diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.292870ae2617f1c4d62ff18422e009afd534a342c17877fd1b931fb8d8a62abc.zip b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.292870ae2617f1c4d62ff18422e009afd534a342c17877fd1b931fb8d8a62abc.zip new file mode 100644 index 0000000000000..e6cb898734b43 Binary files /dev/null and b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.292870ae2617f1c4d62ff18422e009afd534a342c17877fd1b931fb8d8a62abc.zip differ diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.6412a5f4524c6b41d26fbeee226c68c2dad735393940a51008d77e6f8b1038f5.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.6412a5f4524c6b41d26fbeee226c68c2dad735393940a51008d77e6f8b1038f5.json new file mode 100644 index 0000000000000..9785ab36f253f --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.6412a5f4524c6b41d26fbeee226c68c2dad735393940a51008d77e6f8b1038f5.json @@ -0,0 +1,98 @@ +{ + "AWSTemplateFormatVersion" : "2010-09-09", + + "Description" : "AWS Service Catalog sample template. Creates an Amazon EC2 instance running the Amazon Linux AMI. The AMI is chosen based on the region in which the stack is run. This example creates an EC2 security group for the instance to give you SSH access. **WARNING** This template creates an Amazon EC2 instance. You will be billed for the AWS resources used if you create a stack from this template.", + + "Parameters" : { + "KeyName": { + "Description" : "Name of an existing EC2 key pair for SSH access to the EC2 instance.", + "Type": "AWS::EC2::KeyPair::KeyName" + }, + + "InstanceType" : { + "Description" : "EC2 instance type.", + "Type" : "String", + "Default" : "t2.micro", + "AllowedValues" : [ "t2.micro", "t2.small", "t2.medium"] + }, + + "SSHLocation" : { + "Description" : "The IP address range that can SSH to the EC2 instance.", + "Type": "String", + "MinLength": "9", + "MaxLength": "18", + "Default": "0.0.0.0/0", + "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})", + "ConstraintDescription": "Must be a valid IP CIDR range of the form x.x.x.x/x." + } + }, + + "Metadata" : { + "AWS::CloudFormation::Interface" : { + "ParameterGroups" : [{ + "Label" : {"default": "Instance configuration"}, + "Parameters" : ["InstanceType"] + },{ + "Label" : {"default": "Security configuration"}, + "Parameters" : ["KeyName", "SSHLocation"] + }], + "ParameterLabels" : { + "InstanceType": {"default": "Server size:"}, + "KeyName": {"default": "Key pair:"}, + "SSHLocation": {"default": "CIDR range:"} + } + } + }, + + "Mappings" : { + "AWSRegionArch2AMI" : { + "us-east-1" : { "HVM64" : "ami-08842d60" }, + "us-west-2" : { "HVM64" : "ami-8786c6b7" }, + "us-west-1" : { "HVM64" : "ami-cfa8a18a" }, + "eu-west-1" : { "HVM64" : "ami-748e2903" }, + "ap-southeast-1" : { "HVM64" : "ami-d6e1c584" }, + "ap-northeast-1" : { "HVM64" : "ami-35072834" }, + "ap-southeast-2" : { "HVM64" : "ami-fd4724c7" }, + "sa-east-1" : { "HVM64" : "ami-956cc688" }, + "cn-north-1" : { "HVM64" : "ami-ac57c595" }, + "eu-central-1" : { "HVM64" : "ami-b43503a9" } + } + + }, + + "Resources" : { + "EC2Instance" : { + "Type" : "AWS::EC2::Instance", + "Properties" : { + "InstanceType" : { "Ref" : "InstanceType" }, + "SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ], + "KeyName" : { "Ref" : "KeyName" }, + "ImageId" : { "Fn::FindInMap" : [ "AWSRegionArch2AMI", { "Ref" : "AWS::Region" }, "HVM64" ] } + } + }, + + "InstanceSecurityGroup" : { + "Type" : "AWS::EC2::SecurityGroup", + "Properties" : { + "GroupDescription" : "Enable SSH access via port 22", + "SecurityGroupIngress" : [ { + "IpProtocol" : "tcp", + "FromPort" : "22", + "ToPort" : "22", + "CidrIp" : { "Ref" : "SSHLocation"} + } ] + } + } + }, + + "Outputs" : { + "PublicDNSName" : { + "Description" : "Public DNS name of the new EC2 instance", + "Value" : { "Fn::GetAtt" : [ "EC2Instance", "PublicDnsName" ] } + }, + "PublicIPAddress" : { + "Description" : "Public IP address of the new EC2 instance", + "Value" : { "Fn::GetAtt" : [ "EC2Instance", "PublicIp" ] } + } + } +} diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.89c643a8a6c919d906e0b1cb079b0c5e131cf3cc19c05126f90fc118647fb08c/index.js b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.89c643a8a6c919d906e0b1cb079b0c5e131cf3cc19c05126f90fc118647fb08c/index.js new file mode 100644 index 0000000000000..b9e3b71c939ea --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.89c643a8a6c919d906e0b1cb079b0c5e131cf3cc19c05126f90fc118647fb08c/index.js @@ -0,0 +1,2 @@ +"use strict";var C=Object.create;var c=Object.defineProperty;var f=Object.getOwnPropertyDescriptor;var w=Object.getOwnPropertyNames;var A=Object.getPrototypeOf,P=Object.prototype.hasOwnProperty;var L=(t,e)=>{for(var s in e)c(t,s,{get:e[s],enumerable:!0})},d=(t,e,s,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of w(e))!P.call(t,o)&&o!==s&&c(t,o,{get:()=>e[o],enumerable:!(r=f(e,o))||r.enumerable});return t};var l=(t,e,s)=>(s=t!=null?C(A(t)):{},d(e||!t||!t.__esModule?c(s,"default",{value:t,enumerable:!0}):s,t)),k=t=>d(c({},"__esModule",{value:!0}),t);var _={};L(_,{autoDeleteHandler:()=>g,handler:()=>O});module.exports=k(_);var h=require("@aws-sdk/client-s3");var m=l(require("https")),R=l(require("url")),a={sendHttpRequest:T,log:B,includeStackTraces:!0,userHandlerIndex:"./index"},p="AWSCDK::CustomResourceProviderFramework::CREATE_FAILED",D="AWSCDK::CustomResourceProviderFramework::MISSING_PHYSICAL_ID";function y(t){return async(e,s)=>{let r={...e,ResponseURL:"..."};if(a.log(JSON.stringify(r,void 0,2)),e.RequestType==="Delete"&&e.PhysicalResourceId===p){a.log("ignoring DELETE event caused by a failed CREATE event"),await i("SUCCESS",e);return}try{let o=await t(r,s),n=b(e,o);await i("SUCCESS",n)}catch(o){let n={...e,Reason:a.includeStackTraces?o.stack:o.message};n.PhysicalResourceId||(e.RequestType==="Create"?(a.log("CREATE failed, responding with a marker physical resource id so that the subsequent DELETE will be ignored"),n.PhysicalResourceId=p):a.log(`ERROR: Malformed event. "PhysicalResourceId" is required: ${JSON.stringify(e)}`)),await i("FAILED",n)}}}function b(t,e={}){let s=e.PhysicalResourceId??t.PhysicalResourceId??t.RequestId;if(t.RequestType==="Delete"&&s!==t.PhysicalResourceId)throw new Error(`DELETE: cannot change the physical resource ID from "${t.PhysicalResourceId}" to "${e.PhysicalResourceId}" during deletion`);return{...t,...e,PhysicalResourceId:s}}async function i(t,e){let s={Status:t,Reason:e.Reason??t,StackId:e.StackId,RequestId:e.RequestId,PhysicalResourceId:e.PhysicalResourceId||D,LogicalResourceId:e.LogicalResourceId,NoEcho:e.NoEcho,Data:e.Data};a.log("submit response to cloudformation",s);let r=JSON.stringify(s),o=R.parse(e.ResponseURL),n={hostname:o.hostname,path:o.path,method:"PUT",headers:{"content-type":"","content-length":Buffer.byteLength(r,"utf8")}};await x({attempts:5,sleep:1e3},a.sendHttpRequest)(n,r)}async function T(t,e){return new Promise((s,r)=>{try{let o=m.request(t,n=>s());o.on("error",r),o.write(e),o.end()}catch(o){r(o)}})}function B(t,...e){console.log(t,...e)}function x(t,e){return async(...s)=>{let r=t.attempts,o=t.sleep;for(;;)try{return await e(...s)}catch(n){if(r--<=0)throw n;await H(Math.floor(Math.random()*o)),o*=2}}}async function H(t){return new Promise(e=>setTimeout(e,t))}var E="aws-cdk:auto-delete-objects",u=new h.S3({}),O=y(g);async function g(t){switch(t.RequestType){case"Create":return;case"Update":return F(t);case"Delete":return S(t.ResourceProperties?.BucketName)}}async function F(t){let e=t,s=e.OldResourceProperties?.BucketName,r=e.ResourceProperties?.BucketName;if(r!=null&&s!=null&&r!==s)return S(s)}async function I(t){let e=await u.listObjectVersions({Bucket:t}),s=[...e.Versions??[],...e.DeleteMarkers??[]];if(s.length===0)return;let r=s.map(o=>({Key:o.Key,VersionId:o.VersionId}));await u.deleteObjects({Bucket:t,Delete:{Objects:r}}),e?.IsTruncated&&await I(t)}async function S(t){if(!t)throw new Error("No BucketName was provided.");if(!await N(t)){process.stdout.write(`Bucket does not have '${E}' tag, skipping cleaning. +`);return}try{await I(t)}catch(e){if(e.code!