Skip to content

Commit 31808b4

Browse files
fix(stepfunctions-tasks): fix the generated IAM policy for EFS operations (#30896)
### Issue # (if applicable) Closes #30862. ### Reason for this change Per [TagResource](https://docs.aws.amazon.com/efs/latest/ug/API_TagResource.html), the operation requires permissions for the `elasticfilesystem:TagResource` action. Also per [AWS managed policies for Amazon EFS](https://docs.aws.amazon.com/efs/latest/ug/security-iam-awsmanpol.html), all the `Action`(s) are prefixed with `elasticfilesystem:` (not `efs`). ### Description of changes Updates the `iamServiceMap` that maintains list of services having mapping to IAM policy prefix names. ### Description of how you validated changes Added unit test and integration test (along with snapshot). ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 0e0cbfa commit 31808b4

File tree

11 files changed

+619
-0
lines changed

11 files changed

+619
-0
lines changed

Diff for: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/aws-sdk/integ.call-aws-service-efs.js.snapshot/IntegTestDefaultTestDeployAssertE3E7D2A4.assets.json

+19
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/aws-sdk/integ.call-aws-service-efs.js.snapshot/IntegTestDefaultTestDeployAssertE3E7D2A4.template.json

+36
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/aws-sdk/integ.call-aws-service-efs.js.snapshot/aws-stepfunctions-tasks-call-aws-service-efs-integ.assets.json

+19
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
{
2+
"Resources": {
3+
"StateMachineRoleB840431D": {
4+
"Type": "AWS::IAM::Role",
5+
"Properties": {
6+
"AssumeRolePolicyDocument": {
7+
"Statement": [
8+
{
9+
"Action": "sts:AssumeRole",
10+
"Effect": "Allow",
11+
"Principal": {
12+
"Service": "states.amazonaws.com"
13+
}
14+
}
15+
],
16+
"Version": "2012-10-17"
17+
}
18+
}
19+
},
20+
"StateMachineRoleDefaultPolicyDF1E6607": {
21+
"Type": "AWS::IAM::Policy",
22+
"Properties": {
23+
"PolicyDocument": {
24+
"Statement": [
25+
{
26+
"Action": "elasticfilesystem:tagResource",
27+
"Effect": "Allow",
28+
"Resource": "*"
29+
}
30+
],
31+
"Version": "2012-10-17"
32+
},
33+
"PolicyName": "StateMachineRoleDefaultPolicyDF1E6607",
34+
"Roles": [
35+
{
36+
"Ref": "StateMachineRoleB840431D"
37+
}
38+
]
39+
}
40+
},
41+
"StateMachine2E01A3A5": {
42+
"Type": "AWS::StepFunctions::StateMachine",
43+
"Properties": {
44+
"DefinitionString": {
45+
"Fn::Join": [
46+
"",
47+
[
48+
"{\"StartAt\":\"TagEfsAccessPoint\",\"States\":{\"TagEfsAccessPoint\":{\"End\":true,\"Type\":\"Task\",\"ResultPath\":null,\"Resource\":\"arn:",
49+
{
50+
"Ref": "AWS::Partition"
51+
},
52+
":states:::aws-sdk:efs:tagResource\",\"Parameters\":{\"ResourceId.$\":\"$.pathToArn\",\"Tags\":[{\"Key\":\"MYTAGNAME\",\"Value.$\":\"$.pathToId\"}]}}}}"
53+
]
54+
]
55+
},
56+
"RoleArn": {
57+
"Fn::GetAtt": [
58+
"StateMachineRoleB840431D",
59+
"Arn"
60+
]
61+
}
62+
},
63+
"DependsOn": [
64+
"StateMachineRoleDefaultPolicyDF1E6607",
65+
"StateMachineRoleB840431D"
66+
],
67+
"UpdateReplacePolicy": "Delete",
68+
"DeletionPolicy": "Delete"
69+
}
70+
},
71+
"Parameters": {
72+
"BootstrapVersion": {
73+
"Type": "AWS::SSM::Parameter::Value<String>",
74+
"Default": "/cdk-bootstrap/hnb659fds/version",
75+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
76+
}
77+
},
78+
"Rules": {
79+
"CheckBootstrapVersion": {
80+
"Assertions": [
81+
{
82+
"Assert": {
83+
"Fn::Not": [
84+
{
85+
"Fn::Contains": [
86+
[
87+
"1",
88+
"2",
89+
"3",
90+
"4",
91+
"5"
92+
],
93+
{
94+
"Ref": "BootstrapVersion"
95+
}
96+
]
97+
}
98+
]
99+
},
100+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
101+
}
102+
]
103+
}
104+
}
105+
}

Diff for: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/aws-sdk/integ.call-aws-service-efs.js.snapshot/cdk.out

+1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/aws-sdk/integ.call-aws-service-efs.js.snapshot/integ.json

+12
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/aws-sdk/integ.call-aws-service-efs.js.snapshot/manifest.json

+125
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)