refactor(GuLogShippingPolicy)!: make GuLogShippingPolicy a singleton

src/constructs/core/parameters/log-shipping.ts

@@ -0,0 +1,27 @@
+import type { GuStack } from "../stack";
+import { GuStringParameter } from "./base";
+
+export class GuLoggingStreamNameParameter extends GuStringParameter {
+  private static instance: GuStringParameter | undefined;
+
+  // eslint-disable-next-line custom-rules/valid-constructors -- TODO be better
+  private constructor(scope: GuStack) {
+    super(scope, "LoggingStreamName", {
+      description: "SSM parameter containing the Name (not ARN) on the kinesis stream",
+      default: "/account/services/logging.stream.name",
+      fromSSM: true,
+    });
+  }
+
+  public static getInstance(stack: GuStack): GuLoggingStreamNameParameter {
+    // Resources can only live in the same App so return a new `GuSSMRunCommandPolicy` where necessary.
+    // See https://github.com/aws/aws-cdk/blob/0ea4b19afd639541e5f1d7c1783032ee480c307e/packages/%40aws-cdk/core/lib/private/refs.ts#L47-L50
+    const isSameStack = this.instance?.node.root === stack.node.root;
+
+    if (!this.instance || !isSameStack) {
+      this.instance = new GuLoggingStreamNameParameter(stack);
+    }
+
+    return this.instance;
+  }
+}

src/constructs/iam/policies/log-shipping.test.ts

@@ -1,59 +1,25 @@
 import "@aws-cdk/assert/jest";
+import { SynthUtils } from "@aws-cdk/assert";
+import type { SynthedStack } from "../../../../test/utils";
 import { attachPolicyToTestRole, simpleGuStackForTesting } from "../../../../test/utils";
 import { GuLogShippingPolicy } from "./log-shipping";
 
 describe("The GuLogShippingPolicy class", () => {
-  it("sets default props", () => {
+  it("creates a policy restricted to a kinesis stream defined in a parameter", () => {
     const stack = simpleGuStackForTesting();
 
     const logShippingPolicy = new GuLogShippingPolicy(stack);
-
     attachPolicyToTestRole(stack, logShippingPolicy);
 
-    expect(stack).toHaveResource("AWS::IAM::Policy", {
-      PolicyName: "GuLogShippingPolicy981BFE5A",
-      PolicyDocument: {
-        Version: "2012-10-17",
-        Statement: [
-          {
-            Action: ["kinesis:Describe*", "kinesis:Put*"],
-            Effect: "Allow",
-            Resource: {
-              "Fn::Join": [
-                "",
-                [
-                  "arn:aws:kinesis:",
-                  {
-                    Ref: "AWS::Region",
-                  },
-                  ":",
-                  {
-                    Ref: "AWS::AccountId",
-                  },
-                  ":stream/",
-                  {
-                    Ref: "LoggingStreamName",
-                  },
-                ],
-              ],
-            },
-          },
-        ],
-      },
+    const json = SynthUtils.toCloudFormation(stack) as SynthedStack;
+    expect(json.Parameters.LoggingStreamName).toEqual({
+      Type: "AWS::SSM::Parameter::Value<String>",
+      Default: "/account/services/logging.stream.name",
+      Description: "SSM parameter containing the Name (not ARN) on the kinesis stream",
     });
-  });
-
-  it("merges defaults and passed in props", () => {
-    const stack = simpleGuStackForTesting();
-
-    const logShippingPolicy = new GuLogShippingPolicy(stack, "LogShippingPolicy", {
-      policyName: "test",
-    });
-
-    attachPolicyToTestRole(stack, logShippingPolicy);
 
     expect(stack).toHaveResource("AWS::IAM::Policy", {
-      PolicyName: "test",
+      PolicyName: "GuLogShippingPolicy981BFE5A",
       PolicyDocument: {
         Version: "2012-10-17",
         Statement: [

src/constructs/iam/policies/log-shipping.ts

@@ -1,25 +1,17 @@
-import { Effect, PolicyStatement } from "@aws-cdk/aws-iam";
 import type { GuStack } from "../../core";
-import { GuStringParameter } from "../../core";
-import type { GuPolicyProps } from "./base-policy";
-import { GuPolicy } from "./base-policy";
+import { GuLoggingStreamNameParameter } from "../../core/parameters/log-shipping";
+import { GuAllowPolicy } from "./base-policy";
 
-export class GuLogShippingPolicy extends GuPolicy {
-  constructor(scope: GuStack, id: string = "GuLogShippingPolicy", props?: GuPolicyProps) {
-    super(scope, id, { ...props });
-
-    const loggingStreamNameParam = new GuStringParameter(scope, "LoggingStreamName", {
-      description: "SSM parameter containing the Name (not ARN) on the kinesis stream",
-      default: "/account/services/logging.stream.name",
-      fromSSM: true,
+export class GuLogShippingPolicy extends GuAllowPolicy {
+  // eslint-disable-next-line custom-rules/valid-constructors -- TODO be better
+  constructor(scope: GuStack) {
+    super(scope, "GuLogShippingPolicy", {
+      actions: ["kinesis:Describe*", "kinesis:Put*"],
+      resources: [
+        `arn:aws:kinesis:${scope.region}:${scope.account}:stream/${
+          GuLoggingStreamNameParameter.getInstance(scope).valueAsString
+        }`,
+      ],
     });
-
-    this.addStatements(
-      new PolicyStatement({
-        effect: Effect.ALLOW,
-        actions: ["kinesis:Describe*", "kinesis:Put*"],
-        resources: [`arn:aws:kinesis:${scope.region}:${scope.account}:stream/${loggingStreamNameParam.valueAsString}`],
-      })
-    );
   }
 }