Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(scheduler-targets-alpha): update inspector target to use IAssessmentTemplate instead of CfnAssessmentTemplate #33682

Merged
merged 4 commits into from
Mar 5, 2025
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
update inspector target to use IAssessmentTemplate instead of CfnAsse…
…ssmentTemplate
  • Loading branch information
gracelu0 committed Mar 4, 2025
commit 0112dc7d37240af2926be40f61f94e01e0b0970e
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
import { IScheduleTarget } from '@aws-cdk/aws-scheduler-alpha';
import { IRole, PolicyStatement } from 'aws-cdk-lib/aws-iam';
import { CfnAssessmentTemplate } from 'aws-cdk-lib/aws-inspector';
import { IAssessmentTemplate } from 'aws-cdk-lib/aws-inspector';
import { ScheduleTargetBase, ScheduleTargetBaseProps } from './target';

/**
* Use an Amazon Inspector as a target for AWS EventBridge Scheduler.
*/
export class InspectorStartAssessmentRun extends ScheduleTargetBase implements IScheduleTarget {
constructor(
template: CfnAssessmentTemplate,
template: IAssessmentTemplate,
props: ScheduleTargetBaseProps = {},
) {
super(props, template.attrArn);
super(props, template.assessmentTemplateArn);
}

protected addTargetActionToRole(role: IRole): void {
Original file line number Diff line number Diff line change
@@ -2,26 +2,27 @@ import { ScheduleExpression, Schedule, Group } from '@aws-cdk/aws-scheduler-alph
import { App, Duration, Stack } from 'aws-cdk-lib';
import { Template } from 'aws-cdk-lib/assertions';
import { AccountRootPrincipal, Role } from 'aws-cdk-lib/aws-iam';
import { CfnAssessmentTarget, CfnAssessmentTemplate } from 'aws-cdk-lib/aws-inspector';
import { AssessmentTemplate, CfnAssessmentTarget, CfnAssessmentTemplate, IAssessmentTemplate } from 'aws-cdk-lib/aws-inspector';
import * as sqs from 'aws-cdk-lib/aws-sqs';
import { InspectorStartAssessmentRun } from '../lib';

describe('schedule target', () => {
let app: App;
let stack: Stack;
let template: CfnAssessmentTemplate;
let template: IAssessmentTemplate;
const expr = ScheduleExpression.at(new Date(Date.UTC(1969, 10, 20, 0, 0, 0)));
const roleId = 'SchedulerRoleForTarget78b2d848BF7444';

beforeEach(() => {
app = new App({ context: { '@aws-cdk/aws-iam:minimizePolicies': true } });
stack = new Stack(app, 'Stack', { env: { region: 'us-east-1', account: '123456789012' } });
const assessmentTarget = new CfnAssessmentTarget(stack, 'MyAssessmentTarget');
template = new CfnAssessmentTemplate(stack, 'MyTemplate', {
const cfnAssessmentTemplate = new CfnAssessmentTemplate(stack, 'MyTemplate', {
assessmentTargetArn: assessmentTarget.attrArn,
durationInSeconds: 3600,
rulesPackageArns: ['arn:aws:inspector:us-east-1:316112463485:rulespackage/0-gEjTy7T7'],
});
template = AssessmentTemplate.fromCfnAssessmentTemplate(stack, 'AssessmentTemplate', cfnAssessmentTemplate);
});

test('creates IAM role and IAM policy for inspector assessment template in the same account', () => {
@@ -278,11 +279,12 @@ describe('schedule target', () => {
},
});
const assessmentTarget = new CfnAssessmentTarget(stack2, 'AnotherTarget');
const anotherTemplate = new CfnAssessmentTemplate(stack2, 'AnotherTemplate', {
const cfnAssessmentTemplate = new CfnAssessmentTemplate(stack2, 'AnotherTemplate', {
assessmentTargetArn: assessmentTarget.attrArn,
durationInSeconds: 3600,
rulesPackageArns: ['arn:aws:inspector:us-east-1:316112463485:rulespackage/0-gEjTy7T7'],
});
const anotherTemplate = AssessmentTemplate.fromCfnAssessmentTemplate(stack2, 'AnotherAssessmentTemplate', cfnAssessmentTemplate);

const inspectorTarget = new InspectorStartAssessmentRun(anotherTemplate);

