Skip to content

Commit 2d63a35

Browse files
author
Elad Ben-Israel
authored
refactor(aws-iam): move IAM classes cdk to aws-iam (#866)
Fixes #196 BREAKING CHANGE This change moves the `PolicyDocument`, `PolicyStatement` and all `PolicyPrincipal` classes from the @aws-cdk/cdk module and into the @aws-cdk/aws-iam module.
1 parent d17911e commit 2d63a35

File tree

72 files changed

+194
-171
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+194
-171
lines changed

Diff for: ‎examples/cdk-examples-typescript/advanced-usage/index.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,15 @@ class PolicyExample extends cdk.Stack {
1616
// here's how to create an IAM Role with an assume policy for the Lambda
1717
// service principal.
1818
const role = new iam.Role(this, 'Role', {
19-
assumedBy: new cdk.ServicePrincipal('lambda.amazon.aws.com')
19+
assumedBy: new iam.ServicePrincipal('lambda.amazon.aws.com')
2020
});
2121

2222
// when you call `addToPolicy`, a default policy is defined and attached
2323
// to the bucket.
2424
const bucket = new s3.Bucket(this, 'MyBucket');
2525

2626
// the role also has a policy attached to it.
27-
role.addToPolicy(new cdk.PolicyStatement()
27+
role.addToPolicy(new iam.PolicyStatement()
2828
.addResource(bucket.arnForObjects('*'))
2929
.addResource(bucket.bucketArn)
3030
.addActions('s3:*'));

Diff for: ‎examples/cdk-examples-typescript/bucket-import-export/index.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ class ConsumerConstruct extends cdk.Construct {
2525
constructor(parent: cdk.Construct, name: string, props: ConsumerConstructProps) {
2626
super(parent, name);
2727

28-
props.bucket.addToResourcePolicy(new cdk.PolicyStatement().addAction('*'));
28+
props.bucket.addToResourcePolicy(new iam.PolicyStatement().addAction('*'));
2929
}
3030
}
3131

Diff for: ‎examples/cdk-examples-typescript/sns-sqs/index.ts

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import iam = require('@aws-cdk/aws-iam');
12
import sns = require('@aws-cdk/aws-sns');
23
import sqs = require('@aws-cdk/aws-sqs');
34
import cdk = require('@aws-cdk/cdk');
@@ -28,8 +29,8 @@ class CFN extends cdk.Stack {
2829
protocol: 'sqs'
2930
});
3031

31-
const policyDocument = new cdk.PolicyDocument();
32-
policyDocument.addStatement(new cdk.PolicyStatement()
32+
const policyDocument = new iam.PolicyDocument();
33+
policyDocument.addStatement(new iam.PolicyStatement()
3334
.addResource(queue.queueArn)
3435
.addAction('sqs:SendMessage')
3536
.addServicePrincipal('sns.amazonaws.com')

Diff for: ‎packages/@aws-cdk/aws-apigateway/lib/integrations/lambda.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1+
import iam = require('@aws-cdk/aws-iam');
12
import lambda = require('@aws-cdk/aws-lambda');
2-
import cdk = require('@aws-cdk/cdk');
33
import { IntegrationOptions } from '../integration';
44
import { Method } from '../method';
55
import { AwsIntegration } from './aws';
@@ -52,7 +52,7 @@ export class LambdaIntegration extends AwsIntegration {
5252
}
5353

5454
public bind(method: Method) {
55-
const principal = new cdk.ServicePrincipal('apigateway.amazonaws.com');
55+
const principal = new iam.ServicePrincipal('apigateway.amazonaws.com');
5656

5757
const desc = `${method.httpMethod}.${method.resource.resourcePath.replace(/\//g, '.')}`;
5858

Diff for: ‎packages/@aws-cdk/aws-apigateway/lib/restapi.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ export interface RestApiProps extends ResourceOptions {
6666
/**
6767
* A policy document that contains the permissions for this RestApi
6868
*/
69-
policy?: cdk.PolicyDocument;
69+
policy?: iam.PolicyDocument;
7070

7171
/**
7272
* A description of the purpose of this API Gateway RestApi resource.
@@ -314,7 +314,7 @@ export class RestApi extends RestApiRef implements cdk.IDependable {
314314

