Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(iam): IAM Policies are too large to deploy #19114

Merged
merged 37 commits into from
Mar 18, 2022
Merged

fix(iam): IAM Policies are too large to deploy #19114

Show file tree
Hide file tree
Changes from 29 commits
Commits
Show all changes
37 commits
Select commit Hold shift + click to select a range
f8208e9
fix(iam): IAM Policies are too large to deploy
rix0rrr Feb 23, 2022
777c24d
Add unit tests
rix0rrr Feb 24, 2022
e9b6cdc
Only merge objects for principals
rix0rrr Feb 25, 2022
68d3940
Add test for condition
rix0rrr Feb 25, 2022
243f9c0
Update snapshots
rix0rrr Feb 25, 2022
1f40baa
Also merge Deny statements, add Alloy model
rix0rrr Feb 26, 2022
ef260c2
Revert "Update snapshots"
rix0rrr Feb 26, 2022
8b896d5
Add reference to Alloy model in source
rix0rrr Feb 26, 2022
281df8b
Correct docstring
rix0rrr Feb 26, 2022
a00582a
Don't unnecessarily update expectations
rix0rrr Feb 26, 2022
aeb902f
Update packages/@aws-cdk/aws-iam/lib/policy-document.ts
rix0rrr Feb 26, 2022
adf50cb
Add review comments
rix0rrr Feb 26, 2022
ccb192b
Redid merging logic
rix0rrr Feb 27, 2022
79f17d1
Update Alloy comment
rix0rrr Feb 27, 2022
09cdce1
Not subsets, equal sets!
rix0rrr Feb 27, 2022
02274c3
Update snapshots
rix0rrr Mar 2, 2022
ef354b4
Update model some more
rix0rrr Mar 4, 2022
00d0266
Merge branch 'huijbers/minimize-policies' of github.com:aws/aws-cdk i…
rix0rrr Mar 4, 2022
cc54755
Review comments
rix0rrr Mar 8, 2022
e4c3a2a
Update packages/@aws-cdk/aws-iam/lib/private/postprocess-policy-docum…
rix0rrr Mar 9, 2022
8fbee24
Remove unused helpers
rix0rrr Mar 9, 2022
625b2a7
Merge remote-tracking branch 'origin/master' into huijbers/minimize-p…
rix0rrr Mar 9, 2022
8875096
Update packages/@aws-cdk/aws-iam/lib/private/postprocess-policy-docum…
rix0rrr Mar 9, 2022
3e570f0
Do better comparisons
rix0rrr Mar 10, 2022
fe4be84
Merge branch 'huijbers/minimize-policies' of github.com:aws/aws-cdk i…
rix0rrr Mar 10, 2022
812d4fb
Some implementation details
rix0rrr Mar 10, 2022
fac4952
Update snapshots
rix0rrr Mar 10, 2022
bdb113f
More snapshot updates
rix0rrr Mar 10, 2022
1f0b3c4
Merge branch 'master' into huijbers/minimize-policies
rix0rrr Mar 10, 2022
4988a90
Silly copy/paste bug 😓
rix0rrr Mar 14, 2022
2d2f16b
Reformat, find another weakening
rix0rrr Mar 14, 2022
e1f701c
Merge remote-tracking branch 'origin/master' into huijbers/minimize-p…
rix0rrr Mar 14, 2022
8eb3cfa
Also handle untyped principals, review comments
rix0rrr Mar 17, 2022
80d7a07
Merge branch 'huijbers/minimize-policies' of github.com:aws/aws-cdk i…
rix0rrr Mar 17, 2022
793da77
Merge branch 'master' into huijbers/minimize-policies
rix0rrr Mar 17, 2022
4fb02ef
Update new integ
rix0rrr Mar 18, 2022
37eaa56
Merge branch 'master' into huijbers/minimize-policies
mergify[bot] Mar 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
417 changes: 171 additions & 246 deletions ...es/@aws-cdk-containers/ecs-service-extensions/test/integ.all-service-addons.expected.json
View file
Open in desktop

Large diffs are not rendered by default.

