fix(ssm): malformed ARNs for parameters with physical names that use path notation #4842
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| import { CfnCondition, Construct, Fn, IConstruct, Stack, Token } from "@aws-cdk/core"; | ||
|
|
||
| /** | ||
| * Renders an ARN for an SSM parameter given a parameter name. | ||
| * @param scope definition scope | ||
| * @param parameterName the parameter name to include in the ARN | ||
| * @param physicalName optional physical name specified by the user (to auto-detect separator) | ||
| */ | ||
| export function arnForParameterName(scope: IConstruct, parameterName: string, physicalName?: string): string { | ||
| const { sep, resourceName } = determineSepAndResourceName(); | ||
|
|
||
| validateParameterName(physicalName || parameterName); | ||
|
|
||
| return Stack.of(scope).formatArn({ | ||
| service: 'ssm', | ||
| resource: 'parameter', | ||
| sep, | ||
| resourceName, | ||
| }); | ||
|
|
||
| function validateParameterName(concreteName: string) { | ||
| // can't validate tokens | ||
| if (Token.isUnresolved(concreteName)) { | ||
| return; | ||
| } | ||
|
|
||
| if (concreteName.includes('/') && !concreteName.startsWith('/')) { | ||
| throw new Error(`Parameter names must be fully qualified (if they include "/" they must also begin with a "/"): ${concreteName}`); | ||
| } | ||
| } | ||
|
|
||
| function determineSepAndResourceName() { | ||
| // if the parameter name is a token | ||
| if (Token.isUnresolved(parameterName)) { | ||
|
|
||
| // if we have a concrete physical name, we can use it to determine the separator | ||
| if (physicalName && !Token.isUnresolved(physicalName)) { | ||
| return { | ||
| sep: physicalName.startsWith('/') ? '' : '/', | ||
| resourceName: parameterName | ||
| }; | ||
| } | ||
|
|
||
| // parameterName is a token and physical name is not helping us (either missing or a token itself) | ||
| // in this use case we will need to synthesize a CloudFormation condition that will be used to determine | ||
| // if the name has a "/" prefix or not. | ||
| const startsWithSlash = startsWithCondition(scope as Construct, parameterName, "/"); | ||
|
Contributor
There was a problem hiding this comment. Oh shit. After thinking about it some more, I'm not sure this is going to work. At least, this won't work for
Contributor
Author
There was a problem hiding this comment. Yes, you are right: |
||
| return { | ||
| sep: '', | ||
| resourceName: Token.asString(Fn.conditionIf(startsWithSlash.logicalId, parameterName, `/${parameterName}`)) | ||
| }; | ||
| } | ||
|
|
||
| // parameterName is concrete, use it to determine the token | ||
| return { | ||
| sep: parameterName.startsWith('/') ? '' : '/', | ||
| resourceName: parameterName | ||
| }; | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Gets or creates a CloudFormation condition that evaluates to "TRUE" if `parameterName` (treated as an opaque token) | ||
| * starts with a "/". | ||
| */ | ||
| function startsWithCondition(scope: Construct, value: string, startsWith: string) { | ||
| const id = `AWS::CDK::StartsWith(${startsWith})`; | ||
| return scope.node.tryFindChild(id) as CfnCondition || new CfnCondition(scope, id, { | ||
| expression: Fn.conditionEquals(Fn.select(0, Fn.split(startsWith, value)), "") | ||
| }); | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,202 @@ | ||
| { | ||
| "Resources": { | ||
| "StringAutogenE7E896E4": { | ||
| "Type": "AWS::SSM::Parameter", | ||
| "Properties": { | ||