315315
private configureCloudWatchRole(apiResource: cloudformation.RestApiResource) {
316316
const role = new iam.Role(this, 'CloudWatchRole', {
317-
assumedBy: new cdk.ServicePrincipal('apigateway.amazonaws.com'),
317+
assumedBy: new iam.ServicePrincipal('apigateway.amazonaws.com'),
318318
managedPolicyArns: [ cdk.ArnUtils.fromComponents({
319319
service: 'iam',
320320
region: '',

Diff for: ‎packages/@aws-cdk/aws-apigateway/test/test.method.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ export = {
206206
// GIVEN
207207
const stack = new cdk.Stack();
208208
const api = new apigateway.RestApi(stack, 'test-api', { deploy: false });
209-
const role = new iam.Role(stack, 'MyRole', { assumedBy: new cdk.ServicePrincipal('foo') });
209+
const role = new iam.Role(stack, 'MyRole', { assumedBy: new iam.ServicePrincipal('foo') });
210210

211211
// WHEN
212212
api.root.addMethod('GET', new apigateway.Integration({
@@ -251,7 +251,7 @@ export = {
251251
// GIVEN
252252
const stack = new cdk.Stack();
253253
const api = new apigateway.RestApi(stack, 'test-api', { deploy: false });
254-
const role = new iam.Role(stack, 'MyRole', { assumedBy: new cdk.ServicePrincipal('foo') });
254+
const role = new iam.Role(stack, 'MyRole', { assumedBy: new iam.ServicePrincipal('foo') });
255255

256256
// WHEN
257257
const integration = new apigateway.Integration({

Diff for: ‎packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ export class AutoScalingGroup extends cdk.Construct implements cdk.ITaggable, el
190190
}
191191

192192
this.role = new iam.Role(this, 'InstanceRole', {
193-
assumedBy: new cdk.ServicePrincipal('ec2.amazonaws.com')
193+
assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com')
194194
});
195195

196196
const iamProfile = new iam.cloudformation.InstanceProfileResource(this, 'InstanceProfile', {
@@ -302,7 +302,7 @@ export class AutoScalingGroup extends cdk.Construct implements cdk.ITaggable, el
302302
/**
303303
* Adds a statement to the IAM role assumed by instances of this fleet.
304304
*/
305-
public addToRolePolicy(statement: cdk.PolicyStatement) {
305+
public addToRolePolicy(statement: iam.PolicyStatement) {
306306
this.role.addToPolicy(statement);
307307
}
308308

Diff for: ‎packages/@aws-cdk/aws-autoscaling/test/test.auto-scaling-group.ts

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import { expect, haveResource, ResourcePart } from '@aws-cdk/assert';
22
import ec2 = require('@aws-cdk/aws-ec2');
3+
import iam = require('@aws-cdk/aws-iam');
34
import cdk = require('@aws-cdk/cdk');
45
import { Test } from 'nodeunit';
56
import autoscaling = require('../lib');
@@ -137,7 +138,7 @@ export = {
137138
vpc
138139
});
139140

140-
fleet.addToRolePolicy(new cdk.PolicyStatement()
141+
fleet.addToRolePolicy(new iam.PolicyStatement()
141142
.addAction('test:SpecialName')
142143
.addAllResources());
143144

Diff for: ‎packages/@aws-cdk/aws-cloudformation/lib/pipeline-actions.ts

+7-7
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ export class PipelineExecuteChangeSetAction extends PipelineCloudFormationAction
8989
ChangeSetName: props.changeSetName,
9090
});
9191

92-
props.stage.pipelineRole.addToPolicy(new cdk.PolicyStatement()
92+
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
9393
.addAction('cloudformation:ExecuteChangeSet')
9494
.addResource(stackArnFromName(props.stackName))
9595
.addCondition('StringEquals', { 'cloudformation:ChangeSetName': props.changeSetName }));
@@ -201,19 +201,19 @@ export abstract class PipelineCloudFormationDeployAction extends PipelineCloudFo
201201
this.role = props.role;
202202
} else {
203203
this.role = new iam.Role(this, 'Role', {
204-
assumedBy: new cdk.ServicePrincipal('cloudformation.amazonaws.com')
204+
assumedBy: new iam.ServicePrincipal('cloudformation.amazonaws.com')
205205
});
206206

207207
if (props.fullPermissions) {
208-
this.role.addToPolicy(new cdk.PolicyStatement().addAction('*').addAllResources());
208+
this.role.addToPolicy(new iam.PolicyStatement().addAction('*').addAllResources());
209209
}
210210
}
211211
}
212212

