feat(aws-sqs): allow direct grants from a Queue #1004

leepa · 2018-10-24T11:44:32Z

Add grantReceive and grantSend to a Queue allowing a user to be able to
directly grant permissions to an IAM Principal (Role, User etc.).

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.

rix0rrr · 2018-10-24T11:53:41Z

packages/@aws-cdk/aws-sqs/lib/perms.ts

@@ -0,0 +1,7 @@
+export const QUEUE_GET_ACTIONS = [
+    "sqs:ReceiveMessage",


Should have DeleteMessage(s) and SetVisibilityTimeout (and maybe others?) as well I think. Those are common receiver actions.

I based this off the templated permissions the user expects in the console and the examples that the IAM documentation states are needed (doesn't mean it's right in this case!). Maybe more detailed grants might work for those cases?

rix0rrr · 2018-10-24T11:54:48Z

packages/@aws-cdk/aws-sqs/lib/queue.ts

@@ -275,6 +277,26 @@ export class Queue extends QueueRef {
    }
  }

+  public grantReceiveMessages(identity?: iam.IPrincipal) {


In my head this was always called grantConsume (since you're consuming from the queue). What do you think? More accurate or too pretentious?

Went for Receive to match AWS documentation nomenclature but open to opinion here. It might well be that both names are right and that having both to enable the user to easily find it might be better.

"Consume" has the advantage (in my mind) that it's very clear that you'll be removing messages from the queue as well.

Maybe we can squash both discussions by exposing both grantConsume (receive+delete+setvisibilitytimeout) and grantReceive (just receive).

But I think that will be a compromise to appease the naysayers. I don't see a realistic scenario in which you ever want to give someone just receiveMessage permissions. Maybe a snooper, but not an active component.

Roger that - I'll change accordingly.

rix0rrr · 2018-10-24T12:40:51Z

packages/@aws-cdk/aws-sqs/lib/perms.ts

@@ -0,0 +1,7 @@
+export const QUEUE_GET_ACTIONS = [


No need to expose these I think. Might as well put them in the queue.ts file and not export them.

rix0rrr · 2018-10-24T12:41:10Z

packages/@aws-cdk/aws-sqs/lib/queue.ts

@@ -275,6 +277,26 @@ export class Queue extends QueueRef {
    }
  }

+  public grantReceiveMessages(identity?: iam.IPrincipal) {


Should have a public docstring

rix0rrr · 2018-10-24T12:41:16Z

packages/@aws-cdk/aws-sqs/lib/queue.ts

+    this.grant(identity, perms.QUEUE_GET_ACTIONS);
+  }
+
+  public grantSendMessages(identity?: iam.IPrincipal) {


Should have a public docstring

rix0rrr · 2018-10-24T12:41:21Z

packages/@aws-cdk/aws-sqs/lib/queue.ts

+    this.grant(identity, perms.QUEUE_PUT_ACTIONS);
+  }
+
+  private grant(identity: iam.IPrincipal | undefined,


Might have a docstring as well, why not.

Add grantReceive and grantSend to a Queue allowing a user to be able to directly grant permissions to an IAM Principal (Role, User etc.). An additional grantConsume is here for combining three permissions commonly used when consuming messages rather than just receiving to provide the ability to set message visibility and delete entirely.

__IMPORTANT NOTE__: when upgrading to this version of the CDK framework, you must also upgrade your installation the CDK Toolkit to the matching version: ```shell $ npm i -g aws-cdk $ cdk --version 0.14.0 (build ...) ``` Bug Fixes ========= * remove CloudFormation property renames ([#973](#973)) ([3f86603](3f86603)), closes [#852](#852) * **aws-ec2:** fix retention of all egress traffic rule ([#998](#998)) ([b9d5b43](b9d5b43)), closes [#987](#987) * **aws-s3-deployment:** avoid deletion during update using physical ids ([#1006](#1006)) ([bca99c6](bca99c6)), closes [#981](#981) [#981](#981) * **cloudformation-diff:** ignore changes to DependsOn ([#1005](#1005)) ([3605f9c](3605f9c)), closes [#274](#274) * **cloudformation-diff:** track replacements ([#1003](#1003)) ([a83ac5f](a83ac5f)), closes [#1001](#1001) * **docs:** fix EC2 readme for "natgatway" configuration ([#994](#994)) ([0b1e7cc](0b1e7cc)) * **docs:** updates to contribution guide ([#997](#997)) ([b42e742](b42e742)) * **iam:** Merge multiple principals correctly ([#983](#983)) ([3fc5c8c](3fc5c8c)), closes [#924](#924) [#916](#916) [#958](#958) Features ========= * add construct library for Application AutoScaling ([#933](#933)) ([7861c6f](7861c6f)), closes [#856](#856) [#861](#861) [#640](#640) [#644](#644) * add HostedZone context provider ([#823](#823)) ([1626c37](1626c37)) * **assert:** haveResource lists failing properties ([#1016](#1016)) ([7f6f3fd](7f6f3fd)) * **aws-cdk:** add CDK app version negotiation ([#988](#988)) ([db4e718](db4e718)), closes [#891](#891) * **aws-codebuild:** Introduce a CodePipeline test Action. ([#873](#873)) ([770f9aa](770f9aa)) * **aws-sqs:** Add grantXxx() methods ([#1004](#1004)) ([8c90350](8c90350)) * **core:** Pre-concatenate Fn::Join ([#967](#967)) ([33c32a8](33c32a8)), closes [#916](#916) [#958](#958) BREAKING CHANGES ========= * DynamoDB AutoScaling: Instead of `addReadAutoScaling()`, call `autoScaleReadCapacity()`, and similar for write scaling. * CloudFormation resource usage: If you use L1s, you may need to change some `XxxName` properties back into `Name`. These will match the CloudFormation property names. * You must use the matching `aws-cdk` toolkit when upgrading to this version, or context providers will cease to work. All existing cached context values in `cdk.json` will be invalidated and refreshed.

