Prevent role creation for resources created with CfnResource #22862
Assignees
Comments
4 tasks
mergify bot
pushed a commit
that referenced
this issue
Nov 11, 2022
Introduces a new static method `Role.customizeRoles` which allows customization of role creation behavior. By default this will prevent all IAM roles and policies from being created (they will not be synthesized in the template) and will generate a policy report (both human and machine readable versions) in the cloud assembly (i.e. cdk.out) with information on the roles that need to be created and their associated IAM policies. If `customizeRoles.preventSynthesis=true` then this will - prevent IAM roles (AWS::IAM::Role) from being created - prevent managed policies (AWS::IAM::ManagedPolicy) from being created - prevent IAM policies (AWS::IAM::Policy) from being created - Managed policies that are created and _not_ attached to a role will not be synthesized _and_ will not be added to the report. Errors are added using `Annotations.addError` so that the app will still synthesize to the `cdk.out` directory and the policy report will be generated. The policy report can be generated _without_ preventing resource synthesis by setting `customizeRoles.preventSynthesis=false`. I added an integration test `aws-lambda/test/integ.lambda-customize-roles.ts` that will only synthesize the snapshot. You can view the generated reports in the snapshot. refactored: - Moved the `Import` class that was created under the `fromRoleArn` to a separate private class (imported-role.ts). The implementation is the same (just moved). This also adds support for the role created as part of custom resources in `core`. closes #22749, closes #22862 ---- ### All Submissions: * [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Follow up to #22749.
There are some IAM resources that are created using the
CfnResourceL0 which we need to also prevent creation of.The text was updated successfully, but these errors were encountered: