fix(codepipeline): default cross-region S3 buckets allow public access

[david-richer-adsk]

The cross region S3 buckets that are created should have block public access by default.

Fixes #16411

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[david-richer-adsk]

Same approach as for the artifact bucket: https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-codepipeline/lib/pipeline.ts#L382

[skinny85]

Thanks for the contribution @david-richer-adsk!

Pull request has been modified.

[skinny85]

We also need a unit test for this one 🙂.

[david-richer-adsk]

We also need a unit test for this one 🙂.

Does this look like the right place to add a check? https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-codepipeline/test/cross-env.test.ts#L132

[skinny85]

We also need a unit test for this one 🙂.

Does this look like the right place to add a check? https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-codepipeline/test/cross-env.test.ts#L132

Yes, that's probably a good spot. You can use the toHaveResourceLike() helper, like here.

Pull request has been modified.

[david-richer-adsk]

Should be good to go, let me know if anything is missing.

[skinny85]

Looks good @david-richer-adsk! One question.

Pull request has been modified.

[david-richer-adsk]

@skinny85 ready to be merged?

[skinny85]

Thanks for the contribution @david-richer-adsk!

[skinny85]

@skinny85 ready to be merged?

Yep! In the future, make sure to re-request my review after you're done pushing your changes (there's a button in the top-right corner of the PR page, next to my avatar), this way I won't miss it 🙂.

Thanks,
Adam

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[david-richer-adsk]

Will do!

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
• Commit ID: 463ce71
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).