feat(rds): support configuring secret rotation behavior via rotateImmediatelyOnUpdate prop #26329
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…monRotationUserOptions interfaces Signed-off-by: Francis <colifran@amazon.com>
…ser rotations Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
… false Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
|
|
github-actions
bot
added
effort/medium
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
aws-cdk-automation
added
the
pr/needs-community-review
…ssets: false` (#26321) The motivation here is that I went to add this option and realized that it already existed. However, setting the property to `false` wasn't tested or documented. This PR does both of those things. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Replaces the existing `cfn2ts` code generator with the new `spec2cdk` generator based on `@cdklabs/typewriter` and the separately published service spec database `@aws-cdk/aws-service-spec`. Other neccesary changes are: - Lowered coverage threshold for branches to 35% since the newly generated code is more expressive. Arguably we should not include generated files in the coverage calculation, but that's a bigger change. - Asset hashes in `cfn-include` test changed due to props now being ordered alphabetic. I've manually verified that the templates are otherwise identical. - Removing `port` property from `neptune-alpha` as this has been removed upstream and is not functional according to the service team. - Switched `synthetics-alpha` tests to use `testDeprecated()` for anything using the `Canary`. This is due to the removal of the `deleteLambdaResourcesOnCanaryDeletion` prop in the CFN spec. The new codegen marks removed props as deprecated. We will replace this feature with a custom resource soon. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Not needed as we are no longer releasing v1 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Implemented the L2 construct for the IoT Core HTTPS action. Closes #25491 . ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Turning rosetta back on again. Was turned off in April in #26330 and never turned on again. Therefore we have a significant diff of uncompilable examples. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Previously (accidentally) used the module name as a name for the import. This caused the build to fail with `error TS5055: Cannot write file 'aws-cdk-lib/aws-cloudwatch/index.d.ts' because it would overwrite input file.` Also exclude declaration files from the build, which makes it slightly faster (~20s). ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…using EXTERNAL deployment controller (#26338) When using an external deployment controller, ECS Service creation fails because the `NetworkConfiguration` is output to the template. This fix prevents the output of `NetworkConfiguration` when using external deployment controller. Closes #26335 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
This PR fixes a document for `fingerprint` in `core` module, because the caller's comments did not modify it. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Allowing user to provide a `platform` property when bundling docker assets ([ref](https://docs.docker.com/build/building/multi-platform/)). Currently, this is not possible when using an existing Docker image via the [BundlingOptions](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.BundlingOptions.html). You can specify this when building a [DockerImageAsset](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecr_assets.DockerImageAsset.html#platform), but not when using an image as a builder: Closes #25759. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…26366) This change grants the possibility to [specify event filtering](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-msk-smak) on the `ManagedKafkaEventSource` and `SelfManagedKafkaEventSource` constructs via the `filters` property. Closes #26348. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Some tests were previously skipped. Un-skip them and put a linter rule in place that prevents this. Closes #25137 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Fix issue with esbuild bundling step using pnpm 8.4.0 and above where `{outputDir}/node_modules/.modules.yaml` does not always exist and current `rm` command fails bundling process when file is not present.
Relevant change that in [pnpm 8.4.0 release notes](https://github.com/pnpm/pnpm/releases/tag/v8.4.0):
> Do not create a node_modules folder with a .modules.yaml file if there are no dependencies inside node_modules.
Solved by following prior rejected pull request #25617 and suggestion in original issue #25612 of adding `-f` param to `rm` command to succeed even if file doesn't exist. Updated relevant unit test to expect this flag when using pnpm.
Closes #25612.
