feat(iam): validate roleName #28509
feat(iam): validate roleName #28509
Conversation
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
There was a problem hiding this comment.
Thanks @frattallone. I got you to pass the automated reviewer but I do have one concern re: tokens before I approve this PR.
Also, the build is failing. The build needs to succeed before we take a second look!
| @@ -413,6 +413,10 @@ export class Role extends Resource implements IRole { | |||
| physicalName: props.roleName, | |||
| }); | |||
|
|
|||
| if (props.roleName && !/^[\w_+=,.@-]{1,64}$/.test(props.roleName)) { | |||
There was a problem hiding this comment.
We need to cover the case where the roleName is a token, and thus we cannot parse it and see if the roleName is valid. We let these go through to CloudFormation, and there's tons of prior art around CDK that handles these situations. Need a unit test for it as well.
There was a problem hiding this comment.
I'm going to add this check and relative tests
Pull request has been modified.
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
There was a problem hiding this comment.
Additional check and tests have been added for roleName is token case. Great work @frattallone, thanks for the contribution!
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
> Validates roleName Closes aws#28502 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Closes #28502
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license