Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
private makePolicyStatements(task: sfn.Task): iam.PolicyStatement[] {
const stack = cdk.Stack.of(task);
// https://docs.aws.amazon.com/step-functions/latest/dg/ecs-iam.html
const policyStatements = [
new iam.PolicyStatement({
actions: ['ecs:RunTask'],
resources: [this.props.taskDefinition.taskDefinitionArn],
}),
new iam.PolicyStatement({
actions: ['ecs:StopTask', 'ecs:DescribeTasks'],
resources: ['*'],
}),
new iam.PolicyStatement({
actions: ['iam:PassRole'],
resources: cdk.Lazy.listValue({ produce: () => this.taskExecutionRoles().map(r => r.roleArn) })
}),
];
if (this.integrationPattern === sfn.ServiceIntegrationPattern.SYNC) {
policyStatements.push(new iam.PolicyStatement({
actions: ["events:PutTargets", "events:PutRule", "events:DescribeRule"],
resources: [stack.formatArn({
service: 'events',
resource: 'rule',
resourceName: 'StepFunctionsGetEventsForECSTaskRule'
})]
}));
}
return policyStatements;
}
constructor(scope: cdk.Construct, id: string, props: StepScalingActionProps) {
super(scope, id);
// Cloudformation requires either the ResourceId, ScalableDimension, and ServiceNamespace
// properties, or the ScalingTargetId property, but not both.
// https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-applicationautoscaling-scalingpolicy.html
const resource = new CfnScalingPolicy(this, 'Resource', {
policyName: props.policyName || this.node.uniqueId,
policyType: 'StepScaling',
scalingTargetId: props.scalingTarget.scalableTargetId,
stepScalingPolicyConfiguration: {
adjustmentType: props.adjustmentType,
cooldown: props.cooldown && props.cooldown.toSeconds(),
minAdjustmentMagnitude: props.minAdjustmentMagnitude,
metricAggregationType: props.metricAggregationType,
stepAdjustments: cdk.Lazy.anyValue({ produce: () => this.adjustments }),
} as CfnScalingPolicy.StepScalingPolicyConfigurationProperty
});
this.scalingPolicyArn = resource.ref;
}
constructor(scope: cdk.Construct, id: string, props: StepScalingActionProps) {
super(scope, id);
const resource = new CfnScalingPolicy(this, 'Resource', {
policyType: 'StepScaling',
autoScalingGroupName: props.autoScalingGroup.autoScalingGroupName,
cooldown: props.cooldown && props.cooldown.toSeconds().toString(),
estimatedInstanceWarmup: props.estimatedInstanceWarmup && props.estimatedInstanceWarmup.toSeconds(),
adjustmentType: props.adjustmentType,
minAdjustmentMagnitude: props.minAdjustmentMagnitude,
metricAggregationType: props.metricAggregationType,
stepAdjustments: cdk.Lazy.anyValue({ produce: () => this.adjustments }),
});
this.scalingPolicyArn = resource.ref;
}
constructor(scope: cdk.Construct, id: string, props: VirtualNodeProps) {
super(scope, id, {
physicalName: props.virtualNodeName || cdk.Lazy.stringValue({ produce: () => this.node.uniqueId })
});
this.mesh = props.mesh;
this.addBackends(...props.backends || []);
this.addListeners(...props.listener ? [props.listener] : []);
const node = new CfnVirtualNode(this, 'Resource', {
virtualNodeName: this.physicalName,
meshName: this.mesh.meshName,
spec: {
backends: cdk.Lazy.anyValue({ produce: () => this.backends }, { omitEmptyArray: true }),
listeners: cdk.Lazy.anyValue({ produce: () => this.listeners }, { omitEmptyArray: true }),
serviceDiscovery: {
dns: props.dnsHostName !== undefined ? { hostname: props.dnsHostName } : undefined,
awsCloudMap: props.cloudMapService !== undefined ? {
serviceName: props.cloudMapService.serviceName,
namespaceName: props.cloudMapService.namespace.namespaceName,
attributes: renderAttributes(props.cloudMapServiceInstanceAttributes)
} : undefined,
},
logging: {
accessLog: {
file: {
path: '/dev/stdout',
},
},
},
constructor(props: AwsIntegrationProps) {
const backend = props.subdomain ? `${props.subdomain}.${props.service}` : props.service;
const type = props.proxy ? IntegrationType.AWS_PROXY : IntegrationType.AWS;
const { apiType, apiValue } = parseAwsApiCall(props.path, props.action, props.actionParameters);
super({
type,
integrationHttpMethod: props.integrationHttpMethod || 'POST',
uri: cdk.Lazy.stringValue({ produce: () => {
if (!this.scope) { throw new Error('AwsIntegration must be used in API'); }
return cdk.Stack.of(this.scope).formatArn({
service: 'apigateway',
account: backend,
resource: apiType,
sep: '/',
resourceName: apiValue,
});
}}),
options: props.options,
});
}
resources: ['*'],
}));
requestorFunction.addToRolePolicy(new iam.PolicyStatement({
actions: ['route53:GetChange'],
resources: ['*'],
}));
requestorFunction.addToRolePolicy(new iam.PolicyStatement({
