fix(codebuild): permissions for Project in VPC used incorrect AWS par…

…tition (#10637) Creating a CodeBuild project with vpc attachment creates and attaches a policy to the IAM role with static resource arn that does not reference `AWS::Partition` - this breaks compatibility with GovCloud. fixes #10634 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
aws · Oct 1, 2020 · b207888 · b207888
1 parent c908c7b
commit b207888
Show file tree

Hide file tree

Showing 4 changed files with 35 additions and 8 deletions.
diff --git a/packages/@aws-cdk/aws-codebuild/lib/project.ts b/packages/@aws-cdk/aws-codebuild/lib/project.ts
@@ -1038,13 +1038,13 @@ export class Project extends ProjectBase {
     }
 
     this.role.addToPolicy(new iam.PolicyStatement({
-      resources: [`arn:aws:ec2:${Aws.REGION}:${Aws.ACCOUNT_ID}:network-interface/*`],
+      resources: [`arn:${Aws.PARTITION}:ec2:${Aws.REGION}:${Aws.ACCOUNT_ID}:network-interface/*`],
       actions: ['ec2:CreateNetworkInterfacePermission'],
       conditions: {
         StringEquals: {
           'ec2:Subnet': props.vpc
             .selectSubnets(props.subnetSelection).subnetIds
-            .map(si => `arn:aws:ec2:${Aws.REGION}:${Aws.ACCOUNT_ID}:subnet/${si}`),
+            .map(si => `arn:${Aws.PARTITION}:ec2:${Aws.REGION}:${Aws.ACCOUNT_ID}:subnet/${si}`),
           'ec2:AuthorizedService': 'codebuild.amazonaws.com',
         },
       },

diff --git a/packages/@aws-cdk/aws-codebuild/test/integ.project-file-system-location.expected.json b/packages/@aws-cdk/aws-codebuild/test/integ.project-file-system-location.expected.json
@@ -244,7 +244,11 @@
                       "Fn::Join": [
                         "",
                         [
-                          "arn:aws:ec2:",
+                          "arn:",
+                          {
+                            "Ref": "AWS::Partition"
+                          },
+                          ":ec2:",
                           {
                             "Ref": "AWS::Region"
                           },
@@ -268,7 +272,11 @@
                 "Fn::Join": [
                   "",
                   [
-                    "arn:aws:ec2:",
+                    "arn:",
+                    {
+                      "Ref": "AWS::Partition"
+                    },
+                    ":ec2:",
                     {
                       "Ref": "AWS::Region"
                     },
@@ -375,7 +383,18 @@
         "FileSystemLocations": [
           {
             "Identifier": "myidentifier",
-            "Location": "fs-c8d04839.efs.eu-west-2.amazonaws.com:/mnt",
+            "Location": {
+              "Fn::Join": [
+                "",
+                [
+                  "fs-c8d04839.efs.",
+                  {
+                    "Ref": "AWS::Region"
+                  },
+                  ".amazonaws.com:/mnt"
+                ]
+              ]
+            },
             "MountOptions": "nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2",
             "MountPoint": "/media",
             "Type": "EFS"

diff --git a/packages/@aws-cdk/aws-codebuild/test/integ.project-file-system-location.ts b/packages/@aws-cdk/aws-codebuild/test/integ.project-file-system-location.ts
@@ -27,7 +27,7 @@ new codebuild.Project(stack, 'MyProject', {
   securityGroups: [securityGroup],
   fileSystemLocations: [codebuild.FileSystemLocation.efs({
     identifier: 'myidentifier',
-    location: 'fs-c8d04839.efs.eu-west-2.amazonaws.com:/mnt',
+    location: `fs-c8d04839.efs.${cdk.Aws.REGION}.amazonaws.com:/mnt`,
     mountOptions: 'nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2',
     mountPoint: '/media',
   })],

diff --git a/packages/@aws-cdk/aws-codebuild/test/integ.project-vpc.expected.json b/packages/@aws-cdk/aws-codebuild/test/integ.project-vpc.expected.json
@@ -244,7 +244,11 @@
                       "Fn::Join": [
                         "",
                         [
-                          "arn:aws:ec2:",
+                          "arn:",
+                          {
+                            "Ref": "AWS::Partition"
+                          },
+                          ":ec2:",
                           {
                             "Ref": "AWS::Region"
                           },
@@ -268,7 +272,11 @@
                 "Fn::Join": [
                   "",
                   [
-                    "arn:aws:ec2:",
+                    "arn:",
+                    {
+                      "Ref": "AWS::Partition"
+                    },
+                    ":ec2:",
                     {
                       "Ref": "AWS::Region"
                     },