fix(sns-subscriptions): restrict encryption of queue to only the respective sns topic (under feature flag) #20521
Conversation
|
|
corymhall
changed the title
There was a problem hiding this comment.
@daschaa, unfortunately since this does technically introduce a breaking change, this will need to live behind a feature flag.
daschaa
changed the title
|
@corymhall I have now added the feature flag. Since this is my first time implementing a feature flag, it would be cool if you could double check everything and give some feedback if it is ok like it is implemented. |
|
@corymhall Thanks for the review! I have added everything (I think) ❤️ |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
…ective sns topic (under feature flag) (aws#20521) Implements aws#20339 The change adds a conditional that only the corresponding SNS Topic can decrypt the SQS queue with the KMS-Key if one was given. ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/master/INTEGRATION_TESTS.md)? * [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…21074) [Follow-Up to this Comment.](#20521 (comment)) > Can you also add this info [here](https://github.com/aws/aws-cdk/blob/68f09b7c6f8e6c1ddf13fdd4e116d12333d24c46/packages/%40aws-cdk/cx-api/README.md?plain=1#L14)? We haven't found the best way to document these yet so until then I figure that will have to do. In the contributing documentation for the feature flags the part for adding an entry in the feature flags README was added in this PR. ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Implements #20339
The change adds a conditional that only the corresponding SNS Topic can decrypt the SQS queue with the KMS-Key if one was given.
All Submissions:
Adding new Unconventional Dependencies:
New Features
yarn integto deploy the infrastructure and generate the snapshot (i.e.yarn integwithout--dry-run)?By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license