@@ -363,11 +365,12 @@ describe('schedule target', () => {
},
});
const assessmentTarget = new CfnAssessmentTarget(stack2, 'AnotherTarget');
const anotherTemplate = new CfnAssessmentTemplate(stack2, 'AnotherTemplate', {
const cfnAssessmentTemplate = new CfnAssessmentTemplate(stack2, 'AnotherTemplate', {
assessmentTargetArn: assessmentTarget.attrArn,
durationInSeconds: 3600,
rulesPackageArns: ['arn:aws:inspector:us-east-1:316112463485:rulespackage/0-gEjTy7T7'],
});
const anotherTemplate = AssessmentTemplate.fromCfnAssessmentTemplate(stack2, 'AnotherAssessmentTemplate', cfnAssessmentTemplate);
const importedRole = Role.fromRoleArn(stack, 'ImportedRole', 'arn:aws:iam::123456789012:role/someRole');

const inspectorTarget = new InspectorStartAssessmentRun(anotherTemplate, {
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import * as scheduler from '@aws-cdk/aws-scheduler-alpha';
import { ExpectedResult, IntegTest } from '@aws-cdk/integ-tests-alpha';
import * as cdk from 'aws-cdk-lib';
import { CfnAssessmentTarget, CfnAssessmentTemplate } from 'aws-cdk-lib/aws-inspector';
import { AssessmentTemplate, CfnAssessmentTarget, CfnAssessmentTemplate } from 'aws-cdk-lib/aws-inspector';
import { InspectorStartAssessmentRun } from '../lib';

/*
@@ -17,12 +17,12 @@ const app = new cdk.App();
const stack = new cdk.Stack(app, 'aws-cdk-scheduler-targets-inspector-start-assessment-run');

const assessmentTarget = new CfnAssessmentTarget(stack, 'MyAssessmentTarget');
const assessmentTemplate = new CfnAssessmentTemplate(stack, 'MyAssessmentTemplate', {
const cfnAssessmentTemplate = new CfnAssessmentTemplate(stack, 'MyAssessmentTemplate', {
assessmentTargetArn: assessmentTarget.attrArn,
durationInSeconds: 3600,
// https://docs.aws.amazon.com/inspector/v1/userguide/inspector_rules-arns.html#us-east-1
rulesPackageArns: ['arn:aws:inspector:us-east-1:316112463485:rulespackage/0-gEjTy7T7'],
});
const assessmentTemplate = AssessmentTemplate.fromCfnAssessmentTemplate(stack, 'AssessmentTemplate', cfnAssessmentTemplate);

new scheduler.Schedule(stack, 'Schedule', {
schedule: scheduler.ScheduleExpression.rate(cdk.Duration.minutes(10)),
@@ -36,10 +36,10 @@ const integrationTest = new IntegTest(app, 'integrationtest-inspector-start-asse

// Verifies that the assessment run by the scheduler
integrationTest.assertions.awsApiCall('Inspector', 'listAssessmentRuns', {
AssessmentTemplateArns: [assessmentTemplate.attrArn],
AssessmentTemplateArns: [assessmentTemplate.assessmentTemplateArn],
}).assertAtPath(
'assessmentRunArns.0',
ExpectedResult.stringLikeRegexp(assessmentTemplate.attrArn),
ExpectedResult.stringLikeRegexp(assessmentTemplate.assessmentTemplateArn),
).waitForAssertions({
interval: cdk.Duration.seconds(30),
totalTimeout: cdk.Duration.minutes(10),