----
*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
In this [PR](#26287), we moved the custom resource handlers from the `lib` directory to `dist` - but any `dist` directory is npm ignored. This is causing failures in our pipeline when running cli integration tests: ```console Error: cannot find /tmp/cdk-integ-0u3tmsd7dnl/node_modules/aws-cdk-lib/custom-resource-handlers/dist/aws-s3/auto-delete-objects-handler/index.js -- 242 | at new CustomResourceProvider (/tmp/cdk-integ-0u3tmsd7dnl/node_modules/aws-cdk-lib/core/lib/custom-resource-provider/custom-resource-provider.js:1:3214) 243 | at Function.getOrCreateProvider (/tmp/cdk-integ-0u3tmsd7dnl/node_modules/aws-cdk-lib/core/lib/custom-resource-provider/custom-resource-provider.js:1:2660) 244 | at Bucket.enableAutoDeleteObjects (/tmp/cdk-integ-0u3tmsd7dnl/node_modules/aws-cdk-lib/aws-s3/lib/bucket.js:1:32627) 245 | at new Bucket (/tmp/cdk-integ-0u3tmsd7dnl/node_modules/aws-cdk-lib/aws-s3/lib/bucket.js:1:21317) 246 | at new BuiltinLambdaStack (/tmp/cdk-integ-0u3tmsd7dnl/app.js:379:5) 247 | at Object.<anonymous> (/tmp/cdk-integ-0u3tmsd7dnl/app.js:449:5) 248 | at Module._compile (node:internal/modules/cjs/loader:1196:14) 249 | at Object.Module._extensions..js (node:internal/modules/cjs/loader:1250:10) 250 | at Module.load (node:internal/modules/cjs/loader:1074:32) ``` ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Add Aurora PostgreSQL 15.3.0 to database cluster engine. https://docs.aws.amazon.com/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.html#AuroraPostgreSQL.Updates.20180305.1530 S3 import and s3 export features are supported. ```bash $ aws rds describe-db-engine-versions --region us-east-1 --engine aurora-postgresql --engine-version 15.3 { "DBEngineVersions": [ { "Engine": "aurora-postgresql", "EngineVersion": "15.3", "DBParameterGroupFamily": "aurora-postgresql15", "DBEngineDescription": "Aurora (PostgreSQL)", "DBEngineVersionDescription": "Aurora PostgreSQL (Compatible with PostgreSQL 15.3)", "ValidUpgradeTarget": [], "ExportableLogTypes": [ "postgresql" ], "SupportsLogExportsToCloudwatchLogs": true, "SupportsReadReplica": false, "SupportedEngineModes": [ "provisioned" ], "SupportedFeatureNames": [ "Comprehend", "Lambda", "s3Export", "s3Import", "SageMaker" ], "Status": "available", "SupportsParallelQuery": false, "SupportsGlobalDatabases": true, "MajorEngineVersion": "15", "SupportsBabelfish": true, "SupportsCertificateRotationWithoutRestart": true, "SupportedCACertificateIdentifiers": [ "rds-ca-2019", "rds-ca-ecc384-g1", "rds-ca-rsa4096-g1", "rds-ca-rsa2048-g1" ] } ] } ``` Closes #26363. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Add toString to Lambda Architecture property When throwing errors during synthesis, you can't see the architecture chosen for a lambda. Adding this toString method solves that Closes #26117 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Closes #26242 . ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Signed-off-by: Francis <colifran@amazon.com>
mrgrain
approved these changes
Jul 18, 2023
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
bmoffatt
pushed a commit
to bmoffatt/aws-cdk
that referenced
this pull request
Jul 29, 2023
…ediatelyOnUpdate prop (aws#26329) This PR supports allowing users to configure the default secret rotation behavior of AWS Secrets Manager. By default, AWS Secrets Manager will rotate the secret immediately. Setting `rotateImmediatelyOnUpdate` to `false` will force AWS Secrets Manager to wait until the next scheduled rotation window which is specified via the `automaticallyAfter` property. Closes aws#26099 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR supports allowing users to configure the default secret rotation behavior of AWS Secrets Manager. By default, AWS Secrets Manager will rotate the secret immediately. Setting
rotateImmediatelyOnUpdatetofalsewill force AWS Secrets Manager to wait until the next scheduled rotation window which is specified via theautomaticallyAfterproperty.Closes #26099
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license