Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: support for IAM Identity Center in security diff #30009

Merged
merged 11 commits into from
May 2, 2024
Merged

Conversation

bergjaak
Copy link
Contributor

@bergjaak bergjaak commented Apr 30, 2024

Issue # (if applicable)

Closes #29835

Reason for this change

IAM Identity Center resources were ignored in the security diff

Description of changes

  • Adds the IAM Identity Center resources to CDK diff
  • fixes not presenting property changes when a resource is removed from the template

Description of how you validated changes

  • Added unit tests and integration tests.
  • Ran the integration tests that mention cdk diff (bin/run-suite -a cli-integ-tests -t 'cdk diff'):
Test Suites: 2 skipped, 1 passed, 1 of 3 total
Tests:       90 skipped, 13 passed, 103 total
Snapshots:   0 total
Time:        312.397 s
Ran all test suites with tests matching "cdk diff": 

Dependent PRs

Checklist


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@github-actions github-actions bot added the p1 label Apr 30, 2024
@aws-cdk-automation aws-cdk-automation requested a review from a team April 30, 2024 01:27
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Apr 30, 2024
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@bergjaak
Copy link
Contributor Author

bergjaak commented Apr 30, 2024

Exemption Request:

We are cli integ testing this change which would not generate a snapshot.

github-merge-queue bot pushed a commit to cdklabs/awscdk-service-spec that referenced this pull request Apr 30, 2024
For issue aws/aws-cdk#29835

This is the first of 2 PRs. The other PR will be to the main aws-cdk
repository.

Notice that AWS::SSO::PermissionSet has a property called
`ManagedPolicies`. That's why I add that property check. And judging by
the db.json that we create in this package (the service spec),
AWS::SSO::PermissionSet is the only resource with that property name:

```
(18:36:39) bergjak@bcd074b101ed ~/workplace/CDK/awscdk-service-spec AwsSsoFix ✔
 ➜ cat ~/db.json4 | jq '.schema.resource.entities.[]' | jq '.properties' | grep ManagedPolicies
    "scrutinizable": "ManagedPolicies"
    "scrutinizable": "ManagedPolicies"
    "scrutinizable": "ManagedPolicies"
    "scrutinizable": "ManagedPolicies"
    "scrutinizable": "CustomerManagedPolicies"
  "ManagedPolicies": {
    "scrutinizable": "ManagedPolicies"
```

AWS::SSO is the IAM Identity Center, and therefore changes to AWS SSO
resources are security sensitive. Hence the issue.

### Testing
As you'll see in the next pull request, I have integration tests for
this change
* Here is the PR with all the testing
aws/aws-cdk#30009
Copy link
Contributor

@comcalvi comcalvi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing but minor comments, this looks really good! Nice work.

…ter.ts

Co-authored-by: Calvin Combs <66279577+comcalvi@users.noreply.github.com>
@bergjaak bergjaak added pr-linter/exempt-readme The PR linter will not require README changes pr-linter/exempt-integ-test The PR linter will not require integ test changes labels May 1, 2024
@aws-cdk-automation aws-cdk-automation dismissed their stale review May 1, 2024 14:01

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 9db78cf
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

Copy link
Contributor

mergify bot commented May 2, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot merged commit 0a3cb94 into main May 2, 2024
13 checks passed
@mergify mergify bot deleted the AwsSsoFix branch May 2, 2024 14:51
@aws-cdk-automation
Copy link
Collaborator

➡️ PR build request submitted to test-main-pipeline ⬅️

A maintainer must now check the pipeline and add the pr-linter/cli-integ-tested label once the pipeline succeeds.

@bergjaak bergjaak added the pr-linter/cli-integ-tested Assert that any CLI changes have been integ tested label May 2, 2024
@aws-cdk-automation
Copy link
Collaborator

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.

@aws aws locked as resolved and limited conversation to collaborators Jul 25, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
contribution/core This is a PR that came from AWS. p1 pr-linter/cli-integ-tested Assert that any CLI changes have been integ tested pr-linter/exempt-integ-test The PR linter will not require integ test changes pr-linter/exempt-readme The PR linter will not require README changes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CDK Diff and Deploy do not include AWS::SSO::Assignment in security related changes
3 participants