46 changes: 23 additions & 23 deletions ...ages/@aws-cdk-containers/ecs-service-extensions/test/integ.assign-public-ip.expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -511,9 +511,9 @@
"Statement": [
{
"Action": [
"sqs:SendMessage",
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl"
"sqs:GetQueueUrl",
"sqs:SendMessage"
],
"Condition": {
"ArnEquals": {
Expand All @@ -538,9 +538,9 @@
},
{
"Action": [
"sqs:SendMessage",
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl"
"sqs:GetQueueUrl",
"sqs:SendMessage"
],
"Condition": {
"ArnEquals": {
Expand Down Expand Up @@ -740,11 +740,11 @@
},
{
"Action": [
"sqs:ReceiveMessage",
"sqs:ChangeMessageVisibility",
"sqs:GetQueueUrl",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl",
"sqs:ReceiveMessage"
],
"Effect": "Allow",
"Resource": {
Expand All @@ -757,17 +757,17 @@
{
"Action": [
"dynamodb:BatchGetItem",
"dynamodb:BatchWriteItem",
"dynamodb:ConditionCheckItem",
"dynamodb:DeleteItem",
"dynamodb:DescribeTable",
"dynamodb:GetItem",
"dynamodb:GetRecords",
"dynamodb:GetShardIterator",
"dynamodb:PutItem",
"dynamodb:Query",
"dynamodb:GetItem",
"dynamodb:Scan",
"dynamodb:ConditionCheckItem",
"dynamodb:BatchWriteItem",
"dynamodb:PutItem",
"dynamodb:UpdateItem",
"dynamodb:DeleteItem",
"dynamodb:DescribeTable"
"dynamodb:UpdateItem"
],
"Effect": "Allow",
"Resource": [
Expand Down Expand Up @@ -1074,7 +1074,7 @@
"Properties": {
"Code": {
"S3Bucket": {
"Ref": "AssetParametersdaeb79e3cee39c9b902dc0d5c780223e227ed573ea60976252947adab5fb2be1S3BucketDC4B98B1"
"Ref": "AssetParameters5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391S3BucketB4102E9A"
},
"S3Key": {
"Fn::Join": [
Expand All @@ -1087,7 +1087,7 @@
"Fn::Split": [
"||",
{
"Ref": "AssetParametersdaeb79e3cee39c9b902dc0d5c780223e227ed573ea60976252947adab5fb2be1S3VersionKeyA495226F"
"Ref": "AssetParameters5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391S3VersionKeyC1EC3ED6"
}
]
}
Expand All @@ -1100,7 +1100,7 @@
"Fn::Split": [
"||",
{
"Ref": "AssetParametersdaeb79e3cee39c9b902dc0d5c780223e227ed573ea60976252947adab5fb2be1S3VersionKeyA495226F"
"Ref": "AssetParameters5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391S3VersionKeyC1EC3ED6"
}
]
}
Expand Down Expand Up @@ -1338,17 +1338,17 @@
"Type": "String",
"Description": "Artifact hash for asset \"8f06a3db22794ebc7ff89b4745fd706afd46e17816fe46da72e5125cabae725d\""
},
"AssetParametersdaeb79e3cee39c9b902dc0d5c780223e227ed573ea60976252947adab5fb2be1S3BucketDC4B98B1": {
"AssetParameters5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391S3BucketB4102E9A": {
"Type": "String",
"Description": "S3 bucket for asset \"daeb79e3cee39c9b902dc0d5c780223e227ed573ea60976252947adab5fb2be1\""
"Description": "S3 bucket for asset \"5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391\""
},
"AssetParametersdaeb79e3cee39c9b902dc0d5c780223e227ed573ea60976252947adab5fb2be1S3VersionKeyA495226F": {
"AssetParameters5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391S3VersionKeyC1EC3ED6": {
"Type": "String",
"Description": "S3 key for asset version \"daeb79e3cee39c9b902dc0d5c780223e227ed573ea60976252947adab5fb2be1\""
"Description": "S3 key for asset version \"5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391\""
},
"AssetParametersdaeb79e3cee39c9b902dc0d5c780223e227ed573ea60976252947adab5fb2be1ArtifactHashA521A16F": {
"AssetParameters5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391ArtifactHashA391D940": {
"Type": "String",
"Description": "Artifact hash for asset \"daeb79e3cee39c9b902dc0d5c780223e227ed573ea60976252947adab5fb2be1\""
"Description": "Artifact hash for asset \"5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391\""
},
"AssetParameters3744fa896361f81b76b1efde632ac07b1920ce09a4ca1ff15ab486f262a19b87S3Bucket36F31A16": {