=="NoSuchBucket")throw e}}async function N(t){return(await u.getBucketTagging({Bucket:t})).TagSet?.some(s=>s.Key===E&&s.Value==="true")}0&&(module.exports={autoDeleteHandler,handler}); diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd/index.py b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd/index.py new file mode 100644 index 0000000000000..95c458826a0b0 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd/index.py @@ -0,0 +1,319 @@ +import contextlib +import json +import logging +import os +import shutil +import subprocess +import tempfile +from urllib.request import Request, urlopen +from uuid import uuid4 +from zipfile import ZipFile + +import boto3 + +logger = logging.getLogger() +logger.setLevel(logging.INFO) + +cloudfront = boto3.client('cloudfront') +s3 = boto3.client('s3') + +CFN_SUCCESS = "SUCCESS" +CFN_FAILED = "FAILED" +ENV_KEY_MOUNT_PATH = "MOUNT_PATH" +ENV_KEY_SKIP_CLEANUP = "SKIP_CLEANUP" + +AWS_CLI_CONFIG_FILE = "/tmp/aws_cli_config" +CUSTOM_RESOURCE_OWNER_TAG = "aws-cdk:cr-owned" + +os.putenv('AWS_CONFIG_FILE', AWS_CLI_CONFIG_FILE) + +def handler(event, context): + + def cfn_error(message=None): + logger.error("| cfn_error: %s" % message) + cfn_send(event, context, CFN_FAILED, reason=message, physicalResourceId=event.get('PhysicalResourceId', None)) + + + try: + # We are not logging ResponseURL as this is a pre-signed S3 URL, and could be used to tamper + # with the response CloudFormation sees from this Custom Resource execution. + logger.info({ key:value for (key, value) in event.items() if key != 'ResponseURL'}) + + # cloudformation request type (create/update/delete) + request_type = event['RequestType'] + + # extract resource properties + props = event['ResourceProperties'] + old_props = event.get('OldResourceProperties', {}) + physical_id = event.get('PhysicalResourceId', None) + + try: + source_bucket_names = props['SourceBucketNames'] + source_object_keys = props['SourceObjectKeys'] + source_markers = props.get('SourceMarkers', None) + dest_bucket_name = props['DestinationBucketName'] + dest_bucket_prefix = props.get('DestinationBucketKeyPrefix', '') + extract = props.get('Extract', 'true') == 'true' + retain_on_delete = props.get('RetainOnDelete', "true") == "true" + distribution_id = props.get('DistributionId', '') + user_metadata = props.get('UserMetadata', {}) + system_metadata = props.get('SystemMetadata', {}) + prune = props.get('Prune', 'true').lower() == 'true' + exclude = props.get('Exclude', []) + include = props.get('Include', []) + sign_content = props.get('SignContent', 'false').lower() == 'true' + + # backwards compatibility - if "SourceMarkers" is not specified, + # assume all sources have an empty market map + if source_markers is None: + source_markers = [{} for i in range(len(source_bucket_names))] + + default_distribution_path = dest_bucket_prefix + if not default_distribution_path.endswith("/"): + default_distribution_path += "/" + if not default_distribution_path.startswith("/"): + default_distribution_path = "/" + default_distribution_path + default_distribution_path += "*" + + distribution_paths = props.get('DistributionPaths', [default_distribution_path]) + except KeyError as e: + cfn_error("missing request resource property %s. props: %s" % (str(e), props)) + return + + # configure aws cli options after resetting back to the defaults for each request + if os.path.exists(AWS_CLI_CONFIG_FILE): + os.remove(AWS_CLI_CONFIG_FILE) + if sign_content: + aws_command("configure", "set", "default.s3.payload_signing_enabled", "true") + + # treat "/" as if no prefix was specified + if dest_bucket_prefix == "/": + dest_bucket_prefix = "" + + s3_source_zips = list(map(lambda name, key: "s3://%s/%s" % (name, key), source_bucket_names, source_object_keys)) + s3_dest = "s3://%s/%s" % (dest_bucket_name, dest_bucket_prefix) + old_s3_dest = "s3://%s/%s" % (old_props.get("DestinationBucketName", ""), old_props.get("DestinationBucketKeyPrefix", "")) + + + # obviously this is not + if old_s3_dest == "s3:///": + old_s3_dest = None + + logger.info("| s3_dest: %s" % s3_dest) + logger.info("| old_s3_dest: %s" % old_s3_dest) + + # if we are creating a new resource, allocate a physical id for it + # otherwise, we expect physical id to be relayed by cloudformation + if request_type == "Create": + physical_id = "aws.cdk.s3deployment.%s" % str(uuid4()) + else: + if not physical_id: + cfn_error("invalid request: request type is '%s' but 'PhysicalResourceId' is not defined" % request_type) + return + + # delete or create/update (only if "retain_on_delete" is false) + if request_type == "Delete" and not retain_on_delete: + if not bucket_owned(dest_bucket_name, dest_bucket_prefix): + aws_command("s3", "rm", s3_dest, "--recursive") + + # if we are updating without retention and the destination changed, delete first + if request_type == "Update" and not retain_on_delete and old_s3_dest != s3_dest: + if not old_s3_dest: + logger.warn("cannot delete old resource without old resource properties") + return + + aws_command("s3", "rm", old_s3_dest, "--recursive") + + if request_type == "Update" or request_type == "Create": + s3_deploy(s3_source_zips, s3_dest, user_metadata, system_metadata, prune, exclude, include, source_markers, extract) + + if distribution_id: + cloudfront_invalidate(distribution_id, distribution_paths) + + cfn_send(event, context, CFN_SUCCESS, physicalResourceId=physical_id, responseData={ + # Passing through the ARN sequences dependencees on the deployment + 'DestinationBucketArn': props.get('DestinationBucketArn'), + 'SourceObjectKeys': props.get('SourceObjectKeys'), + }) + except KeyError as e: + cfn_error("invalid request. Missing key %s" % str(e)) + except Exception as e: + logger.exception(e) + cfn_error(str(e)) + +#--------------------------------------------------------------------------------------------------- +# populate all files from s3_source_zips to a destination bucket +def s3_deploy(s3_source_zips, s3_dest, user_metadata, system_metadata, prune, exclude, include, source_markers, extract): + # list lengths are equal + if len(s3_source_zips) != len(source_markers): + raise Exception("'source_markers' and 's3_source_zips' must be the same length") + + # create a temporary working directory in /tmp or if enabled an attached efs volume + if ENV_KEY_MOUNT_PATH in os.environ: + workdir = os.getenv(ENV_KEY_MOUNT_PATH) + "/" + str(uuid4()) + os.mkdir(workdir) + else: + workdir = tempfile.mkdtemp() + + logger.info("| workdir: %s" % workdir) + + # create a directory into which we extract the contents of the zip file + contents_dir=os.path.join(workdir, 'contents') + os.mkdir(contents_dir) + + try: + # download the archive from the source and extract to "contents" + for i in range(len(s3_source_zips)): + s3_source_zip = s3_source_zips[i] + markers = source_markers[i] + + if extract: + archive=os.path.join(workdir, str(uuid4())) + logger.info("archive: %s" % archive) + aws_command("s3", "cp", s3_source_zip, archive) + logger.info("| extracting archive to: %s\n" % contents_dir) + logger.info("| markers: %s" % markers) + extract_and_replace_markers(archive, contents_dir, markers) + else: + logger.info("| copying archive to: %s\n" % contents_dir) + aws_command("s3", "cp", s3_source_zip, contents_dir) + + # sync from "contents" to destination + + s3_command = ["s3", "sync"] + + if prune: + s3_command.append("--delete") + + if exclude: + for filter in exclude: + s3_command.extend(["--exclude", filter]) + + if include: + for filter in include: + s3_command.extend(["--include", filter]) + + s3_command.extend([contents_dir, s3_dest]) + s3_command.extend(create_metadata_args(user_metadata, system_metadata)) + aws_command(*s3_command) + finally: + if not os.getenv(ENV_KEY_SKIP_CLEANUP): + shutil.rmtree(workdir) + +#--------------------------------------------------------------------------------------------------- +# invalidate files in the CloudFront distribution edge caches +def cloudfront_invalidate(distribution_id, distribution_paths): + invalidation_resp = cloudfront.create_invalidation( + DistributionId=distribution_id, + InvalidationBatch={ + 'Paths': { + 'Quantity': len(distribution_paths), + 'Items': distribution_paths + }, + 'CallerReference': str(uuid4()), + }) + # by default, will wait up to 10 minutes + cloudfront.get_waiter('invalidation_completed').wait( + DistributionId=distribution_id, + Id=invalidation_resp['Invalidation']['Id']) + +#--------------------------------------------------------------------------------------------------- +# set metadata +def create_metadata_args(raw_user_metadata, raw_system_metadata): + if