::Queue,tag-key=tag3'],
+    { modEnv: { MIGRATE_INTEG_TEST: '1' }, neverRequireApproval: true, verbose: true, captureStderr: false },
+  );
+
+  try {
+    const response = await fixture.aws.cloudFormation('describeGeneratedTemplate', {
+      GeneratedTemplateName: stackName,
+    });
+    const resourceNames = [];
+    for (const resource of response.Resources || []) {
+      if (resource.LogicalResourceId) {
+        resourceNames.push(resource.LogicalResourceId);
+      }
+    }
+    fixture.log(`Resources: ${resourceNames}`);
+    expect(resourceNames.some(ele => ele && ele.includes('migratetopic1'))).toBeTruthy();
+    expect(resourceNames.some(ele => ele && ele.includes('migratequeue1'))).toBeTruthy();
+  } finally {
+    await fixture.cdkDestroy('migrate-stack');
+    await fixture.aws.cloudFormation('deleteGeneratedTemplate', {
+      GeneratedTemplateName: stackName,
+    });
+  }
+}));
+
+integTest('cdk migrate --from-scan for resources with Write Only Properties generates warnings', withExtendedTimeoutFixture(async (fixture) => {
+  const stackName = `cdk-migrate-integ-${fixture.randomString}`;
+
+  await fixture.cdkDeploy('migrate-stack', {
+    modEnv: {
+      LAMBDA_RESOURCES: '1',
+    },
+  });
+  await fixture.cdk(
+    ['migrate', '--stack-name', stackName, '--from-scan', 'new', '--filter', 'type=AWS::Lambda::Function,tag-key=lambda-tag'],
+    { modEnv: { MIGRATE_INTEG_TEST: '1' }, neverRequireApproval: true, verbose: true, captureStderr: false },
+  );
+
+  try {
+
+    const response = await fixture.aws.cloudFormation('describeGeneratedTemplate', {
+      GeneratedTemplateName: stackName,
+    });
+    const resourceNames = [];
+    for (const resource of response.Resources || []) {
+      if (resource.LogicalResourceId && resource.ResourceType === 'AWS::Lambda::Function') {
+        resourceNames.push(resource.LogicalResourceId);
+      }
+    }
+    fixture.log(`Resources: ${resourceNames}`);
+    const readmePath = path.join(fixture.integTestDir, stackName, 'README.md');
+    const readme = await fs.readFile(readmePath, 'utf8');
+    expect(readme).toContain('## Warnings');
+    for (const resourceName of resourceNames) {
+      expect(readme).toContain(`### ${resourceName}`);
+    }
+  } finally {
+    await fixture.cdkDestroy('migrate-stack');
+    await fixture.aws.cloudFormation('deleteGeneratedTemplate', {
+      GeneratedTemplateName: stackName,
+    });
+  }
+}));
+
+['typescript', 'python', 'csharp', 'java'].forEach(language => {
+  integTest(`cdk migrate --from-stack creates deployable ${language} app`, withExtendedTimeoutFixture(async (fixture) => {
+    const migrateStackName = fixture.fullStackName('migrate-stack');
+    await fixture.aws.cloudFormation('createStack', {
+      StackName: migrateStackName,
+      TemplateBody: await fs.readFile(path.join(__dirname, '..', '..', 'resources', 'templates', 'sqs-template.json'), 'utf8'),
+    });
+    try {
+      let stackStatus = 'CREATE_IN_PROGRESS';
+      while (stackStatus === 'CREATE_IN_PROGRESS') {
+        stackStatus = await (await (fixture.aws.cloudFormation('describeStacks', { StackName: migrateStackName }))).Stacks?.[0].StackStatus!;
+        await sleep(1000);
+      }
+      await fixture.cdk(
+        ['migrate', '--stack-name', migrateStackName, '--from-stack'],
+        { modEnv: { MIGRATE_INTEG_TEST: '1' }, neverRequireApproval: true, verbose: true, captureStderr: false },
+      );
+      await fixture.shell(['cd', path.join(fixture.integTestDir, migrateStackName)]);
+      await fixture.cdk(['deploy', migrateStackName], { neverRequireApproval: true, verbose: true, captureStderr: false });
+      const response = await fixture.aws.cloudFormation('describeStacks', {
+        StackName: migrateStackName,
+      });
+
+      expect(response.Stacks?.[0].StackStatus).toEqual('UPDATE_COMPLETE');
+    } finally {
+      await fixture.cdkDestroy('migrate-stack');
+    }
+  }));
+});
+
 integTest('cdk diff', withDefaultFixture(async (fixture) => {
   const diff1 = await fixture.cdk(['diff', fixture.fullStackName('test-1')]);
   expect(diff1).toContain('AWS::SNS::Topic');