"Type": "String",
Expand Down
74 changes: 32 additions & 42 deletions ...@aws-cdk-containers/ecs-service-extensions/test/integ.multiple-environments.expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1306,18 +1306,26 @@
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"nameproductionlogsD0BFFE8C",
"Arn"
]
}
"Resource": [
{
"Fn::GetAtt": [
"nameproductionlogsD0BFFE8C",
"Arn"
]
},
{
"Fn::GetAtt": [
"nameproductiontaskdefinitionenvoyLogGroupF79A2732",
"Arn"
]
}
]
},
{
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
],
"Effect": "Allow",
"Resource": {
Expand Down Expand Up @@ -1351,19 +1359,6 @@
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"nameproductiontaskdefinitionenvoyLogGroupF79A2732",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -1868,18 +1863,26 @@
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"namedevelopmentlogs108670CC",
"Arn"
]
}
"Resource": [
{
"Fn::GetAtt": [
"namedevelopmentlogs108670CC",
"Arn"
]
},
{
"Fn::GetAtt": [
"namedevelopmenttaskdefinitionenvoyLogGroupF8FCAFD6",
"Arn"
]
}
]
},
{
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
],
"Effect": "Allow",
"Resource": {
Expand Down Expand Up @@ -1913,19 +1916,6 @@
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"namedevelopmenttaskdefinitionenvoyLogGroupF8FCAFD6",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down
58 changes: 24 additions & 34 deletions ...ges/@aws-cdk-containers/ecs-service-extensions/test/integ.publish-subscribe.expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -548,16 +548,14 @@
{
"Action": "sns:Publish",
"Effect": "Allow",
"Resource": {
"Ref": "signupD2AAA171"
}
},
{
"Action": "sns:Publish",
"Effect": "Allow",
"Resource": {
"Ref": "delete1CCE71FF"
}
"Resource": [
{
"Ref": "delete1CCE71FF"
},
{
"Ref": "signupD2AAA171"
}
]
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -913,35 +911,27 @@
"Statement": [
{
"Action": [
"sqs:ReceiveMessage",
"sqs:ChangeMessageVisibility",
"sqs:GetQueueUrl",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"EventsQueueB96EB0D2",
"Arn"
]
}
},
{
"Action": [
"sqs:ReceiveMessage",
"sqs:ChangeMessageVisibility",
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
"sqs:ReceiveMessage"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"signupqueue33AFF2E6",
"Arn"
]
}
"Resource": [
{
"Fn::GetAtt": [
"EventsQueueB96EB0D2",
"Arn"
]
},
{
"Fn::GetAtt": [
"signupqueue33AFF2E6",
"Arn"
]
}
]
}
],
"Version": "2012-10-17"
Expand Down
44 changes: 21 additions & 23 deletions packages/@aws-cdk/app-delivery/test/integ.cicd.expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,16 +29,16 @@
"Statement": [
{
"Action": [
"s3:GetObject*",
"s3:Abort*",
"s3:DeleteObject*",
"s3:GetBucket*",
"s3:GetObject*",
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
"s3:PutObjectVersionTagging"
],
"Effect": "Allow",
"Resource": [
Expand Down Expand Up @@ -67,22 +67,20 @@
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"CodePipelineDeployExecuteCodePipelineActionRoleAE36AF49",
"Arn"
]
}
},
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"CodePipelineDeployChangeSetCodePipelineActionRoleB3BCDD8A",
"Arn"
]
}
"Resource": [
{
"Fn::GetAtt": [
"CodePipelineDeployChangeSetCodePipelineActionRoleB3BCDD8A",
"Arn"
]
},
{
"Fn::GetAtt": [
"CodePipelineDeployExecuteCodePipelineActionRoleAE36AF49",
"Arn"
]
}
]
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -334,8 +332,8 @@
},
{
"Action": [
"s3:GetObject*",
"s3:GetBucket*",
"s3:GetObject*",
"s3:List*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -431,8 +429,8 @@
"Statement": [
{
"Action": [
"s3:GetObject*",
"s3:GetBucket*",
"s3:GetObject*",
"s3:List*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -471,4 +469,4 @@
}
}
}
}
}
Loading