len(raw_user_metadata) == 0 and len(raw_system_metadata) == 0: + return [] + + format_system_metadata_key = lambda k: k.lower() + format_user_metadata_key = lambda k: k.lower() + + system_metadata = { format_system_metadata_key(k): v for k, v in raw_system_metadata.items() } + user_metadata = { format_user_metadata_key(k): v for k, v in raw_user_metadata.items() } + + flatten = lambda l: [item for sublist in l for item in sublist] + system_args = flatten([[f"--{k}", v] for k, v in system_metadata.items()]) + user_args = ["--metadata", json.dumps(user_metadata, separators=(',', ':'))] if len(user_metadata) > 0 else [] + + return system_args + user_args + ["--metadata-directive", "REPLACE"] + +#--------------------------------------------------------------------------------------------------- +# executes an "aws" cli command +def aws_command(*args): + aws="/opt/awscli/aws" # from AwsCliLayer + logger.info("| aws %s" % ' '.join(args)) + subprocess.check_call([aws] + list(args)) + +#--------------------------------------------------------------------------------------------------- +# sends a response to cloudformation +def cfn_send(event, context, responseStatus, responseData={}, physicalResourceId=None, noEcho=False, reason=None): + + responseUrl = event['ResponseURL'] + + responseBody = {} + responseBody['Status'] = responseStatus + responseBody['Reason'] = reason or ('See the details in CloudWatch Log Stream: ' + context.log_stream_name) + responseBody['PhysicalResourceId'] = physicalResourceId or context.log_stream_name + responseBody['StackId'] = event['StackId'] + responseBody['RequestId'] = event['RequestId'] + responseBody['LogicalResourceId'] = event['LogicalResourceId'] + responseBody['NoEcho'] = noEcho + responseBody['Data'] = responseData + + body = json.dumps(responseBody) + logger.info("| response body:\n" + body) + + headers = { + 'content-type' : '', + 'content-length' : str(len(body)) + } + + try: + request = Request(responseUrl, method='PUT', data=bytes(body.encode('utf-8')), headers=headers) + with contextlib.closing(urlopen(request)) as response: + logger.info("| status code: " + response.reason) + except Exception as e: + logger.error("| unable to send response to CloudFormation") + logger.exception(e) + + +#--------------------------------------------------------------------------------------------------- +# check if bucket is owned by a custom resource +# if it is then we don't want to delete content +def bucket_owned(bucketName, keyPrefix): + tag = CUSTOM_RESOURCE_OWNER_TAG + if keyPrefix != "": + tag = tag + ':' + keyPrefix + try: + request = s3.get_bucket_tagging( + Bucket=bucketName, + ) + return any((x["Key"].startswith(tag)) for x in request["TagSet"]) + except Exception as e: + logger.info("| error getting tags from bucket") + logger.exception(e) + return False + +# extract archive and replace markers in output files +def extract_and_replace_markers(archive, contents_dir, markers): + with ZipFile(archive, "r") as zip: + zip.extractall(contents_dir) + + # replace markers for this source + for file in zip.namelist(): + file_path = os.path.join(contents_dir, file) + if os.path.isdir(file_path): continue + replace_markers(file_path, markers) + +def replace_markers(filename, markers): + # convert the dict of string markers to binary markers + replace_tokens = dict([(k.encode('utf-8'), v.encode('utf-8')) for k, v in markers.items()]) + + outfile = filename + '.new' + with open(filename, 'rb') as fi, open(outfile, 'wb') as fo: + for line in fi: + for token in replace_tokens: + line = line.replace(token, replace_tokens[token]) + fo.write(line) + + # # delete the original file and rename the new one to the original + os.remove(filename) + os.rename(outfile, filename) diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.b59f768286e16b69628bb23b9c1a1f07300a24101b8979d8e2a94ff1ab03d09e.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.b59f768286e16b69628bb23b9c1a1f07300a24101b8979d8e2a94ff1ab03d09e.json new file mode 100644 index 0000000000000..69c3138be93f4 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.b59f768286e16b69628bb23b9c1a1f07300a24101b8979d8e2a94ff1ab03d09e.json @@ -0,0 +1,98 @@ +{ + "AWSTemplateFormatVersion" : "2010-09-09", + + "Description" : "AWS Service Catalog sample template. Creates an Amazon EC2 instance running the Amazon Linux AMI. The AMI is chosen based on the region in which the stack is run. This example creates an EC2 security group for the instance to give you SSH access. **WARNING** This template creates an Amazon EC2 instance. You will be billed for the AWS resources used if you create a stack from this template.", + + "Parameters" : { + "KeyName": { + "Description" : "Name of an existing EC2 key pair for SSH access to the EC2 instance.", + "Type": "AWS::EC2::KeyPair::KeyName" + }, + + "InstanceType" : { + "Description" : "EC2 instance type.", + "Type" : "String", + "Default" : "t2.micro", + "AllowedValues" : [ "t2.micro", "t2.small", "t2.medium", "m3.medium", "m3.large", "m3.xlarge", "m3.2xlarge" ] + }, + + "SSHLocation" : { + "Description" : "The IP address range that can SSH to the EC2 instance.", + "Type": "String", + "MinLength": "9", + "MaxLength": "18", + "Default": "0.0.0.0/0", + "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})", + "ConstraintDescription": "Must be a valid IP CIDR range of the form x.x.x.x/x." + } + }, + + "Metadata" : { + "AWS::CloudFormation::Interface" : { + "ParameterGroups" : [{ + "Label" : {"default": "Instance configuration"}, + "Parameters" : ["InstanceType"] + },{ + "Label" : {"default": "Security configuration"}, + "Parameters" : ["KeyName", "SSHLocation"] + }], + "ParameterLabels" : { + "InstanceType": {"default": "Server size:"}, + "KeyName": {"default": "Key pair:"}, + "SSHLocation": {"default": "CIDR range:"} + } + } + }, + + "Mappings" : { + "AWSRegionArch2AMI" : { + "us-east-1" : { "HVM64" : "ami-08842d60" }, + "us-west-2" : { "HVM64" : "ami-8786c6b7" }, + "us-west-1" : { "HVM64" : "ami-cfa8a18a" }, + "eu-west-1" : { "HVM64" : "ami-748e2903" }, + "ap-southeast-1" : { "HVM64" : "ami-d6e1c584" }, + "ap-northeast-1" : { "HVM64" : "ami-35072834" }, + "ap-southeast-2" : { "HVM64" : "ami-fd4724c7" }, + "sa-east-1" : { "HVM64" : "ami-956cc688" }, + "cn-north-1" : { "HVM64" : "ami-ac57c595" }, + "eu-central-1" : { "HVM64" : "ami-b43503a9" } + } + + }, + + "Resources" : { + "EC2Instance" : { + "Type" : "AWS::EC2::Instance", + "Properties" : { + "InstanceType" : { "Ref" : "InstanceType" }, + "SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ], + "KeyName" : { "Ref" : "KeyName" }, + "ImageId" : { "Fn::FindInMap" : [ "AWSRegionArch2AMI", { "Ref" : "AWS::Region" }, "HVM64" ] } + } + }, + + "InstanceSecurityGroup" : { + "Type" : "AWS::EC2::SecurityGroup", + "Properties" : { + "GroupDescription" : "Enable SSH access via port 22", + "SecurityGroupIngress" : [ { + "IpProtocol" : "tcp", + "FromPort" : "22", + "ToPort" : "22", + "CidrIp" : { "Ref" : "SSHLocation"} + } ] + } + } + }, + + "Outputs" : { + "PublicDNSName" : { + "Description" : "Public DNS name of the new EC2 instance", + "Value" : { "Fn::GetAtt" : [ "EC2Instance", "PublicDnsName" ] } + }, + "PublicIPAddress" : { + "Description" : "Public IP address of the new EC2 instance", + "Value" : { "Fn::GetAtt" : [ "EC2Instance", "PublicIp" ] } + } + } +} diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2/index.py b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2/index.py new file mode 100644 index 0000000000000..105bdadc3c1a8 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2/index.py @@ -0,0 +1,7 @@ +import json + +def handler(event, context): + return { + 'statusCode': 200, + 'body': json.dumps('Hello from Lambda!') + } \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2/index.py b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2/index.py new file mode 100644 index 0000000000000..105bdadc3c1a8 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2/index.py @@ -0,0 +1,7 @@ +import json + +def handler(event, context): + return { + 'statusCode': 200, + 'body': json.dumps('Hello from Lambda!') + } \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d/index.py b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d/index.py new file mode 100644 index 0000000000000..059c625350f79 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d/index.py @@ -0,0 +1,7 @@ +import json + +def handler(event, context): + return { + 'statusCode': 200, + 'body': json.dumps('Hello from Lambda again!') + } \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d/index.py b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d/index.py new file mode 100644 index 0000000000000..059c625350f79 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/asset.