packages/@aws-cdk-testing/framework-integ/package.json

@@ -43,8 +43,8 @@
     "aws-cdk-lib": "0.0.0",
     "aws-sdk": "^2.1548.0",
     "aws-sdk-mock": "5.6.0",
-    "cdk8s": "2.68.32",
-    "cdk8s-plus-27": "2.7.74",
+    "cdk8s": "2.68.33",
+    "cdk8s-plus-27": "2.7.75",
     "constructs": "^10.0.0"
   },
   "repository": {

packages/@aws-cdk-testing/framework-integ/test/aws-apigatewayv2-authorizers/test/http/integ.lambda.ts

@@ -18,7 +18,7 @@ const stack = new Stack(app, 'AuthorizerInteg');
 const authHandler = new lambda.Function(stack, 'auth-function', {
   runtime: lambda.Runtime.NODEJS_18_X,
   handler: 'index.handler',
-  code: lambda.Code.fromAsset(path.join(__dirname, '../auth-handler')),
+  code: lambda.Code.fromAsset(path.join(__dirname, '..', 'auth-handler')),
 });
 
 const authorizer = new HttpLambdaAuthorizer('LambdaAuthorizer', authHandler, {
@@ -41,7 +41,7 @@ const httpApiWithDefaultAuthorizer = new HttpApi(stack, 'MyHttpApiWithDefaultAut
 const handler = new lambda.Function(stack, 'lambda', {
   runtime: lambda.Runtime.NODEJS_18_X,
   handler: 'index.handler',
-  code: lambda.AssetCode.fromAsset(path.join(__dirname, '../integ.lambda.handler')),
+  code: lambda.AssetCode.fromAsset(path.join(__dirname, '..', 'integ.lambda.handler')),
 });
 
 httpApi.addRoutes({

packages/@aws-cdk-testing/framework-integ/test/aws-apigatewayv2-authorizers/test/http/integ.user-pool.ts

@@ -31,7 +31,7 @@ const httpApiWithDefaultAuthorizer = new HttpApi(stack, 'MyHttpApiWithDefaultAut
 const handler = new lambda.Function(stack, 'lambda', {
   runtime: lambda.Runtime.NODEJS_18_X,
   handler: 'index.handler',
-  code: lambda.AssetCode.fromAsset(path.join(__dirname, '../integ.user-pool.handler')),
+  code: lambda.AssetCode.fromAsset(path.join(__dirname, '..', 'integ.user-pool.handler')),
 });
 
 httpApi.addRoutes({

packages/@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.appsync-lambda.ts

@@ -28,7 +28,7 @@ const api = new appsync.GraphqlApi(stack, 'LambdaAPI', {
 });
 
 const func = new lambda.Function(stack, 'func', {
-  code: lambda.Code.fromAsset(path.join(__dirname, 'verify/lambda-tutorial')),
+  code: lambda.Code.fromAsset(path.join(__dirname, 'verify', 'lambda-tutorial')),
   handler: 'lambda-tutorial.handler',
   runtime: STANDARD_NODEJS_RUNTIME,
 });

packages/@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.js-resolver.ts

@@ -58,7 +58,7 @@ const integ = new IntegTest(app, 'JsResolverIntegTest', { testCases: [stack] });
  * Handler that calls our api with an `addTest` Mutation
  */
 const invoke = new lambda.Function(stack, 'InvokeApi', {
-  code: lambda.Code.fromAsset(path.join(__dirname, 'integ-assets/js-resolver-assertion')),
+  code: lambda.Code.fromAsset(path.join(__dirname, 'integ-assets', 'js-resolver-assertion')),
   handler: 'index.handler',
   runtime: lambda.Runtime.NODEJS_18_X,
 });

packages/@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.lambda-auth.ts

@@ -12,7 +12,7 @@ class GraphQLApiLambdaAuthStack extends cdk.Stack {
 
     const func = new lambda.Function(this, 'func', {
       code: lambda.Code.fromAsset(
-        path.join(__dirname, 'verify/lambda-tutorial'),
+        path.join(__dirname, 'verify', 'lambda-tutorial'),
       ),
       handler: 'lambda-tutorial.handler',
       runtime: STANDARD_NODEJS_RUNTIME,

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.ts

@@ -52,6 +52,7 @@ const prodStage = {
 };
 
 new codepipeline.Pipeline(stack, 'Pipeline', {
+  crossAccountKeys: true,
   stages: [
     sourceStage,
     prodStage,