| "Type": "String", | ||
| "Value": "hello, world" | ||
| } | ||
| }, | ||
| "StringSimpleA681514D": { | ||
| "Type": "AWS::SSM::Parameter", | ||
| "Properties": { | ||
| "Type": "String", | ||
| "Value": "hello, world", | ||
| "Name": "simple-name" | ||
| } | ||
| }, | ||
| "StringPathD8120137": { | ||
| "Type": "AWS::SSM::Parameter", | ||
| "Properties": { | ||
| "Type": "String", | ||
| "Value": "hello, world", | ||
| "Name": "/path/name/foo/bar" | ||
| } | ||
| }, | ||
| "ListAutogenC5DA1CAE": { | ||
| "Type": "AWS::SSM::Parameter", | ||
| "Properties": { | ||
| "Type": "StringList", | ||
| "Value": "hello,world" | ||
| } | ||
| }, | ||
| "ListSimple9DB641CB": { | ||
| "Type": "AWS::SSM::Parameter", | ||
| "Properties": { | ||
| "Type": "StringList", | ||
| "Value": "hello,world", | ||
| "Name": "list-simple-name" | ||
| } | ||
| }, | ||
| "ListPath120D6FAB": { | ||
| "Type": "AWS::SSM::Parameter", | ||
| "Properties": { | ||
| "Type": "StringList", | ||
| "Value": "hello,world", | ||
| "Name": "/list/path/name" | ||
| } | ||
| } | ||
| }, | ||
| "Outputs": { | ||
| "StringAutogenArn": { | ||
| "Value": { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "arn:", | ||
| { | ||
| "Ref": "AWS::Partition" | ||
| }, | ||
| ":ssm:", | ||
| { | ||
| "Ref": "AWS::Region" | ||
| }, | ||
| ":", | ||
| { | ||
| "Ref": "AWS::AccountId" | ||
| }, | ||
| ":parameter/", | ||
| { | ||
| "Ref": "StringAutogenE7E896E4" | ||
| } | ||
| ] | ||
| ] | ||
| } | ||
| }, | ||
| "StringSimpleArn": { | ||
| "Value": { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "arn:", | ||
| { | ||
| "Ref": "AWS::Partition" | ||
| }, | ||
| ":ssm:", | ||
| { | ||
| "Ref": "AWS::Region" | ||
| }, | ||
| ":", | ||
| { | ||
| "Ref": "AWS::AccountId" | ||
| }, | ||
| ":parameter/", | ||
| { | ||
| "Ref": "StringSimpleA681514D" | ||
| } | ||
| ] | ||
| ] | ||
| } | ||
| }, | ||
| "StringPathArn": { | ||
| "Value": { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "arn:", | ||
| { | ||
| "Ref": "AWS::Partition" | ||
| }, | ||
| ":ssm:", | ||
| { | ||
| "Ref": "AWS::Region" | ||
| }, | ||
| ":", | ||
| { | ||
| "Ref": "AWS::AccountId" | ||
| }, | ||
| ":parameter", | ||
| { | ||
| "Ref": "StringPathD8120137" | ||
| } | ||
| ] | ||
| ] | ||
| } | ||
| }, | ||
| "ListAutogenArn": { | ||
| "Value": { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "arn:", | ||
| { | ||
| "Ref": "AWS::Partition" | ||
| }, | ||
| ":ssm:", | ||
| { | ||
| "Ref": "AWS::Region" | ||
| }, | ||
| ":", | ||
| { | ||
| "Ref": "AWS::AccountId" | ||
| }, | ||
| ":parameter/", | ||
| { | ||
| "Ref": "ListAutogenC5DA1CAE" | ||
| } | ||
| ] | ||
| ] | ||
| } | ||
| }, | ||
| "ListSimpleArn": { | ||
| "Value": { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "arn:", | ||
| { | ||
| "Ref": "AWS::Partition" | ||
| }, | ||
| ":ssm:", | ||
| { | ||
| "Ref": "AWS::Region" | ||
| }, | ||
| ":", | ||
| { | ||
| "Ref": "AWS::AccountId" | ||
| }, | ||
| ":parameter/", | ||
| { | ||
| "Ref": "ListSimple9DB641CB" | ||
| } | ||
| ] | ||
| ] | ||
| } | ||
| }, | ||
| "ListPathArn": { | ||
| "Value": { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "arn:", | ||
| { | ||
| "Ref": "AWS::Partition" | ||
| }, | ||
| ":ssm:", | ||
| { | ||
| "Ref": "AWS::Region" | ||
| }, | ||
| ":", | ||
| { | ||
| "Ref": "AWS::AccountId" | ||
| }, | ||
| ":parameter", | ||
| { | ||
| "Ref": "ListPath120D6FAB" | ||
| } | ||
| ] | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.