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d/index.py @@ -0,0 +1,7 @@ +import json + +def handler(event, context): + return { + 'statusCode': 200, + 'body': json.dumps('Hello from Lambda again!') + } \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/cdk.out b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/cdk.out new file mode 100644 index 0000000000000..f0b901e7c06e5 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/cdk.out @@ -0,0 +1 @@ +{"version":"32.0.0"} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integ-servicecatalog-product-encrypted-asset.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integ-servicecatalog-product-encrypted-asset.assets.json new file mode 100644 index 0000000000000..e8d8993acf730 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integ-servicecatalog-product-encrypted-asset.assets.json @@ -0,0 +1,146 @@ +{ + "version": "32.0.0", + "files": { + "89c643a8a6c919d906e0b1cb079b0c5e131cf3cc19c05126f90fc118647fb08c": { + "source": { + "path": "asset.89c643a8a6c919d906e0b1cb079b0c5e131cf3cc19c05126f90fc118647fb08c", + "packaging": "zip" + }, + "destinations": { + "12345678-test-region": { + "bucketName": "cdk-hnb659fds-assets-12345678-test-region", + "objectKey": "89c643a8a6c919d906e0b1cb079b0c5e131cf3cc19c05126f90fc118647fb08c.zip", + "region": "test-region", + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region" + } + } + }, + "292870ae2617f1c4d62ff18422e009afd534a342c17877fd1b931fb8d8a62abc": { + "source": { + "path": "asset.292870ae2617f1c4d62ff18422e009afd534a342c17877fd1b931fb8d8a62abc.zip", + "packaging": "file" + }, + "destinations": { + "12345678-test-region": { + "bucketName": "cdk-hnb659fds-assets-12345678-test-region", + "objectKey": "292870ae2617f1c4d62ff18422e009afd534a342c17877fd1b931fb8d8a62abc.zip", + "region": "test-region", + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region" + } + } + }, + "9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd": { + "source": { + "path": "asset.9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd", + "packaging": "zip" + }, + "destinations": { + "12345678-test-region": { + "bucketName": "cdk-hnb659fds-assets-12345678-test-region", + "objectKey": "9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd.zip", + "region": "test-region", + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region" + } + } + }, + "d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2": { + "source": { + "path": "asset.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2.d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2", + "packaging": "zip" + }, + "destinations": { + "12345678-test-region": { + "bucketName": "cdk-hnb659fds-assets-12345678-test-region", + "objectKey": "d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2.zip", + "region": "test-region", + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region" + } + } + }, + "e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d": { + "source": { + "path": "asset.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d.e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d", + "packaging": "zip" + }, + "destinations": { + "12345678-test-region": { + "bucketName": "cdk-hnb659fds-assets-12345678-test-region", + "objectKey": "e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d.zip", + "region": "test-region", + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region" + } + } + }, + "b59f768286e16b69628bb23b9c1a1f07300a24101b8979d8e2a94ff1ab03d09e": { + "source": { + "path": "asset.b59f768286e16b69628bb23b9c1a1f07300a24101b8979d8e2a94ff1ab03d09e.json", + "packaging": "file" + }, + "destinations": { + "12345678-test-region": { + "bucketName": "cdk-hnb659fds-assets-12345678-test-region", + "objectKey": "b59f768286e16b69628bb23b9c1a1f07300a24101b8979d8e2a94ff1ab03d09e.json", + "region": "test-region", + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region" + } + } + }, + "6412a5f4524c6b41d26fbeee226c68c2dad735393940a51008d77e6f8b1038f5": { + "source": { + "path": "asset.6412a5f4524c6b41d26fbeee226c68c2dad735393940a51008d77e6f8b1038f5.json", + "packaging": "file" + }, + "destinations": { + "12345678-test-region": { + "bucketName": "cdk-hnb659fds-assets-12345678-test-region", + "objectKey": "6412a5f4524c6b41d26fbeee226c68c2dad735393940a51008d77e6f8b1038f5.json", + "region": "test-region", + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region" + } + } + }, + "dd2d087eeb6ede1d2a9166639ccbde7bd1b10eef9ba2b4cb3d9855faa4fe8c1f": { + "source": { + "path": "integservicecatalogproductencryptedassetSNSTopicProduct3DB08679D.product.template.json", + "packaging": "file" + }, + "destinations": { + "12345678-test-region": { + "bucketName": "cdk-hnb659fds-assets-12345678-test-region", + "objectKey": "dd2d087eeb6ede1d2a9166639ccbde7bd1b10eef9ba2b4cb3d9855faa4fe8c1f.json", + "region": "test-region", + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region" + } + } + }, + "c6a724b9f87d5f730d400d518f32edba51cf14c851d05c5eea07a9170b9e510a": { + "source": { + "path": "integservicecatalogproductencryptedassetS3AssetProductF5835286.product.template.json", + "packaging": "file" + }, + "destinations": { + "12345678-test-region": { + "bucketName": "cdk-hnb659fds-assets-12345678-test-region", + "objectKey": "c6a724b9f87d5f730d400d518f32edba51cf14c851d05c5eea07a9170b9e510a.json", + "region": "test-region", + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region" + } + } + }, + "fbc5053e654cbff7f9f9e2dcc93822650d3c4575a353996389f09725526668bd": { + "source": { + "path": "integ-servicecatalog-product-encrypted-asset.template.json", + "packaging": "file" + }, + "destinations": { + "12345678-test-region": { + "bucketName": "cdk-hnb659fds-assets-12345678-test-region", + "objectKey": "fbc5053e654cbff7f9f9e2dcc93822650d3c4575a353996389f09725526668bd.json", + "region": "test-region", + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region" + } + } + } + }, + "dockerImages": {} +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integ-servicecatalog-product-encrypted-asset.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integ-servicecatalog-product-encrypted-asset.template.json new file mode 100644 index 0000000000000..90b3d81a4a1ee --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integ-servicecatalog-product-encrypted-asset.template.json @@ -0,0 +1,620 @@ +{ + "Resources": { + "TestPortfolio4AC794EB": { + "Type": "AWS::ServiceCatalog::Portfolio", + "Properties": { + "DisplayName": "TestPortfolio", + "ProviderName": "TestProvider", + "AcceptLanguage": "en", + "Description": "This is our Service Catalog Portfolio" + } + }, + "TestPortfolioPortfolioProductAssociation1f17ee66e93a16195E73": { + "Type": "AWS::ServiceCatalog::PortfolioProductAssociation", + "Properties": { + "PortfolioId": { + "Ref": "TestPortfolio4AC794EB" + }, + "ProductId": { + "Ref": "TestProduct7606930B" + } + } + }, + "KmsKey46693ADD": { + "Type": "AWS::KMS::Key", + "Properties": { + "KeyPolicy": { + "Statement": [ + { + "Action": "kms:*", + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::12345678:root" + ] + ] + } + }, + "Resource": "*" + } + ], + "Version": "2012-10-17" + }, + "Description": "Kms key for asset bucket" + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain" + }, + "TestAssetBucket9434EFAE": { + "Type": "AWS::S3::Bucket", + "Properties": { + "BucketEncryption": { + "ServerSideEncryptionConfiguration": [ + { + "BucketKeyEnabled": true, + "ServerSideEncryptionByDefault": { + "KMSMasterKeyID": { + "Fn::GetAtt": [ + "KmsKey46693ADD", + "Arn" + ] + }, + "SSEAlgorithm": "aws:kms" + } + } + ] + }, + "BucketName": "product-stack-asset-bucket-12345678-test-region", + "Tags": [ + { + "Key": "aws-cdk:auto-delete-objects", + "Value": "true" + }, + { + "Key": "aws-cdk:cr-owned:173c1279", + "Value": "true" + } + ] + }, + "UpdateReplacePolicy": "Delete", + "DeletionPolicy": "Delete" + }, + "TestAssetBucketPolicy62167ACB": { + "Type": "AWS::S3::BucketPolicy", + "Properties": { + "Bucket": { + "Ref": "TestAssetBucket9434EFAE" + }, + "PolicyDocument": { + "Statement": [ + { + "Action": "s3:*", + "Condition": { + "Bool": { + "aws:SecureTransport": "false" + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + "/*" + ] + ] + } + ] + }, + { + "Action": [ + "s3:DeleteObject*", + "s3:GetBucket*", + "s3:List*" + ], + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::GetAtt": [ + "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", + "Arn" + ] + } + }, + "Resource": [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + "/*" + ] + ] + } + ] + }, + { + "Action": "s3:PutObject", + "Condition": { + "StringNotEquals": { + "s3:x-amz-server-side-encryption": "aws:kms" + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + "/*" + ] + ] + } + }, + { + "Action": "s3:PutObject", + "Condition": { + "Null": { + "s3:x-amz-server-side-encryption": true + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + "/*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + }, + "TestAssetBucketAutoDeleteObjectsCustomResource5A0F8F22": { + "Type": "Custom::S3AutoDeleteObjects", + "Properties": { + "ServiceToken": { + "Fn::GetAtt": [ + "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F", + "Arn" + ] + }, + "BucketName": { + "Ref": "TestAssetBucket9434EFAE" + } + }, + "DependsOn": [ + "TestAssetBucketPolicy62167ACB" + ], + "UpdateReplacePolicy": "Delete", + "DeletionPolicy": "Delete" + }, + "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ] + }, + "ManagedPolicyArns": [ + { + "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + } + ] + } + }, + "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F": { + "Type": "AWS::Lambda::Function", + "Properties": { + "Code": { + "S3Bucket": "cdk-hnb659fds-assets-12345678-test-region", + "S3Key": "89c643a8a6c919d906e0b1cb079b0c5e131cf3cc19c05126f90fc118647fb08c.zip" + }, + "Timeout": 900, + "MemorySize": 128, + "Handler": "index.handler", + "Role": { + "Fn::GetAtt": [ + "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", + "Arn" + ] + }, + "Runtime": "nodejs18.x", + "Description": { + "Fn::Join": [ + "", + [ + "Lambda function for auto-deleting objects in ", + { + "Ref": "TestAssetBucket9434EFAE" + }, + " S3 bucket." + ] + ] + } + }, + "DependsOn": [ + "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092" + ] + }, + "AssetsBucketDeploymentAwsCliLayer9BCEE17F": { + "Type": "AWS::Lambda::LayerVersion", + "Properties": { + "Content": { + "S3Bucket": "cdk-hnb659fds-assets-12345678-test-region", + "S3Key": "292870ae2617f1c4d62ff18422e009afd534a342c17877fd1b931fb8d8a62abc.zip" + }, + "Description": "/opt/awscli/aws" + } + }, + "AssetsBucketDeploymentCustomResource283760D6": { + "Type": "Custom::CDKBucketDeployment", + "Properties": { + "ServiceToken": { + "Fn::GetAtt": [ + "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C81C01536", + "Arn" + ] + }, + "SourceBucketNames": [ + "cdk-hnb659fds-assets-12345678-test-region", + "cdk-hnb659fds-assets-12345678-test-region" + ], + "SourceObjectKeys": [ + "d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2.zip", + "e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d.zip" + ], + "SourceMarkers": [ + {}, + {} + ], + "DestinationBucketName": { + "Ref": "TestAssetBucket9434EFAE" + }, + "Extract": false, + "Prune": false, + "SystemMetadata": { + "sse": "aws:kms", + "sse-kms-key-id": { + "Ref": "KmsKey46693ADD" + } + } + }, + "UpdateReplacePolicy": "Delete", + "DeletionPolicy": "Delete" + }, + "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + ] + ] + } + ] + } + }, + "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRoleDefaultPolicy88902FDF": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "s3:GetBucket*", + "s3:GetObject*", + "s3:List*" + ], + "Effect": "Allow", + "Resource": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":s3:::cdk-hnb659fds-assets-12345678-test-region" + ] + ] + }, + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":s3:::cdk-hnb659fds-assets-12345678-test-region/*" + ] + ] + } + ] + }, + { + "Action": [ + "s3:Abort*", + "s3:DeleteObject*", + "s3:GetBucket*", + "s3:GetObject*", + "s3:List*", + "s3:PutObject", + "s3:PutObjectLegalHold", + "s3:PutObjectRetention", + "s3:PutObjectTagging", + "s3:PutObjectVersionTagging" + ], + "Effect": "Allow", + "Resource": [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + "/*" + ] + ] + } + ] + }, + { + "Action": [ + "kms:Decrypt", + "kms:DescribeKey", + "kms:Encrypt", + "kms:GenerateDataKey*", + "kms:ReEncrypt*" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "KmsKey46693ADD", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRoleDefaultPolicy88902FDF", + "Roles": [ + { + "Ref": "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265" + } + ] + } + }, + "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C81C01536": { + "Type": "AWS::Lambda::Function", + "Properties": { + "Code": { + "S3Bucket": "cdk-hnb659fds-assets-12345678-test-region", + "S3Key": "9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd.zip" + }, + "Role": { + "Fn::GetAtt": [ + "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265", + "Arn" + ] + }, + "Environment": { + "Variables": { + "AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem" + } + }, + "Handler": "index.handler", + "Layers": [ + { + "Ref": "AssetsBucketDeploymentAwsCliLayer9BCEE17F" + } + ], + "Runtime": "python3.9", + "Timeout": 900 + }, + "DependsOn": [ + "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRoleDefaultPolicy88902FDF", + "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265" + ] + }, + "TestProduct7606930B": { + "Type": "AWS::ServiceCatalog::CloudFormationProduct", + "Properties": { + "Name": "testProduct", + "Owner": "testOwner", + "ProvisioningArtifactParameters": [ + { + "DisableTemplateValidation": true, + "Info": { + "LoadTemplateFromURL": "https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template" + } + }, + { + "DisableTemplateValidation": false, + "Info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/b59f768286e16b69628bb23b9c1a1f07300a24101b8979d8e2a94ff1ab03d09e.json" + } + } + }, + { + "DisableTemplateValidation": false, + "Info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/6412a5f4524c6b41d26fbeee226c68c2dad735393940a51008d77e6f8b1038f5.json" + } + } + }, + { + "DisableTemplateValidation": false, + "Info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/dd2d087eeb6ede1d2a9166639ccbde7bd1b10eef9ba2b4cb3d9855faa4fe8c1f.json" + } + } + }, + { + "DisableTemplateValidation": false, + "Info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/dd2d087eeb6ede1d2a9166639ccbde7bd1b10eef9ba2b4cb3d9855faa4fe8c1f.json" + } + } + }, + { + "DisableTemplateValidation": true, + "Info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/c6a724b9f87d5f730d400d518f32edba51cf14c851d05c5eea07a9170b9e510a.json" + } + }, + "Name": "testAssetProduct" + }, + { + "DisableTemplateValidation": false, + "Info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/dd2d087eeb6ede1d2a9166639ccbde7bd1b10eef9ba2b4cb3d9855faa4fe8c1f.json" + } + }, + "Name": "v1" + } + ] + } + } + }, + "Outputs": { + "PortfolioId": { + "Value": { + "Ref": "TestPortfolio4AC794EB" + } + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]" + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integ.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integ.json new file mode 100644 index 0000000000000..2057962d0bd26 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integ.json @@ -0,0 +1,13 @@ +{ + "enableLookups": true, + "version": "32.0.0", + "testCases": { + "integ-product-encrypted-asset/DefaultTest": { + "stacks": [ + "integ-servicecatalog-product-encrypted-asset" + ], + "assertionStack": "integ-product-encrypted-asset/DefaultTest/DeployAssert", + "assertionStackName": "integproductencryptedassetDefaultTestDeployAssertCD64745E" + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integproductencryptedassetDefaultTestDeployAssertCD64745E.