213213
/**
214214
* Add statement to the service role assumed by CloudFormation while executing this action.
215215
*/
216-
public addToRolePolicy(statement: cdk.PolicyStatement) {
216+
public addToRolePolicy(statement: iam.PolicyStatement) {
217217
return this.role.addToPolicy(statement);
218218
}
219219
}
@@ -254,16 +254,16 @@ export class PipelineCreateReplaceChangeSetAction extends PipelineCloudFormation
254254

255255
const stackArn = stackArnFromName(props.stackName);
256256
// Allow the pipeline to check for Stack & ChangeSet existence
257-
props.stage.pipelineRole.addToPolicy(new cdk.PolicyStatement()
257+
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
258258
.addAction('cloudformation:DescribeStacks')
259259
.addResource(stackArn));
260260
// Allow the pipeline to create & delete the specified ChangeSet
261-
props.stage.pipelineRole.addToPolicy(new cdk.PolicyStatement()
261+
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
262262
.addActions('cloudformation:CreateChangeSet', 'cloudformation:DeleteChangeSet', 'cloudformation:DescribeChangeSet')
263263
.addResource(stackArn)
264264
.addCondition('StringEquals', { 'cloudformation:ChangeSetName': props.changeSetName }));
265265
// Allow the pipeline to pass this actions' role to CloudFormation
266-
props.stage.pipelineRole.addToPolicy(new cdk.PolicyStatement()
266+
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
267267
.addAction('iam:PassRole')
268268
.addResource(this.role.roleArn));
269269
}

Diff for: ‎packages/@aws-cdk/aws-cloudformation/test/test.pipeline-actions.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -170,11 +170,11 @@ class StageDouble implements cpapi.IStage {
170170
class RoleDouble extends iam.Role {
171171
public readonly statements = new Array<PolicyStatementJson>();
172172

173-
constructor(parent: cdk.Construct, id: string, props: iam.RoleProps = { assumedBy: new cdk.ServicePrincipal('test') }) {
173+
constructor(parent: cdk.Construct, id: string, props: iam.RoleProps = { assumedBy: new iam.ServicePrincipal('test') }) {
174174
super(parent, id, props);
175175
}
176176

177-
public addToPolicy(statement: cdk.PolicyStatement) {
177+
public addToPolicy(statement: iam.PolicyStatement) {
178178
super.addToPolicy(statement);
179179
this.statements.push(statement.toJson());
180180
}

Diff for: ‎packages/@aws-cdk/aws-cloudtrail/lib/index.ts

+4-4
Original file line numberDiff line numberDiff line change
@@ -132,12 +132,12 @@ export class CloudTrail extends cdk.Construct {
132132
const s3bucket = new s3.Bucket(this, 'S3', {encryption: s3.BucketEncryption.Unencrypted});
133133
const cloudTrailPrincipal = "cloudtrail.amazonaws.com";
134134

135-
s3bucket.addToResourcePolicy(new cdk.PolicyStatement()
135+
s3bucket.addToResourcePolicy(new iam.PolicyStatement()
136136
.addResource(s3bucket.bucketArn)
137137
.addActions('s3:GetBucketAcl')
138138
.addServicePrincipal(cloudTrailPrincipal));
139139

140-
s3bucket.addToResourcePolicy(new cdk.PolicyStatement()
140+
s3bucket.addToResourcePolicy(new iam.PolicyStatement()
141141
.addResource(s3bucket.arnForObjects(new cdk.FnConcat('/AWSLogs/', new cdk.AwsAccountId())))
142142
.addActions("s3:PutObject")
143143
.addServicePrincipal(cloudTrailPrincipal)
@@ -149,10 +149,10 @@ export class CloudTrail extends cdk.Construct {
149149
});
150150
this.cloudWatchLogsGroupArn = logGroup.logGroupArn;
151151

152-
const logsRole = new iam.Role(this, 'LogsRole', {assumedBy: new cdk.ServicePrincipal(cloudTrailPrincipal) });
152+
const logsRole = new iam.Role(this, 'LogsRole', {assumedBy: new iam.ServicePrincipal(cloudTrailPrincipal) });
153153

154154
const streamArn = `${this.cloudWatchLogsRoleArn}:log-stream:*`;
155-
logsRole.addToPolicy(new cdk.PolicyStatement()
155+
logsRole.addToPolicy(new iam.PolicyStatement()
156156
.addActions("logs:PutLogEvents", "logs:CreateLogStream")
157157
.addResource(streamArn));
158158
this.cloudWatchLogsRoleArn = logsRole.roleArn;

