(@aws-cdk/aws-sns-subscriptions): add support for firehose endpoint

[Yatisha]

SNS has launched support for kinesis subscriptions - https://aws.amazon.com/about-aws/whats-new/2021/01/amazon-sns-adds-support-for-message-archiving-and-analytics-via-kineses-data-firehose-subscriptions/

However subscriptions module doesn't support firehose endpoints yet for addSubscriptions method.
CDK guide: https://docs.aws.amazon.com/cdk/api/latest/docs/aws-sns-subscriptions-readme.html

Use Case

To create subscriptions to fire-hose using L2 constructs

Proposed Solution

Work-around is to insert CFN directly into CDK using CfnResource module

Other

• 👋 I may be able to implement this feature request

• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[yannbr]

Hi, is it planned to add the Kinesis subscription method to an SNS topic soon?

This is a feature that I would definitely use.

Thank you!

[jumic]

As long as Kinesis Firehose is an experimental CDK module, this feature cannot be implemented. Stable modules (e.g. SNS subscription) cannot depend on experimental modules.

[eugeneh101]

Hello CDKers! Should this feature request be updated?

I am still not able to create a SNS subscription for Firehouse endpoint using the add_subscriptions() method.
BUT I was able to get around that (ie successfully creating a SNS subscription for Firehose endpoint) by using the sns.Subscription class. I followed the code snippet from https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_sns/Subscription.html.

In case the page changes, here's what it looked like for me:

Here's my actual code:

sns.Subscription(
    self,
    "FirehoseSubscription",
    topic=SNS_TOPIC_INSTANCE,  # put your SNS topic here
    raw_message_delivery=True,
    endpoint=FIREHOSE_CFNDELIVERYSTREAM_INSTANCE.attr_arn,  # put your Firehose instance (of `firehose.CfnDeliveryStream` class) here
    protocol=sns.SubscriptionProtocol.FIREHOSE,
    subscription_role_arn=IAM_ROLE_FOR_SNS.role_arn,  # put your IAM role here
)

My IAM_ROLE_FOR_SNS is defined as:

iam.Role(
    self,
    "SnsRoleToPutMessagesInFirehose",
    assumed_by=iam.ServicePrincipal("sns.amazonaws.com"),
    managed_policies=[
        iam.ManagedPolicy.from_aws_managed_policy_name(
            "service-role/AmazonSNSRole"
        ),
    ],
    inline_policies={
        "WriteToFirehose": iam.PolicyDocument(
            statements=[
                iam.PolicyStatement(
                    actions=[
                        "firehose:DescribeDeliveryStream",
                        "firehose:ListDeliveryStreams",
                        "firehose:ListTagsForDeliveryStream",
                        "firehose:PutRecord",
                        "firehose:PutRecordBatch",
                    ],
                    resources=[
                        "arn:aws:firehose:{}:{}:deliverystream/*".format(
                            environment["AWS_REGION"],  # whatever AWS region your are in
                            environment["AWS_ACCOUNT"],  # whatever AWS account you are using
                        ),
                    ],
                ),
            ],
        ),
    },
)

Hope that helps! If you have any questions, feel free to ask. I hope to look at this Github Issue once in awhile.

[MrArnoldPalmer]

Hey @eugeneh101 I think we can keep this open for just updating the addSubscription method to add firehose endpoint support just for convenience.

[eugeneh101]

@MrArnoldPalmer Sounds good, makes sense. Thank you.

Just to clarify, @jumic stated above on Jan 25, 2022 that "Kinesis Firehose is an experimental CDK module". Is that still accurate? Is he referring to aws_cdk.aws_kinesisfirehose (the module with L1 constructs) or aws_cdk.aws_kinesisfirehose_alpha (the module with the experimental L2 constructs)? I guess a different way to phrase it is, does SNS subscription via addSubscriptions() method only support stable L2 constructs or could it also support L1 constructs? This question is just out of curiosity for my mental map of what CDK tries to support.

[MrArnoldPalmer]

@eugeneh so when we say experimental we are referring to the L2 constructs in @aws-cdk/aws-kinesisfirehose-alpha. Since aws-cdk-lib and sns-subscriptions are stable, we won't include APIs within those modules that will change.

In this case addSubscription accepts an interface ITopicSubscription which decouples the APIs. As long as the kinesisfirehose construct implements that interface there is no coupling to the constructs that may change.