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.ts

@@ -20,7 +20,9 @@ new lambda.Function(lambdaStack, 'Lambda', {
 // other resources that your Lambda needs, added to the lambdaStack...
 
 const pipelineStack = new cdk.Stack(app, 'PipelineStack');
-const pipeline = new codepipeline.Pipeline(pipelineStack, 'Pipeline');
+const pipeline = new codepipeline.Pipeline(pipelineStack, 'Pipeline', {
+  crossAccountKeys: true,
+});
 
 // add the source code repository containing this code to your Pipeline,
 // and the source code of the Lambda Function, if they're separate

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.lambda-pipeline.ts

@@ -10,7 +10,9 @@ const app = new cdk.App();
 
 const stack = new cdk.Stack(app, 'aws-cdk-codepipeline-lambda');
 
-const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
+const pipeline = new codepipeline.Pipeline(stack, 'Pipeline', {
+  crossAccountKeys: true,
+});
 
 const sourceStage = pipeline.addStage({ stageName: 'Source' });
 const bucket = new s3.Bucket(stack, 'PipelineBucket', {

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-alexa-deploy.ts

@@ -39,6 +39,7 @@ const deployStage = {
 };
 
 new codepipeline.Pipeline(stack, 'Pipeline', {
+  crossAccountKeys: true,
   stages: [
     sourceStage,
     deployStage,

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-cfn.ts

@@ -8,7 +8,9 @@ const app = new cdk.App();
 
 const stack = new cdk.Stack(app, 'aws-cdk-codepipeline-cloudformation');
 
-const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
+const pipeline = new codepipeline.Pipeline(stack, 'Pipeline', {
+  crossAccountKeys: true,
+});
 
 const bucket = new s3.Bucket(stack, 'PipelineBucket', {
   versioned: true,

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.ts

@@ -47,6 +47,7 @@ const testAction = new cpactions.CodeBuildAction({
 });
 
 new codepipeline.Pipeline(stack, 'Pipeline', {
+  crossAccountKeys: true,
   stages: [
     {
       stageName: 'source',

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-code-commit-custom-event.ts

@@ -32,6 +32,7 @@ const eventPattern
 
 const pipeline = new codepipeline.Pipeline(stack, 'Pipeline', {
   pipelineName: 'IntegCustomEventPipeline',
+  crossAccountKeys: true,
   stages: [
     {
       stageName: 'source',

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-code-commit-main.ts

@@ -15,6 +15,7 @@ const repo = new codecommit.Repository(stack, 'MyRepo', {
 });
 
 new codepipeline.Pipeline(stack, 'Pipeline', {
+  crossAccountKeys: true,
   stages: [
     {
       stageName: 'source',

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-code-commit.ts

@@ -16,6 +16,7 @@ const repo = new codecommit.Repository(stack, 'MyRepo', {
 });
 
 new codepipeline.Pipeline(stack, 'Pipeline', {
+  crossAccountKeys: true,
   stages: [
     {
       stageName: 'source',

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-elastic-beanstalk-deploy.ts

@@ -32,7 +32,7 @@ const bucket = new s3.Bucket(stack, 'PipelineBucket', {
 });
 
 const artifact = new deploy.BucketDeployment(stack, 'DeployApp', {
-  sources: [deploy.Source.asset(path.join(__dirname, 'assets/nodejs.zip'))],
+  sources: [deploy.Source.asset(path.join(__dirname, 'assets', 'nodejs.zip'))],
   destinationBucket: bucket,
   extract: false,
 });

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-events.ts

@@ -13,7 +13,9 @@ const app = new cdk.App();
 
 const stack = new cdk.Stack(app, 'aws-cdk-pipeline-event-target');
 
-const pipeline = new codepipeline.Pipeline(stack, 'MyPipeline');
+const pipeline = new codepipeline.Pipeline(stack, 'MyPipeline', {
+  crossAccountKeys: true,
+});
 
 const repository = new codecommit.Repository(stack, 'CodeCommitRepo', {
   repositoryName: 'foo',

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-stepfunctions.ts

@@ -15,7 +15,9 @@ const simpleStateMachine = new stepfunctions.StateMachine(stack, 'SimpleStateMac
   definition: startState,
 });
 
-const pipeline = new codepipeline.Pipeline(stack, 'MyPipeline');
+const pipeline = new codepipeline.Pipeline(stack, 'MyPipeline', {
+  crossAccountKeys: true,
+});
 pipeline.addStage({
   stageName: 'Source',
   actions: [