Diff for: ‎packages/@aws-cdk/aws-cloudwatch/lib/metric.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ export class Metric {
9090
public static grantPutMetricData(identity?: iam.IIdentityResource) {
9191
if (!identity) { return; }
9292

93-
identity.addToPolicy(new cdk.PolicyStatement()
93+
identity.addToPolicy(new iam.PolicyStatement()
9494
.addAllResources()
9595
.addAction("cloudwatch:PutMetricData"));
9696
}

Diff for: ‎packages/@aws-cdk/aws-cloudwatch/test/test.metrics.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ export = {
99
// GIVEN
1010
const stack = new cdk.Stack();
1111
const role = new iam.Role(stack, 'SomeRole', {
12-
assumedBy: new cdk.Anyone()
12+
assumedBy: new iam.Anyone()
1313
});
1414

1515
// WHEN

Diff for: ‎packages/@aws-cdk/aws-codebuild/lib/pipeline-actions.ts

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import codepipeline = require('@aws-cdk/aws-codepipeline-api');
2+
import iam = require('@aws-cdk/aws-iam');
23
import cdk = require('@aws-cdk/cdk');
34
import { ProjectRef } from './project';
45

@@ -53,7 +54,7 @@ export class PipelineBuildAction extends codepipeline.BuildAction {
5354
'codebuild:StopBuild',
5455
];
5556

56-
props.stage.pipelineRole.addToPolicy(new cdk.PolicyStatement()
57+
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
5758
.addResource(props.project.projectArn)
5859
.addActions(...actions));
5960

Diff for: ‎packages/@aws-cdk/aws-codebuild/lib/project.ts

+5-5
Original file line numberDiff line numberDiff line change
@@ -279,10 +279,10 @@ export abstract class ProjectRef extends cdk.Construct implements events.IEventR
279279
public asEventRuleTarget(_ruleArn: string, _ruleId: string): events.EventRuleTargetProps {
280280
if (!this.eventsRole) {
281281
this.eventsRole = new iam.Role(this, 'EventsRole', {
282-
assumedBy: new cdk.ServicePrincipal('events.amazonaws.com')
282+
assumedBy: new iam.ServicePrincipal('events.amazonaws.com')
283283
});
284284

285-
this.eventsRole.addToPolicy(new cdk.PolicyStatement()
285+
this.eventsRole.addToPolicy(new iam.PolicyStatement()
286286
.addAction('codebuild:StartBuild')
287287
.addResource(this.projectArn));
288288
}
@@ -446,7 +446,7 @@ export class Project extends ProjectRef {
446446
}
447447

448448
this.role = props.role || new iam.Role(this, 'Role', {
449-
assumedBy: new cdk.ServicePrincipal('codebuild.amazonaws.com')
449+
assumedBy: new iam.ServicePrincipal('codebuild.amazonaws.com')
450450
});
451451

452452
let cache: cloudformation.ProjectResource.ProjectCacheProperty | undefined;
@@ -515,7 +515,7 @@ export class Project extends ProjectRef {
515515
* Add a permission only if there's a policy attached.
516516
* @param statement The permissions statement to add
517517
*/
518-
public addToRolePolicy(statement: cdk.PolicyStatement) {
518+
public addToRolePolicy(statement: iam.PolicyStatement) {
519519
if (this.role) {
520520
this.role.addToPolicy(statement);
521521
}
@@ -531,7 +531,7 @@ export class Project extends ProjectRef {
531531

532532
const logGroupStarArn = `${logGroupArn}:*`;
533533

534-
const p = new cdk.PolicyStatement();
534+
const p = new iam.PolicyStatement();
535535
p.allow();
536536
p.addResource(logGroupArn);
537537
p.addResource(logGroupStarArn);

Diff for: ‎packages/@aws-cdk/aws-codebuild/lib/source.ts

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import codecommit = require('@aws-cdk/aws-codecommit');
2+
import iam = require('@aws-cdk/aws-iam');
23
import s3 = require('@aws-cdk/aws-s3');
34
import cdk = require('@aws-cdk/cdk');
45
import { cloudformation } from './codebuild.generated';
@@ -43,7 +44,7 @@ export class CodeCommitSource extends BuildSource {
4344

