Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(aws-iam): fixes #2041 sensitive module, support required to replace current cfn template construction #2058

Closed
wants to merge 1 commit into from
Closed

fix(aws-iam): fixes #2041 sensitive module, support required to replace current cfn template construction #2058

wants to merge 1 commit into from

Conversation

reillykw
Copy link
Contributor

@reillykw reillykw commented Mar 20, 2019

Support added to PolicyDocument assume role actions which is needed for policy documents that require more than one action


Pull Request Checklist

  • Testing
    • Unit test added (prefer not to modify an existing test, otherwise, it's probably a breaking change)
    • CLI change?: coordinate update of integration tests with team
    • cdk-init template change?: coordinated update of integration tests with team
  • Docs
    • jsdocs: All public APIs documented
    • README: README and/or documentation topic updated
  • Title and Description
    • Change type: title prefixed with fix, feat will appear in changelog
    • Title: use lower-case and doesn't end with a period
    • Breaking?: last paragraph: "BREAKING CHANGE: <describe what changed + link for details>"
    • Issues: Indicate issues fixed via: "Fixes #xxx" or "Closes #xxx"
  • Sensitive Modules (requires 2 PR approvers)
    • IAM Policy Document (in @aws-cdk/aws-iam)
    • EC2 Security Groups and ACLs (in @aws-cdk/aws-ec2)
    • Grant APIs (only if not based on official documentation with a reference)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.

…cument actions which is needed for policy documents that require more than one action
@reillykw reillykw requested a review from a team as a code owner March 20, 2019 03:07
@@ -50,7 +50,7 @@ export abstract class PolicyPrincipal {
/**
* When this Principal is used in an AssumeRole policy, the action to use.
*/
public assumeRoleAction: string = 'sts:AssumeRole';
public assumeRoleAction: string | Array<string> = 'sts:AssumeRole';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't expose type unions at the L2 level, so we can't accept this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How might this be achieved otherwise? Any suggestions would be helpful.

@rix0rrr
Copy link
Contributor

rix0rrr commented Mar 20, 2019

I think instead of multiple assume role actions, making it so that CompositePrincipal can render to multiple policy statements would serve the same purpose, and be more generally useful in solving:

#1578

Are you interested in taking that on?

Copy link
Contributor

@rix0rrr rix0rrr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See notes

@rix0rrr rix0rrr self-assigned this Mar 20, 2019
@reillykw
Copy link
Contributor Author

Yeah I could give it a shot.

@eladb
Copy link
Contributor

eladb commented Apr 2, 2019

@reillykw any updates on this?

@rix0rrr
Copy link
Contributor

rix0rrr commented Apr 16, 2019

I am going to close this PR as it does not look there's going to be any movement on it. Feel free to reopen in case of renewed interest.

@rix0rrr rix0rrr closed this Apr 16, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants