-
Notifications
You must be signed in to change notification settings - Fork 3.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: allow all sts
options for roles assumed by the cli
#31089
base: main
Are you sure you want to change the base?
Conversation
Signed-off-by: Sumu <sumughan@amazon.com>
…iling with tags in custom bootstrap Signed-off-by: Sumu <sumughan@amazon.com>
Signed-off-by: Sumu <sumughan@amazon.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request
. Additionally, if clarification is needed add Clarification Request
to a comment.
…s to cfnexecutionrole instead of deployrole Signed-off-by: Sumu <sumughan@amazon.com>
.../@aws-cdk-testing/cli-integ/resources/bootstrap-templates/custom-bootstrap-session-tags.yaml
Outdated
Show resolved
Hide resolved
Signed-off-by: Sumu <sumughan@amazon.com>
Signed-off-by: Sumu <sumughan@amazon.com>
Signed-off-by: Sumu <sumughan@amazon.com>
Signed-off-by: Sumu <sumughan@amazon.com>
Signed-off-by: Sumu <sumughan@amazon.com>
Signed-off-by: Sumu <sumughan@amazon.com>
Signed-off-by: Sumu <sumughan@amazon.com>
Signed-off-by: Sumu <sumughan@amazon.com>
Signed-off-by: Sumu <sumughan@amazon.com>
Required to implement [session tags](aws/aws-cdk#26157) and a prerequisite to aws/aws-cdk#31089.
Required to implement [session tags](aws/aws-cdk#26157) and a prerequisite to aws/aws-cdk#31089. ### Notes - Requires cdklabs/cloud-assembly-schema#33 to be merged first.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This file is a duplicate of https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/cx-api/FEATURE_FLAGS.md and should never have been committed.
➡️ PR build request submitted to A maintainer must now check the pipeline and add the |
The pull request linter fails with the following errors:
PRs must pass status checks before we can provide a meaningful review. If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
Allow passing all STS options to assume role configuration for various CDK roles.
Prerequisites
Issue # (if applicable)
Closes #26157
Fixes #22535
Reason for this change
Enabling ABAC via STS session tags. From the AWS docs:
Description of changes
The CDK creates 4 IAM roles during bootstrap. It then assumes these roles at various phases of the deployment.
Each of these roles should be assumable with their own specific session tags, as they server different purposes.
Session tags for each role will be configurable via synthesizer properties (similarly to how
externalId
is exposed) both for theDefaultStackSynthesizer
, and for a custom synthesizer extending theStackSynthesizer
class. The new properties will propagate down and will eventually be written to the cloud assembly.+ manifest.json
+ assets.json
Description of how you validated changes
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license