4445
public bind(project: Project) {
4546
// https://docs.aws.amazon.com/codebuild/latest/userguide/setting-up.html
46-
project.addToRolePolicy(new cdk.PolicyStatement()
47+
project.addToRolePolicy(new iam.PolicyStatement()
4748
.addAction('codecommit:GitPull')
4849
.addResource(this.repo.repositoryArn));
4950
}

Diff for: ‎packages/@aws-cdk/aws-codecommit/lib/pipeline-action.ts

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import codepipeline = require('@aws-cdk/aws-codepipeline-api');
2+
import iam = require('@aws-cdk/aws-iam');
23
import cdk = require('@aws-cdk/cdk');
34
import { RepositoryRef } from './repository';
45

@@ -63,7 +64,7 @@ export class PipelineSourceAction extends codepipeline.SourceAction {
6364
'codecommit:CancelUploadArchive',
6465
];
6566

66-
props.stage.pipelineRole.addToPolicy(new cdk.PolicyStatement()
67+
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
6768
.addResource(props.repository.repositoryArn)
6869
.addActions(...actions));
6970
}

Diff for: ‎packages/@aws-cdk/aws-codedeploy/lib/deployment-group.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
import autoscaling = require("@aws-cdk/aws-autoscaling");
22
import codedeploylb = require("@aws-cdk/aws-codedeploy-api");
33
import ec2 = require("@aws-cdk/aws-ec2");
4+
import iam = require('@aws-cdk/aws-iam');
45
import s3 = require("@aws-cdk/aws-s3");
56
import cdk = require("@aws-cdk/cdk");
6-
import iam = require("../../aws-iam/lib/role");
77
import { ServerApplication, ServerApplicationRef } from "./application";
88
import { cloudformation } from './codedeploy.generated';
99
import { IServerDeploymentConfig, ServerDeploymentConfig } from "./deployment-config";
@@ -174,7 +174,7 @@ export class ServerDeploymentGroup extends ServerDeploymentGroupRef {
174174
this.application = props.application || new ServerApplication(this, 'Application');
175175

176176
this.role = props.role || new iam.Role(this, 'Role', {
177-
assumedBy: new cdk.ServicePrincipal('codedeploy.amazonaws.com'),
177+
assumedBy: new iam.ServicePrincipal('codedeploy.amazonaws.com'),
178178
managedPolicyArns: ['arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole'],
179179
});
180180

Diff for: ‎packages/@aws-cdk/aws-codedeploy/lib/pipeline-action.ts

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import actions = require('@aws-cdk/aws-codepipeline-api');
2+
import iam = require('@aws-cdk/aws-iam');
23
import cdk = require('@aws-cdk/cdk');
34

45
/**
@@ -49,7 +50,7 @@ export class PipelineDeployAction extends actions.DeployAction {
4950
resourceName: props.applicationName,
5051
sep: ':',
5152
});
52-
props.stage.pipelineRole.addToPolicy(new cdk.PolicyStatement()
53+
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
5354
.addResource(applicationArn)
5455
.addActions(
5556
'codedeploy:GetApplicationRevision',
@@ -62,7 +63,7 @@ export class PipelineDeployAction extends actions.DeployAction {
6263
resourceName: `${props.applicationName}/${props.deploymentGroupName}`,
6364
sep: ':',
6465
});
65-
props.stage.pipelineRole.addToPolicy(new cdk.PolicyStatement()
66+
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
6667
.addResource(deploymentGroupArn)
6768
.addActions(
6869
'codedeploy:CreateDeployment',
@@ -75,7 +76,7 @@ export class PipelineDeployAction extends actions.DeployAction {
7576
resourceName: '*',
7677
sep: ':',
7778
});
78-
props.stage.pipelineRole.addToPolicy(new cdk.PolicyStatement()
79+
props.stage.pipelineRole.addToPolicy(new iam.PolicyStatement()
7980
.addResource(deployConfigArn)
8081
.addActions(
8182
'codedeploy:GetDeploymentConfig',

Diff for: ‎packages/@aws-cdk/aws-codedeploy/package.json

+1
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@
6363
},
6464
"dependencies": {
6565
"@aws-cdk/aws-autoscaling": "^0.10.0",
66+
"@aws-cdk/aws-iam": "^0.10.0",
6667
"@aws-cdk/aws-codedeploy-api": "^0.10.0",
6768
"@aws-cdk/aws-codepipeline-api": "^0.10.0",
6869
"@aws-cdk/aws-s3": "^0.10.0",

0 commit comments

Comments
 (0)