__IMPORTANT NOTE__: when upgrading to this version of the CDK framework, you must also upgrade your installation the CDK Toolkit to the matching version: ```shell $ npm i -g aws-cdk $ cdk --version 0.14.0 (build ...) ``` Bug Fixes ========= * remove CloudFormation property renames ([aws#973](aws#973)) ([3f86603](aws@3f86603)), closes [aws#852](aws#852) * **aws-ec2:** fix retention of all egress traffic rule ([aws#998](aws#998)) ([b9d5b43](aws@b9d5b43)), closes [aws#987](aws#987) * **aws-s3-deployment:** avoid deletion during update using physical ids ([aws#1006](aws#1006)) ([bca99c6](aws@bca99c6)), closes [aws#981](aws#981) [aws#981](aws#981) * **cloudformation-diff:** ignore changes to DependsOn ([aws#1005](aws#1005)) ([3605f9c](aws@3605f9c)), closes [aws#274](aws#274) * **cloudformation-diff:** track replacements ([aws#1003](aws#1003)) ([a83ac5f](aws@a83ac5f)), closes [aws#1001](aws#1001) * **docs:** fix EC2 readme for "natgatway" configuration ([aws#994](aws#994)) ([0b1e7cc](aws@0b1e7cc)) * **docs:** updates to contribution guide ([aws#997](aws#997)) ([b42e742](aws@b42e742)) * **iam:** Merge multiple principals correctly ([aws#983](aws#983)) ([3fc5c8c](aws@3fc5c8c)), closes [aws#924](aws#924) [aws#916](aws#916) [aws#958](aws#958) Features ========= * add construct library for Application AutoScaling ([aws#933](aws#933)) ([7861c6f](aws@7861c6f)), closes [aws#856](aws#856) [aws#861](aws#861) [aws#640](aws#640) [aws#644](aws#644) * add HostedZone context provider ([aws#823](aws#823)) ([1626c37](aws@1626c37)) * **assert:** haveResource lists failing properties ([aws#1016](aws#1016)) ([7f6f3fd](aws@7f6f3fd)) * **aws-cdk:** add CDK app version negotiation ([aws#988](aws#988)) ([db4e718](aws@db4e718)), closes [aws#891](aws#891) * **aws-codebuild:** Introduce a CodePipeline test Action. ([aws#873](aws#873)) ([770f9aa](aws@770f9aa)) * **aws-sqs:** Add grantXxx() methods ([aws#1004](aws#1004)) ([8c90350](aws@8c90350)) * **core:** Pre-concatenate Fn::Join ([aws#967](aws#967)) ([33c32a8](aws@33c32a8)), closes [aws#916](aws#916) [aws#958](aws#958) BREAKING CHANGES ========= * DynamoDB AutoScaling: Instead of `addReadAutoScaling()`, call `autoScaleReadCapacity()`, and similar for write scaling. * CloudFormation resource usage: If you use L1s, you may need to change some `XxxName` properties back into `Name`. These will match the CloudFormation property names. * You must use the matching `aws-cdk` toolkit when upgrading to this version, or context providers will cease to work. All existing cached context values in `cdk.json` will be invalidated and refreshed.

rix0rrr reviewed Oct 24, 2018

View reviewed changes

rix0rrr approved these changes Oct 24, 2018

View reviewed changes

rix0rrr added 2 commits October 24, 2018 15:10

Make Consume name consistent with other methods

835e75f

Also update test

72bced2

rix0rrr merged commit 8c90350 into aws:master Oct 24, 2018

rix0rrr mentioned this pull request Oct 26, 2018

v0.14.0 #1021

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(aws-sqs): allow direct grants from a Queue #1004

feat(aws-sqs): allow direct grants from a Queue #1004

leepa commented Oct 24, 2018

rix0rrr Oct 24, 2018

leepa Oct 24, 2018

rix0rrr Oct 24, 2018

leepa Oct 24, 2018

rix0rrr Oct 24, 2018

leepa Oct 24, 2018

rix0rrr Oct 24, 2018

rix0rrr Oct 24, 2018

rix0rrr Oct 24, 2018

rix0rrr Oct 24, 2018 •

edited

Loading

		@@ -0,0 +1,7 @@
		export const QUEUE_GET_ACTIONS = [
		"sqs:ReceiveMessage",

feat(aws-sqs): allow direct grants from a Queue #1004

feat(aws-sqs): allow direct grants from a Queue #1004

Conversation

leepa commented Oct 24, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rix0rrr Oct 24, 2018 • edited Loading

Choose a reason for hiding this comment

rix0rrr Oct 24, 2018 •

edited

Loading