feat(iot): device certificate age check audit configuration #33816

badmintoncryer · 2025-03-18T14:23:15Z

Issue # (if applicable)

None

Reason for this change

AWS IoT now supports for new audit configuration about device certificate age check.
https://docs.aws.amazon.com/iot-device-defender/latest/devguide/device-certificate-age-check.html

Description of changes

Add deviceCertificateAgeCheck to CheckConfiguration
- To enable audit configuraiton
Add deviceCertificateAgeCheckDuration to CheckConfiguration
- To configure threshold duration in days

Describe any new or updated permissions being added

None

Description of how you validated changes

Add both unit and integ tests

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

BREAKING CHANGE: By default, deviceDertificateAgeCheck is automatically enabled.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

codecov · 2025-03-18T14:35:20Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 84.00%. Comparing base (74cbe27) to head (1932e46).
Report is 34 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #33816      +/-   ##
==========================================
+ Coverage   83.98%   84.00%   +0.01%     
==========================================
  Files         120      121       +1     
  Lines        6976     6984       +8     
  Branches     1178     1179       +1     
==========================================
+ Hits         5859     5867       +8     
  Misses       1005     1005              
  Partials      112      112

Flag	Coverage Δ
suite.unit	`84.00% <ø> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`84.00% <ø> (+0.01%)`	⬆️

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

mazyu36

LGTM.
Just to be sure, I have one question.

mazyu36 · 2025-04-15T15:29:57Z

packages/@aws-cdk/aws-iot-alpha/lib/audit-configuration.ts

+   * The duration used to check if a device certificate has been active
+   * for a number of days greater than or equal to the number you specify.
+   *
+   * Valid values are between 30 and 3652 days.


CFn docs say the min is 1 and the max is 64. Just to confirm — this is clearly a mistake in the docs, right?

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iot-accountauditconfiguration-certagecheckcustomconfiguration.html#aws-properties-iot-accountauditconfiguration-certagecheckcustomconfiguration-properties

@mazyu36
Thank you for pointing this out!
At the time of creation, the CloudFormation specification was supposed to be 30-3652 days. It seems the specifications have changed...

I will test what settings are actually possible and make various adjustments accordingly.

@mazyu36

The official documentation states that the valid range is 30 to 3652 days, which matches what is shown in the management console.

Therefore, I think the cfn document may be wrong.

I created a new issue in the cloudformation roadmap.

mazyu36

Thanks!

paulhcsun

Just a couple of description changes, otherwise LGTM! Thanks @badmintoncryer for the contribution and @mazyu36 for the review!

packages/@aws-cdk/aws-iot-alpha/README.md

packages/@aws-cdk/aws-iot-alpha/lib/audit-configuration.ts

paulhcsun

@Mergifyio update

Pull request has been modified.

paulhcsun

@Mergifyio update

paulhcsun · 2025-05-06T18:00:08Z

@Mergifyio update

mergify · 2025-05-06T18:00:15Z

update

✅ Branch has been successfully updated

mergify · 2025-05-06T18:31:30Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-05-06T19:04:08Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: c31d5c0
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-05-06T19:04:28Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-05-06T19:04:45Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

badmintoncryer added 2 commits March 18, 2025 23:06

update integ

e4f1db0

update unit test

b5f8fe5

github-actions bot added the p2 label Mar 18, 2025

aws-cdk-automation requested a review from a team March 18, 2025 14:23

github-actions bot added the distinguished-contributor [Pilot] contributed 50+ PRs to the CDK label Mar 18, 2025

aws-cdk-automation previously requested changes Mar 18, 2025

View reviewed changes

update readme

bd34d1d

aws-cdk-automation previously requested changes Mar 18, 2025

View reviewed changes

update readme

78216c7

Merge branch 'main' into iot

1eeb527

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 19, 2025

badmintoncryer added 3 commits March 20, 2025 07:55

Merge branch 'main' into iot

e426f1b

Merge branch 'main' into iot

a025415

Merge branch 'main' into iot

9a35c47

github-actions bot mentioned this pull request Apr 1, 2025

Monthly PR metrics report #33994

Closed

badmintoncryer added 3 commits April 5, 2025 23:51

Merge branch 'main' into iot

c83d981

Merge branch 'main' into iot

242c47d

Merge branch 'main' into iot

1932e46

mazyu36 reviewed Apr 15, 2025

View reviewed changes

badmintoncryer added 2 commits April 16, 2025 09:07

Merge branch 'main' into iot

04ad544

Merge branch 'main' into iot

12a8b41

mazyu36 approved these changes Apr 16, 2025

View reviewed changes

aws-cdk-automation added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Apr 16, 2025

Merge branch 'main' into iot

4d850ba

paulhcsun self-assigned this May 2, 2025

paulhcsun reviewed May 6, 2025

View reviewed changes

packages/@aws-cdk/aws-iot-alpha/README.md Outdated Show resolved Hide resolved

packages/@aws-cdk/aws-iot-alpha/lib/audit-configuration.ts Outdated Show resolved Hide resolved

Update packages/@aws-cdk/aws-iot-alpha/README.md

cdea97c

paulhcsun previously approved these changes May 6, 2025

View reviewed changes

Update packages/@aws-cdk/aws-iot-alpha/lib/audit-configuration.ts

0a57656

paulhcsun approved these changes May 6, 2025

View reviewed changes

Merge branch 'main' into iot

05f0e6e

Merge branch 'main' into iot

c31d5c0

mergify bot merged commit 9ad383d into aws:main May 6, 2025
14 of 15 checks passed

github-actions bot locked as resolved and limited conversation to collaborators May 6, 2025

badmintoncryer deleted the iot branch May 6, 2025 22:57

Uh oh!

feat(iot): device certificate age check audit configuration #33816

feat(iot): device certificate age check audit configuration #33816

Uh oh!

Conversation

badmintoncryer commented Mar 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Mar 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mazyu36 left a comment

Choose a reason for hiding this comment

Uh oh!

mazyu36 Apr 15, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Apr 16, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Apr 16, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Apr 16, 2025

Choose a reason for hiding this comment

Uh oh!

mazyu36 left a comment

Choose a reason for hiding this comment

Uh oh!

paulhcsun left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

paulhcsun left a comment

Choose a reason for hiding this comment

Uh oh!

paulhcsun left a comment

Choose a reason for hiding this comment

Uh oh!

paulhcsun commented May 6, 2025

Uh oh!

mergify bot commented May 6, 2025

✅ Branch has been successfully updated

Uh oh!

mergify bot commented May 6, 2025

Uh oh!

aws-cdk-automation commented May 6, 2025

AWS CodeBuild CI Report

Uh oh!

mergify bot commented May 6, 2025

Uh oh!

Uh oh!

github-actions bot commented May 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

badmintoncryer commented Mar 18, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Mar 18, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading