Skip to content

Commit f40bbdf

Browse files
glbglb
committed
fix: use AWS::Partition pseudo-parameter in ARNs
Previously the plugin constructed ARNs assuming that they will all be in `arn:aws:...`, which would cause failures when deploying to an alternate AWS partition. This changes the plugin to use the AWS::Partition pseudo-parameter to ensure that the local partition value is used.
1 parent bd51680 commit f40bbdf

24 files changed

+142
-97
lines changed

‎lib/package/dynamodb/compileIamRoleToDynamodb.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ module.exports = {
2626
Action: `dynamodb:${action}`,
2727
Resource: {
2828
'Fn::Sub': [
29-
'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
29+
'arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
3030
{ tableName }
3131
]
3232
}

‎lib/package/dynamodb/compileIamRoleToDynamodb.test.js

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ describe('#compileIamRoleToDynamodb()', () => {
9696
Action: 'dynamodb:PutItem',
9797
Resource: {
9898
'Fn::Sub': [
99-
'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
99+
'arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
100100
{
101101
tableName: { Ref: 'mytable' }
102102
}
@@ -108,7 +108,7 @@ describe('#compileIamRoleToDynamodb()', () => {
108108
Action: 'dynamodb:GetItem',
109109
Resource: {
110110
'Fn::Sub': [
111-
'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
111+
'arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
112112
{
113113
tableName: 'mytable'
114114
}
@@ -120,7 +120,7 @@ describe('#compileIamRoleToDynamodb()', () => {
120120
Action: 'dynamodb:DeleteItem',
121121
Resource: {
122122
'Fn::Sub': [
123-
'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
123+
'arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
124124
{
125125
tableName: 'mytable'
126126
}

‎lib/package/dynamodb/compileMethodsToDynamodb.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ module.exports = {
5353
},
5454
Uri: {
5555
'Fn::Sub': [
56-
'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
56+
'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
5757
{ action: http.action }
5858
]
5959
},

‎lib/package/dynamodb/compileMethodsToDynamodb.test.js

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ describe('#compileMethodsToDynamodb()', () => {
146146

147147
const uri = {
148148
'Fn::Sub': [
149-
'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
149+
'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
150150
{
151151
action: 'PutItem'
152152
}
@@ -183,7 +183,7 @@ describe('#compileMethodsToDynamodb()', () => {
183183

184184
const uri = {
185185
'Fn::Sub': [
186-
'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
186+
'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
187187
{
188188
action: 'GetItem'
189189
}
@@ -220,7 +220,7 @@ describe('#compileMethodsToDynamodb()', () => {
220220

221221
const uri = {
222222
'Fn::Sub': [
223-
'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
223+
'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
224224
{
225225
action: 'DeleteItem'
226226
}
@@ -757,7 +757,7 @@ describe('#compileMethodsToDynamodb()', () => {
757757
Credentials: { 'Fn::GetAtt': ['ApigatewayToDynamodbRole', 'Arn'] },
758758
Uri: {
759759
'Fn::Sub': [
760-
'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
760+
'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
761761
{ action: 'PutItem' }
762762
]
763763
},
@@ -873,7 +873,7 @@ describe('#compileMethodsToDynamodb()', () => {
873873
Credentials: { 'Fn::GetAtt': ['ApigatewayToDynamodbRole', 'Arn'] },
874874
Uri: {
875875
'Fn::Sub': [
876-
'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
876+
'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
877877
{ action: 'PutItem' }
878878
]
879879
},

‎lib/package/eventbridge/compileIamRoleToEventBridge.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ module.exports = {
1919

2020
const policyResource = eventBusNames.map((eventBusName) => ({
2121
'Fn::Sub': [
22-
'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
22+
'arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
2323
{ eventBusName }
2424
]
2525
}))

‎lib/package/eventbridge/compileIamRoleToEventBridge.test.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,13 +83,13 @@ describe('#compileIamRoleToEventBridge()', () => {
8383
Resource: [
8484
{
8585
'Fn::Sub': [
86-
'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
86+
'arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
8787
{ eventBusName: { Ref: 'EventBus1' } }
8888
]
8989
},
9090
{
9191
'Fn::Sub': [
92-
'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
92+
'arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
9393
{ eventBusName: { Ref: 'EventBus2' } }
9494
]
9595
}

‎lib/package/eventbridge/compileMethodsToEventBridge.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ module.exports = {
5353
Type: 'AWS',
5454
Credentials: roleArn,
5555
Uri: {
56-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
56+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
5757
},
5858
PassthroughBehavior: 'NEVER',
5959
RequestParameters: {

‎lib/package/eventbridge/compileMethodsToEventBridge.test.js

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ describe('#compileMethodsToEventBridge()', () => {
6969
Type: 'AWS',
7070
Credentials: { 'Fn::GetAtt': ['ApigatewayToEventBridgeRole', 'Arn'] },
7171
Uri: {
72-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
72+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
7373
},
7474
PassthroughBehavior: 'NEVER',
7575
RequestParameters: {
@@ -189,7 +189,7 @@ describe('#compileMethodsToEventBridge()', () => {
189189
Type: 'AWS',
190190
Credentials: { 'Fn::GetAtt': ['ApigatewayToEventBridgeRole', 'Arn'] },
191191
Uri: {
192-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
192+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
193193
},
194194
PassthroughBehavior: 'NEVER',
195195
RequestParameters: {
@@ -308,7 +308,7 @@ describe('#compileMethodsToEventBridge()', () => {
308308
Type: 'AWS',
309309
Credentials: { 'Fn::GetAtt': ['ApigatewayToEventBridgeRole', 'Arn'] },
310310
Uri: {
311-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
311+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
312312
},
313313
PassthroughBehavior: 'NEVER',
314314
RequestParameters: {
@@ -687,7 +687,7 @@ describe('#compileMethodsToEventBridge()', () => {
687687
Type: 'AWS',
688688
Credentials: { 'Fn::GetAtt': ['ApigatewayToEventBridgeRole', 'Arn'] },
689689
Uri: {
690-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
690+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
691691
},
692692
PassthroughBehavior: 'NEVER',
693693
RequestParameters: {
@@ -794,7 +794,7 @@ describe('#compileMethodsToEventBridge()', () => {
794794
Type: 'AWS',
795795
Credentials: { 'Fn::GetAtt': ['ApigatewayToEventBridgeRole', 'Arn'] },
796796
Uri: {
797-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
797+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
798798
},
799799
PassthroughBehavior: 'NEVER',
800800
RequestParameters: {

‎lib/package/kinesis/compileIamRoleToKinesis.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ module.exports = {
1919

2020
const policyResource = kinesisStreamNames.map((streamName) => ({
2121
'Fn::Sub': [
22-
'arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
22+
'arn:${AWS::Partition}:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
2323
{ streamName }
2424
]
2525
}))

‎lib/package/kinesis/compileIamRoleToKinesis.test.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,13 +83,13 @@ describe('#compileIamRoleToKinesis()', () => {
8383
Resource: [
8484
{
8585
'Fn::Sub': [
86-
'arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
86+
'arn:${AWS::Partition}:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
8787
{ streamName: { Ref: 'KinesisStream1' } }
8888
]
8989
},
9090
{
9191
'Fn::Sub': [
92-
'arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
92+
'arn:${AWS::Partition}:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
9393
{ streamName: { Ref: 'KinesisStream2' } }
9494
]
9595
}

‎lib/package/kinesis/compileMethodsToKinesis.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ module.exports = {
5353
Type: 'AWS',
5454
Credentials: roleArn,
5555
Uri: {
56-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
56+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
5757
},
5858
PassthroughBehavior: 'NEVER',
5959
RequestTemplates: this.getKinesisIntegrationRequestTemplates(http)

‎lib/package/kinesis/compileMethodsToKinesis.test.js

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ describe('#compileMethodsToKinesis()', () => {
6868
Type: 'AWS',
6969
Credentials: { 'Fn::GetAtt': ['ApigatewayToKinesisRole', 'Arn'] },
7070
Uri: {
71-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
71+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
7272
},
7373
PassthroughBehavior: 'NEVER',
7474
RequestTemplates: {
@@ -181,7 +181,7 @@ describe('#compileMethodsToKinesis()', () => {
181181
Type: 'AWS',
182182
Credentials: { 'Fn::GetAtt': ['ApigatewayToKinesisRole', 'Arn'] },
183183
Uri: {
184-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
184+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
185185
},
186186
PassthroughBehavior: 'NEVER',
187187
RequestTemplates: {
@@ -293,7 +293,7 @@ describe('#compileMethodsToKinesis()', () => {
293293
Type: 'AWS',
294294
Credentials: { 'Fn::GetAtt': ['ApigatewayToKinesisRole', 'Arn'] },
295295
Uri: {
296-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
296+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
297297
},
298298
PassthroughBehavior: 'NEVER',
299299
RequestTemplates: {
@@ -707,7 +707,7 @@ describe('#compileMethodsToKinesis()', () => {
707707
Type: 'AWS',
708708
Credentials: { 'Fn::GetAtt': ['ApigatewayToKinesisRole', 'Arn'] },
709709
Uri: {
710-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
710+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
711711
},
712712
PassthroughBehavior: 'NEVER',
713713
RequestTemplates: {
@@ -807,7 +807,7 @@ describe('#compileMethodsToKinesis()', () => {
807807
Type: 'AWS',
808808
Credentials: { 'Fn::GetAtt': ['ApigatewayToKinesisRole', 'Arn'] },
809809
Uri: {
810-
'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
810+
'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
811811
},
812812
PassthroughBehavior: 'NEVER',
813813
RequestTemplates: {

‎lib/package/s3/compileIamRoleToS3.js

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,14 @@ function convertToArn(bucket) {
1212
'Fn::GetAtt': [logicalId, 'Arn']
1313
}
1414
} else {
15-
return `arn:aws:s3:::${bucket}`
15+
return {
16+
'Fn::Sub': [
17+
'arn:${AWS::Partition}:s3:::${bucket}',
18+
{
19+
bucket
20+
}
21+
]
22+
}
1623
}
1724
}
1825

@@ -40,12 +47,7 @@ module.exports = {
4047
Effect: 'Allow',
4148
Action: `s3:${action}*`, // e.g. PutObject*, GetObject*, DeleteObject*
4249
Resource: {
43-
'Fn::Sub': [
44-
'${bucket}/*',
45-
{
46-
bucket: convertToArn(bucket)
47-
}
48-
]
50+
'Fn::Join': ['', [convertToArn(bucket), '/*']]
4951
}
5052
}
5153
})

‎lib/package/s3/compileIamRoleToS3.test.js

Lines changed: 46 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -103,49 +103,74 @@ describe('#compileIamRoleToS3()', () => {
103103
Effect: 'Allow',
104104
Action: 's3:PutObject*',
105105
Resource: {
106-
'Fn::Sub': [
107-
'${bucket}/*',
108-
{
109-
bucket: 'arn:aws:s3:::myBucket'
110-
}
106+
'Fn::Join': [
107+
'',
108+
[
109+
{
110+
'Fn::Sub': [
111+
'arn:${AWS::Partition}:s3:::${bucket}',
112+
{
113+
bucket: 'myBucket'
114+
}
115+
]
116+
},
117+
'/*'
118+
]
111119
]
112120
}
113121
},
114122
{
115123
Effect: 'Allow',
116124
Action: 's3:GetObject*',
117125
Resource: {
118-
'Fn::Sub': [
119-
'${bucket}/*',
120-
{
121-
bucket: 'arn:aws:s3:::myBucket'
122-
}
126+
'Fn::Join': [
127+
'',
128+
[
129+
{
130+
'Fn::Sub': [
131+
'arn:${AWS::Partition}:s3:::${bucket}',
132+
{
133+
bucket: 'myBucket'
134+
}
135+
]
136+
},
137+
'/*'
138+
]
123139
]
124140
}
125141
},
126142
{
127143
Effect: 'Allow',
128144
Action: 's3:DeleteObject*',
129145
Resource: {
130-
'Fn::Sub': [
131-
'${bucket}/*',
132-
{
133-
bucket: {
146+
'Fn::Join': [
147+
'',
148+
[
149+
{
134150
'Fn::GetAtt': ['MyBucket', 'Arn']
135-
}
136-
}
151+
},
152+
'/*'
153+
]
137154
]
138155
}
139156
},
140157
{
141158
Effect: 'Allow',
142159
Action: 's3:PutObject*',
143160
Resource: {
144-
'Fn::Sub': [
145-
'${bucket}/*',
146-
{
147-
bucket: 'arn:aws:s3:::myBucketV2'
148-
}
161+
'Fn::Join': [
162+
'',
163+
[
164+
{
165+
'Fn::Sub': [
166+
'arn:${AWS::Partition}:s3:::${bucket}',
167+
{
168+
bucket: 'myBucketV2'
169+
}
170+
]
171+
},
172+
'/*'
173+
]
149174
]
150175
}
151176
}

‎lib/package/s3/compileMethodsToS3.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ module.exports = {
153153
Type: 'AWS',
154154
Credentials: roleArn,
155155
Uri: {
156-
'Fn::Sub': ['arn:aws:apigateway:${AWS::Region}:s3:path/' + pather, {}]
156+
'Fn::Sub': ['arn:${AWS::Partition}:apigateway:${AWS::Region}:s3:path/' + pather, {}]
157157
},
158158
PassthroughBehavior: 'WHEN_NO_MATCH',
159159
RequestParameters: _.merge(requestParams, http.requestParameters)

0 commit comments

Comments
 (0)