Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(rds): support configuring secret rotation behavior via rotateImmediatelyOnUpdate prop #26329

Merged
merged 37 commits into from
Jul 18, 2023

Conversation

colifran
Copy link
Contributor

This PR supports allowing users to configure the default secret rotation behavior of AWS Secrets Manager. By default, AWS Secrets Manager will rotate the secret immediately. Setting rotateImmediatelyOnUpdate to false will force AWS Secrets Manager to wait until the next scheduled rotation window which is specified via the automaticallyAfter property.

Closes #26099


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…monRotationUserOptions interfaces

Signed-off-by: Francis <colifran@amazon.com>
…ser rotations

Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
… false

Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
@gitpod-io
Copy link

gitpod-io bot commented Jul 12, 2023

@aws-cdk-automation aws-cdk-automation requested a review from a team July 12, 2023 03:09
@github-actions github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p1 labels Jul 12, 2023
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Jul 12, 2023
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
Signed-off-by: Francis <colifran@amazon.com>
@colifran colifran marked this pull request as ready for review July 12, 2023 18:17
@aws-cdk-automation aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jul 12, 2023
kaizencc and others added 7 commits July 17, 2023 08:28
…ssets: false` (#26321)

The motivation here is that I went to add this option and realized that it already existed. However, setting the property to `false` wasn't tested or documented. This PR does both of those things.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Replaces the existing `cfn2ts` code generator with the new `spec2cdk` generator based on `@cdklabs/typewriter` and the separately published service spec database `@aws-cdk/aws-service-spec`.

Other neccesary changes are:

- Lowered coverage threshold for branches to 35% since the newly generated code is more expressive. Arguably we should not include generated files in the coverage calculation, but that's a bigger change. 
- Asset hashes in `cfn-include` test changed due to props now being ordered alphabetic. I've manually verified that the templates are otherwise identical.
- Removing `port` property from `neptune-alpha` as this has been removed upstream and is not functional according to the service team.
- Switched `synthetics-alpha` tests to use `testDeprecated()` for anything using the `Canary`. This is due to the removal of the `deleteLambdaResourcesOnCanaryDeletion` prop in the CFN spec. The new codegen marks removed props as deprecated. We will replace this feature with a custom resource soon.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Not needed as we are no longer releasing v1

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Implemented the L2 construct for the IoT Core HTTPS action.


Closes #25491 .

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Turning rosetta back on again. Was turned off in April in #26330 and never turned on again. Therefore we have a significant diff of uncompilable examples.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
aws-cdk-automation and others added 14 commits July 17, 2023 08:28
Previously (accidentally) used the module name as a name for the import. This caused the build to fail with `error TS5055: Cannot write file 'aws-cdk-lib/aws-cloudwatch/index.d.ts' because it would overwrite input file.` Also exclude declaration files from the build, which makes it slightly faster (~20s).

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…using EXTERNAL deployment controller (#26338)

When using an external deployment controller, ECS Service creation fails because the `NetworkConfiguration` is output to the template.
This fix prevents the output of `NetworkConfiguration` when using external deployment controller.

Closes #26335

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
This PR fixes a document for `fingerprint` in `core` module, because the caller's comments did not modify it.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Allowing user to provide a `platform` property when bundling docker assets ([ref](https://docs.docker.com/build/building/multi-platform/)).

Currently, this is not possible when using an existing Docker image via the [BundlingOptions](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.BundlingOptions.html). You can specify this when building a  [DockerImageAsset](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecr_assets.DockerImageAsset.html#platform), but not when using an image as a builder:

Closes #25759.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…26366)

This change grants the possibility to [specify event filtering](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-msk-smak) on the `ManagedKafkaEventSource` and `SelfManagedKafkaEventSource` constructs via the `filters` property.

Closes #26348.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Some tests were previously skipped. Un-skip them and put a linter rule in place that prevents this.

Closes #25137 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Fix issue with esbuild bundling step using pnpm 8.4.0 and above where `{outputDir}/node_modules/.modules.yaml` does not always exist and current `rm` command fails bundling process when file is not present.

Relevant change that in [pnpm 8.4.0 release notes](https://github.com/pnpm/pnpm/releases/tag/v8.4.0): 

> Do not create a node_modules folder with a .modules.yaml file if there are no dependencies inside node_modules.

Solved by following prior rejected pull request #25617 and suggestion in original issue #25612 of adding `-f` param to `rm` command to succeed even if file doesn't exist. Updated relevant unit test to expect this flag when using pnpm.

Closes #25612.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
In this [PR](#26287), we moved the custom resource handlers from the `lib` directory to `dist` - but any `dist` directory is npm ignored.

This is causing failures in our pipeline when running cli integration tests:

```console
Error: cannot find /tmp/cdk-integ-0u3tmsd7dnl/node_modules/aws-cdk-lib/custom-resource-handlers/dist/aws-s3/auto-delete-objects-handler/index.js
--
242 | at new CustomResourceProvider (/tmp/cdk-integ-0u3tmsd7dnl/node_modules/aws-cdk-lib/core/lib/custom-resource-provider/custom-resource-provider.js:1:3214)
243 | at Function.getOrCreateProvider (/tmp/cdk-integ-0u3tmsd7dnl/node_modules/aws-cdk-lib/core/lib/custom-resource-provider/custom-resource-provider.js:1:2660)
244 | at Bucket.enableAutoDeleteObjects (/tmp/cdk-integ-0u3tmsd7dnl/node_modules/aws-cdk-lib/aws-s3/lib/bucket.js:1:32627)
245 | at new Bucket (/tmp/cdk-integ-0u3tmsd7dnl/node_modules/aws-cdk-lib/aws-s3/lib/bucket.js:1:21317)
246 | at new BuiltinLambdaStack (/tmp/cdk-integ-0u3tmsd7dnl/app.js:379:5)
247 | at Object.<anonymous> (/tmp/cdk-integ-0u3tmsd7dnl/app.js:449:5)
248 | at Module._compile (node:internal/modules/cjs/loader:1196:14)
249 | at Object.Module._extensions..js (node:internal/modules/cjs/loader:1250:10)
250 | at Module.load (node:internal/modules/cjs/loader:1074:32)
```

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Add Aurora PostgreSQL 15.3.0 to database cluster engine.
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.html#AuroraPostgreSQL.Updates.20180305.1530

S3 import and s3 export features are supported.
```bash
$ aws rds describe-db-engine-versions --region us-east-1 --engine aurora-postgresql --engine-version 15.3
{
    "DBEngineVersions": [
        {
            "Engine": "aurora-postgresql",
            "EngineVersion": "15.3",
            "DBParameterGroupFamily": "aurora-postgresql15",
            "DBEngineDescription": "Aurora (PostgreSQL)",
            "DBEngineVersionDescription": "Aurora PostgreSQL (Compatible with PostgreSQL 15.3)",
            "ValidUpgradeTarget": [],
            "ExportableLogTypes": [
                "postgresql"
            ],
            "SupportsLogExportsToCloudwatchLogs": true,
            "SupportsReadReplica": false,
            "SupportedEngineModes": [
                "provisioned"
            ],
            "SupportedFeatureNames": [
                "Comprehend",
                "Lambda",
                "s3Export",
                "s3Import",
                "SageMaker"
            ],
            "Status": "available",
            "SupportsParallelQuery": false,
            "SupportsGlobalDatabases": true,
            "MajorEngineVersion": "15",
            "SupportsBabelfish": true,
            "SupportsCertificateRotationWithoutRestart": true,
            "SupportedCACertificateIdentifiers": [
                "rds-ca-2019",
                "rds-ca-ecc384-g1",
                "rds-ca-rsa4096-g1",
                "rds-ca-rsa2048-g1"
            ]
        }
    ]
}
```

Closes #26363.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Add  toString to Lambda Architecture property

When throwing errors during synthesis, you can't see the architecture chosen for a lambda. Adding this toString method solves that

Closes #26117

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Closes #26242 .

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Signed-off-by: Francis <colifran@amazon.com>
@mergify
Copy link
Contributor

mergify bot commented Jul 18, 2023

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: d0e23fe
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit 979cbff into main Jul 18, 2023
@mergify mergify bot deleted the colifran/rotate-immediately-on-update branch July 18, 2023 08:45
@mergify
Copy link
Contributor

mergify bot commented Jul 18, 2023

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

bmoffatt pushed a commit to bmoffatt/aws-cdk that referenced this pull request Jul 29, 2023
…ediatelyOnUpdate prop (aws#26329)

This PR supports allowing users to configure the default secret rotation behavior of AWS Secrets Manager. By default, AWS Secrets Manager will rotate the secret immediately. Setting `rotateImmediatelyOnUpdate` to `false` will force AWS Secrets Manager to wait until the next scheduled rotation window which is specified via the `automaticallyAfter` property.

Closes aws#26099

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
contribution/core This is a PR that came from AWS. effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p1 pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

aws_rds: add support for RotateImmediatelyOnUpdate to secret rotation