actions: ['route53:changeResourceRecordSets'],
resources: [`arn:aws:route53:::hostedzone/${this.hostedZoneId}`],
}));
const certificate = new cfn.CustomResource(this, 'CertificateRequestorResource', {
provider: cfn.CustomResourceProvider.lambda(requestorFunction),
properties: {
DomainName: props.domainName,
SubjectAlternativeNames: cdk.Lazy.listValue({ produce: () => props.subjectAlternativeNames }, { omitEmpty: true }),
HostedZoneId: this.hostedZoneId,
Region: props.region,
}
});
this.certificateArn = certificate.getAtt('Arn').toString();
}
constructor(scope: cdk.Construct, id: string, props: RouteProps) {
super(scope, id, {
physicalName: props.routeName || cdk.Lazy.stringValue({ produce: () => this.node.uniqueId })
});
this.virtualRouter = props.virtualRouter;
const routeType = props.routeType !== undefined ? props.routeType :
props.prefix !== undefined ? RouteType.HTTP :
RouteType.TCP;
if (routeType === RouteType.HTTP) {
this.httpRoute = this.renderHttpRoute(props);
} else {
this.tcpRoute = this.renderTcpRoute(props);
}
const route = new CfnRoute(this, 'Resource', {
routeName: this.physicalName,
});
this.role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSCodeDeployRoleForLambda'));
this.deploymentConfig = props.deploymentConfig || LambdaDeploymentConfig.CANARY_10PERCENT_5MINUTES;
const resource = new CfnDeploymentGroup(this, 'Resource', {
applicationName: this.application.applicationName,
serviceRoleArn: this.role.roleArn,
deploymentGroupName: this.physicalName,
deploymentConfigName: this.deploymentConfig.deploymentConfigName,
deploymentStyle: {
deploymentType: 'BLUE_GREEN',
deploymentOption: 'WITH_TRAFFIC_CONTROL'
},
alarmConfiguration: cdk.Lazy.anyValue({ produce: () => renderAlarmConfiguration(this.alarms, props.ignorePollAlarmsFailure) }),
autoRollbackConfiguration: cdk.Lazy.anyValue({ produce: () => renderAutoRollbackConfiguration(this.alarms, props.autoRollback) }),
});
this.deploymentGroupName = this.getResourceNameAttribute(resource.ref);
this.deploymentGroupArn = this.getResourceArnAttribute(arnForDeploymentGroup(this.application.applicationName, resource.ref), {
service: 'codedeploy',
resource: 'deploymentgroup',
resourceName: `${this.application.applicationName}/${this.physicalName}`,
sep: ':',
});
if (props.preHook) {
this.addPreHook(props.preHook);
}
if (props.postHook) {
this.addPostHook(props.postHook);
}
assumedBy: new iam.ServicePrincipal('codedeploy.amazonaws.com')
});
this.role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSCodeDeployRoleForLambda'));
this.deploymentConfig = props.deploymentConfig || LambdaDeploymentConfig.CANARY_10PERCENT_5MINUTES;
const resource = new CfnDeploymentGroup(this, 'Resource', {
applicationName: this.application.applicationName,
serviceRoleArn: this.role.roleArn,
deploymentGroupName: this.physicalName,
deploymentConfigName: this.deploymentConfig.deploymentConfigName,
deploymentStyle: {
deploymentType: 'BLUE_GREEN',
deploymentOption: 'WITH_TRAFFIC_CONTROL'
},
alarmConfiguration: cdk.Lazy.anyValue({ produce: () => renderAlarmConfiguration(this.alarms, props.ignorePollAlarmsFailure) }),
autoRollbackConfiguration: cdk.Lazy.anyValue({ produce: () => renderAutoRollbackConfiguration(this.alarms, props.autoRollback) }),
});
this.deploymentGroupName = this.getResourceNameAttribute(resource.ref);
this.deploymentGroupArn = this.getResourceArnAttribute(arnForDeploymentGroup(this.application.applicationName, resource.ref), {
service: 'codedeploy',
resource: 'deploymentgroup',
resourceName: `${this.application.applicationName}/${this.physicalName}`,
sep: ':',
});
if (props.preHook) {
this.addPreHook(props.preHook);
}
if (props.postHook) {
this.addPostHook(props.postHook);
constructor(scope: cdk.Construct, id: string, props: VirtualNodeProps) {
super(scope, id, {
physicalName: props.virtualNodeName || cdk.Lazy.stringValue({ produce: () => this.node.uniqueId })
});
this.mesh = props.mesh;
this.addBackends(...props.backends || []);
this.addListeners(...props.listener ? [props.listener] : []);
const node = new CfnVirtualNode(this, 'Resource', {
virtualNodeName: this.physicalName,
meshName: this.mesh.meshName,
spec: {
backends: cdk.Lazy.anyValue({ produce: () => this.backends }, { omitEmptyArray: true }),
listeners: cdk.Lazy.anyValue({ produce: () => this.listeners }, { omitEmptyArray: true }),
serviceDiscovery: {
dns: props.dnsHostName !== undefined ? { hostname: props.dnsHostName } : undefined,
awsCloudMap: props.cloudMapService !== undefined ? {