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integproductencryptedassetDefaultTestDeployAssertCD64745E.assets.json new file mode 100644 index 0000000000000..9658105f05d6e --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integproductencryptedassetDefaultTestDeployAssertCD64745E.assets.json @@ -0,0 +1,19 @@ +{ + "version": "32.0.0", + "files": { + "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": { + "source": { + "path": "integproductencryptedassetDefaultTestDeployAssertCD64745E.template.json", + "packaging": "file" + }, + "destinations": { + "current_account-current_region": { + "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}", + "objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json", + "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}" + } + } + } + }, + "dockerImages": {} +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integproductencryptedassetDefaultTestDeployAssertCD64745E.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integproductencryptedassetDefaultTestDeployAssertCD64745E.template.json new file mode 100644 index 0000000000000..ad9d0fb73d1dd --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integproductencryptedassetDefaultTestDeployAssertCD64745E.template.json @@ -0,0 +1,36 @@ +{ + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]" + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetS3AssetProductF5835286.product.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetS3AssetProductF5835286.product.template.json new file mode 100644 index 0000000000000..6be8f345ba1c8 --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetS3AssetProductF5835286.product.template.json @@ -0,0 +1,106 @@ +{ + "Resources": { + "HelloHandlerServiceRole11EF7C63": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + ] + ] + } + ] + } + }, + "HelloHandler2E4FBA4D": { + "Type": "AWS::Lambda::Function", + "Properties": { + "Code": { + "S3Bucket": "product-stack-asset-bucket-12345678-test-region", + "S3Key": "d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2.zip" + }, + "Role": { + "Fn::GetAtt": [ + "HelloHandlerServiceRole11EF7C63", + "Arn" + ] + }, + "Handler": "index.handler", + "Runtime": "python3.9" + }, + "DependsOn": [ + "HelloHandlerServiceRole11EF7C63" + ] + }, + "HelloHandler2ServiceRole37B1402D": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + ] + ] + } + ] + } + }, + "HelloHandler2109B0120": { + "Type": "AWS::Lambda::Function", + "Properties": { + "Code": { + "S3Bucket": "product-stack-asset-bucket-12345678-test-region", + "S3Key": "e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d.zip" + }, + "Role": { + "Fn::GetAtt": [ + "HelloHandler2ServiceRole37B1402D", + "Arn" + ] + }, + "Handler": "index.handler", + "Runtime": "python3.9" + }, + "DependsOn": [ + "HelloHandler2ServiceRole37B1402D" + ] + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetSNSTopicProduct1D32F2021.product.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetSNSTopicProduct1D32F2021.product.template.json new file mode 100644 index 0000000000000..2f2f4704a22ad --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetSNSTopicProduct1D32F2021.product.template.json @@ -0,0 +1,7 @@ +{ + "Resources": { + "TopicProductD757E287": { + "Type": "AWS::SNS::Topic" + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetSNSTopicProduct2A7A2061B.product.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetSNSTopicProduct2A7A2061B.product.template.json new file mode 100644 index 0000000000000..2f2f4704a22ad --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetSNSTopicProduct2A7A2061B.product.template.json @@ -0,0 +1,7 @@ +{ + "Resources": { + "TopicProductD757E287": { + "Type": "AWS::SNS::Topic" + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetSNSTopicProduct3DB08679D.product.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetSNSTopicProduct3DB08679D.product.template.json new file mode 100644 index 0000000000000..2f2f4704a22ad --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/integservicecatalogproductencryptedassetSNSTopicProduct3DB08679D.product.template.json @@ -0,0 +1,7 @@ +{ + "Resources": { + "TopicProductD757E287": { + "Type": "AWS::SNS::Topic" + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/manifest.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/manifest.json new file mode 100644 index 0000000000000..6211001bd03fd --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/manifest.json @@ -0,0 +1,195 @@ +{ + "version": "32.0.0", + "artifacts": { + "integ-servicecatalog-product-encrypted-asset.assets": { + "type": "cdk:asset-manifest", + "properties": { + "file": "integ-servicecatalog-product-encrypted-asset.assets.json", + "requiresBootstrapStackVersion": 6, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version" + } + }, + "integ-servicecatalog-product-encrypted-asset": { + "type": "aws:cloudformation:stack", + "environment": "aws://12345678/test-region", + "properties": { + "templateFile": "integ-servicecatalog-product-encrypted-asset.template.json", + "validateOnSynth": false, + "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-deploy-role-12345678-test-region", + "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-cfn-exec-role-12345678-test-region", + "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-12345678-test-region/fbc5053e654cbff7f9f9e2dcc93822650d3c4575a353996389f09725526668bd.json", + "requiresBootstrapStackVersion": 6, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version", + "additionalDependencies": [ + "integ-servicecatalog-product-encrypted-asset.assets" + ], + "lookupRole": { + "arn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-lookup-role-12345678-test-region", + "requiresBootstrapStackVersion": 8, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version" + } + }, + "dependencies": [ + "integ-servicecatalog-product-encrypted-asset.assets" + ], + "metadata": { + "/integ-servicecatalog-product-encrypted-asset/TestPortfolio/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "TestPortfolio4AC794EB" + } + ], + "/integ-servicecatalog-product-encrypted-asset/TestPortfolio/PortfolioProductAssociation1f17ee66e93a": [ + { + "type": "aws:cdk:logicalId", + "data": "TestPortfolioPortfolioProductAssociation1f17ee66e93a16195E73" + } + ], + "/integ-servicecatalog-product-encrypted-asset/KmsKey/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "KmsKey46693ADD" + } + ], + "/integ-servicecatalog-product-encrypted-asset/TestAssetBucket/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "TestAssetBucket9434EFAE" + } + ], + "/integ-servicecatalog-product-encrypted-asset/TestAssetBucket/Policy/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "TestAssetBucketPolicy62167ACB" + } + ], + "/integ-servicecatalog-product-encrypted-asset/TestAssetBucket/AutoDeleteObjectsCustomResource/Default": [ + { + "type": "aws:cdk:logicalId", + "data": "TestAssetBucketAutoDeleteObjectsCustomResource5A0F8F22" + } + ], + "/integ-servicecatalog-product-encrypted-asset/Custom::S3AutoDeleteObjectsCustomResourceProvider/Role": [ + { + "type": "aws:cdk:logicalId", + "data": "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092" + } + ], + "/integ-servicecatalog-product-encrypted-asset/Custom::S3AutoDeleteObjectsCustomResourceProvider/Handler": [ + { + "type": "aws:cdk:logicalId", + "data": "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F" + } + ], + "/integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/AwsCliLayer/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "AssetsBucketDeploymentAwsCliLayer9BCEE17F" + } + ], + "/integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/CustomResource/Default": [ + { + "type": "aws:cdk:logicalId", + "data": "AssetsBucketDeploymentCustomResource283760D6" + } + ], + "/integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/ServiceRole/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265" + } + ], + "/integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/ServiceRole/DefaultPolicy/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRoleDefaultPolicy88902FDF" + } + ], + "/integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C81C01536" + } + ], + "/integ-servicecatalog-product-encrypted-asset/TestProduct/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "TestProduct7606930B" + } + ], + "/integ-servicecatalog-product-encrypted-asset/PortfolioId": [ + { + "type": "aws:cdk:logicalId", + "data": "PortfolioId" + } + ], + "/integ-servicecatalog-product-encrypted-asset/BootstrapVersion": [ + { + "type": "aws:cdk:logicalId", + "data": "BootstrapVersion" + } + ], + "/integ-servicecatalog-product-encrypted-asset/CheckBootstrapVersion": [ + { + "type": "aws:cdk:logicalId", + "data": "CheckBootstrapVersion" + } + ] + }, + "displayName": "integ-servicecatalog-product-encrypted-asset" + }, + "integproductencryptedassetDefaultTestDeployAssertCD64745E.assets": { + "type": "cdk:asset-manifest", + "properties": { + "file": "integproductencryptedassetDefaultTestDeployAssertCD64745E.assets.json", + "requiresBootstrapStackVersion": 6, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version" + } + }, + "integproductencryptedassetDefaultTestDeployAssertCD64745E": { + "type": "aws:cloudformation:stack", + "environment": "aws://unknown-account/unknown-region", + "properties": { + "templateFile": "integproductencryptedassetDefaultTestDeployAssertCD64745E.template.json", + "validateOnSynth": false, + "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}", + "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}", + "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json", + "requiresBootstrapStackVersion": 6, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version", + "additionalDependencies": [ + "integproductencryptedassetDefaultTestDeployAssertCD64745E.assets" + ], + "lookupRole": { + "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}", + "requiresBootstrapStackVersion": 8, + "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version" + } + }, + "dependencies": [ + "integproductencryptedassetDefaultTestDeployAssertCD64745E.assets" + ], + "metadata": { + "/integ-product-encrypted-asset/DefaultTest/DeployAssert/BootstrapVersion": [ + { + "type": "aws:cdk:logicalId", + "data": "BootstrapVersion" + } + ], + "/integ-product-encrypted-asset/DefaultTest/DeployAssert/CheckBootstrapVersion": [ + { + "type": "aws:cdk:logicalId", + "data": "CheckBootstrapVersion" + } + ] + }, + "displayName": "integ-product-encrypted-asset/DefaultTest/DeployAssert" + }, + "Tree": { + "type": "cdk:tree", + "properties": { + "file": "tree.json" + } + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/tree.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/tree.json new file mode 100644 index 0000000000000..597ab5870a7fc --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.js.snapshot/tree.json @@ -0,0 +1,1337 @@ +{ + "version": "tree-0.1", + "tree": { + "id": "App", + "path": "", + "children": { + "integ-servicecatalog-product-encrypted-asset": { + "id": "integ-servicecatalog-product-encrypted-asset", + "path": "integ-servicecatalog-product-encrypted-asset", + "children": { + "TestPortfolio": { + "id": "TestPortfolio", + "path": "integ-servicecatalog-product-encrypted-asset/TestPortfolio", + "children": { + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/TestPortfolio/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::ServiceCatalog::Portfolio", + "aws:cdk:cloudformation:props": { + "displayName": "TestPortfolio", + "providerName": "TestProvider", + "acceptLanguage": "en", + "description": "This is our Service Catalog Portfolio" + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_servicecatalog.CfnPortfolio", + "version": "0.0.0" + } + }, + "PortfolioProductAssociation1f17ee66e93a": { + "id": "PortfolioProductAssociation1f17ee66e93a", + "path": "integ-servicecatalog-product-encrypted-asset/TestPortfolio/PortfolioProductAssociation1f17ee66e93a", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::ServiceCatalog::PortfolioProductAssociation", + "aws:cdk:cloudformation:props": { + "portfolioId": { + "Ref": "TestPortfolio4AC794EB" + }, + "productId": { + "Ref": "TestProduct7606930B" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_servicecatalog.CfnPortfolioProductAssociation", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_servicecatalog.Portfolio", + "version": "0.0.0" + } + }, + "SNSTopicProduct3": { + "id": "SNSTopicProduct3", + "path": "integ-servicecatalog-product-encrypted-asset/SNSTopicProduct3", + "children": { + "TopicProduct": { + "id": "TopicProduct", + "path": "integ-servicecatalog-product-encrypted-asset/SNSTopicProduct3/TopicProduct", + "children": { + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/SNSTopicProduct3/TopicProduct/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::SNS::Topic", + "aws:cdk:cloudformation:props": {} + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_sns.CfnTopic", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_sns.Topic", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_servicecatalog.ProductStack", + "version": "0.0.0" + } + }, + "ProductStackHistory": { + "id": "ProductStackHistory", + "path": "integ-servicecatalog-product-encrypted-asset/ProductStackHistory", + "constructInfo": { + "fqn": "aws-cdk-lib.aws_servicecatalog.ProductStackHistory", + "version": "0.0.0" + } + }, + "KmsKey": { + "id": "KmsKey", + "path": "integ-servicecatalog-product-encrypted-asset/KmsKey", + "children": { + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/KmsKey/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::KMS::Key", + "aws:cdk:cloudformation:props": { + "keyPolicy": { + "Statement": [ + { + "Action": "kms:*", + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::12345678:root" + ] + ] + } + }, + "Resource": "*" + } + ], + "Version": "2012-10-17" + }, + "description": "Kms key for asset bucket" + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_kms.CfnKey", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_kms.Key", + "version": "0.0.0" + } + }, + "TestAssetBucket": { + "id": "TestAssetBucket", + "path": "integ-servicecatalog-product-encrypted-asset/TestAssetBucket", + "children": { + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/TestAssetBucket/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::S3::Bucket", + "aws:cdk:cloudformation:props": { + "bucketEncryption": { + "serverSideEncryptionConfiguration": [ + { + "bucketKeyEnabled": true, + "serverSideEncryptionByDefault": { + "sseAlgorithm": "aws:kms", + "kmsMasterKeyId": { + "Fn::GetAtt": [ + "KmsKey46693ADD", + "Arn" + ] + } + } + } + ] + }, + "bucketName": "product-stack-asset-bucket-12345678-test-region", + "tags": [ + { + "key": "aws-cdk:auto-delete-objects", + "value": "true" + }, + { + "key": "aws-cdk:cr-owned:173c1279", + "value": "true" + } + ] + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.CfnBucket", + "version": "0.0.0" + } + }, + "Policy": { + "id": "Policy", + "path": "integ-servicecatalog-product-encrypted-asset/TestAssetBucket/Policy", + "children": { + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/TestAssetBucket/Policy/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::S3::BucketPolicy", + "aws:cdk:cloudformation:props": { + "bucket": { + "Ref": "TestAssetBucket9434EFAE" + }, + "policyDocument": { + "Statement": [ + { + "Action": "s3:*", + "Condition": { + "Bool": { + "aws:SecureTransport": "false" + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + "/*" + ] + ] + } + ] + }, + { + "Action": [ + "s3:DeleteObject*", + "s3:GetBucket*", + "s3:List*" + ], + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::GetAtt": [ + "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", + "Arn" + ] + } + }, + "Resource": [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + "/*" + ] + ] + } + ] + }, + { + "Action": "s3:PutObject", + "Condition": { + "StringNotEquals": { + "s3:x-amz-server-side-encryption": "aws:kms" + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + "/*" + ] + ] + } + }, + { + "Action": "s3:PutObject", + "Condition": { + "Null": { + "s3:x-amz-server-side-encryption": true + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + "/*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.CfnBucketPolicy", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.BucketPolicy", + "version": "0.0.0" + } + }, + "AutoDeleteObjectsCustomResource": { + "id": "AutoDeleteObjectsCustomResource", + "path": "integ-servicecatalog-product-encrypted-asset/TestAssetBucket/AutoDeleteObjectsCustomResource", + "children": { + "Default": { + "id": "Default", + "path": "integ-servicecatalog-product-encrypted-asset/TestAssetBucket/AutoDeleteObjectsCustomResource/Default", + "constructInfo": { + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.CustomResource", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.Bucket", + "version": "0.0.0" + } + }, + "Custom::S3AutoDeleteObjectsCustomResourceProvider": { + "id": "Custom::S3AutoDeleteObjectsCustomResourceProvider", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::S3AutoDeleteObjectsCustomResourceProvider", + "children": { + "Staging": { + "id": "Staging", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::S3AutoDeleteObjectsCustomResourceProvider/Staging", + "constructInfo": { + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" + } + }, + "Role": { + "id": "Role", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::S3AutoDeleteObjectsCustomResourceProvider/Role", + "constructInfo": { + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" + } + }, + "Handler": { + "id": "Handler", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::S3AutoDeleteObjectsCustomResourceProvider/Handler", + "constructInfo": { + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.CustomResourceProvider", + "version": "0.0.0" + } + }, + "SNSTopicProduct1": { + "id": "SNSTopicProduct1", + "path": "integ-servicecatalog-product-encrypted-asset/SNSTopicProduct1", + "children": { + "TopicProduct": { + "id": "TopicProduct", + "path": "integ-servicecatalog-product-encrypted-asset/SNSTopicProduct1/TopicProduct", + "children": { + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/SNSTopicProduct1/TopicProduct/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::SNS::Topic", + "aws:cdk:cloudformation:props": {} + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_sns.CfnTopic", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_sns.Topic", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_servicecatalog.ProductStack", + "version": "0.0.0" + } + }, + "SNSTopicProduct2": { + "id": "SNSTopicProduct2", + "path": "integ-servicecatalog-product-encrypted-asset/SNSTopicProduct2", + "children": { + "TopicProduct": { + "id": "TopicProduct", + "path": "integ-servicecatalog-product-encrypted-asset/SNSTopicProduct2/TopicProduct", + "children": { + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/SNSTopicProduct2/TopicProduct/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::SNS::Topic", + "aws:cdk:cloudformation:props": {} + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_sns.CfnTopic", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_sns.Topic", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_servicecatalog.ProductStack", + "version": "0.0.0" + } + }, + "S3AssetProduct": { + "id": "S3AssetProduct", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct", + "children": { + "HelloHandler": { + "id": "HelloHandler", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler", + "children": { + "ServiceRole": { + "id": "ServiceRole", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler/ServiceRole", + "children": { + "ImportServiceRole": { + "id": "ImportServiceRole", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler/ServiceRole/ImportServiceRole", + "constructInfo": { + "fqn": "aws-cdk-lib.Resource", + "version": "0.0.0" + } + }, + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler/ServiceRole/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Role", + "aws:cdk:cloudformation:props": { + "assumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "managedPolicyArns": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + ] + ] + } + ] + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_iam.CfnRole", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_iam.Role", + "version": "0.0.0" + } + }, + "Code": { + "id": "Code", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler/Code", + "children": { + "Stage": { + "id": "Stage", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler/Code/Stage", + "constructInfo": { + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" + } + }, + "AssetBucket": { + "id": "AssetBucket", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler/Code/AssetBucket", + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.BucketBase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3_assets.Asset", + "version": "0.0.0" + } + }, + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::Lambda::Function", + "aws:cdk:cloudformation:props": { + "code": { + "s3Bucket": "product-stack-asset-bucket-12345678-test-region", + "s3Key": "d3833f63e813b3a96ea04c8c50ca98209330867f5f6ac358efca11f85a3476c2.zip" + }, + "role": { + "Fn::GetAtt": [ + "HelloHandlerServiceRole11EF7C63", + "Arn" + ] + }, + "handler": "index.handler", + "runtime": "python3.9" + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_lambda.CfnFunction", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_lambda.Function", + "version": "0.0.0" + } + }, + "HelloHandler2": { + "id": "HelloHandler2", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler2", + "children": { + "ServiceRole": { + "id": "ServiceRole", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler2/ServiceRole", + "children": { + "ImportServiceRole": { + "id": "ImportServiceRole", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler2/ServiceRole/ImportServiceRole", + "constructInfo": { + "fqn": "aws-cdk-lib.Resource", + "version": "0.0.0" + } + }, + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler2/ServiceRole/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Role", + "aws:cdk:cloudformation:props": { + "assumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "managedPolicyArns": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + ] + ] + } + ] + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_iam.CfnRole", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_iam.Role", + "version": "0.0.0" + } + }, + "Code": { + "id": "Code", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler2/Code", + "children": { + "Stage": { + "id": "Stage", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler2/Code/Stage", + "constructInfo": { + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" + } + }, + "AssetBucket": { + "id": "AssetBucket", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler2/Code/AssetBucket", + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.BucketBase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3_assets.Asset", + "version": "0.0.0" + } + }, + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/S3AssetProduct/HelloHandler2/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::Lambda::Function", + "aws:cdk:cloudformation:props": { + "code": { + "s3Bucket": "product-stack-asset-bucket-12345678-test-region", + "s3Key": "e2204c9fddfc339ea362dec9143b4c22f883d4c18dd38c456f8f6a7161c1073d.zip" + }, + "role": { + "Fn::GetAtt": [ + "HelloHandler2ServiceRole37B1402D", + "Arn" + ] + }, + "handler": "index.handler", + "runtime": "python3.9" + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_lambda.CfnFunction", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_lambda.Function", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_servicecatalog.ProductStack", + "version": "0.0.0" + } + }, + "AssetsBucketDeployment": { + "id": "AssetsBucketDeployment", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment", + "children": { + "AwsCliLayer": { + "id": "AwsCliLayer", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/AwsCliLayer", + "children": { + "Code": { + "id": "Code", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/AwsCliLayer/Code", + "children": { + "Stage": { + "id": "Stage", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/AwsCliLayer/Code/Stage", + "constructInfo": { + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" + } + }, + "AssetBucket": { + "id": "AssetBucket", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/AwsCliLayer/Code/AssetBucket", + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.BucketBase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3_assets.Asset", + "version": "0.0.0" + } + }, + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/AwsCliLayer/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::Lambda::LayerVersion", + "aws:cdk:cloudformation:props": { + "content": { + "s3Bucket": "cdk-hnb659fds-assets-12345678-test-region", + "s3Key": "292870ae2617f1c4d62ff18422e009afd534a342c17877fd1b931fb8d8a62abc.zip" + }, + "description": "/opt/awscli/aws" + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_lambda.CfnLayerVersion", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.lambda_layer_awscli.AwsCliLayer", + "version": "0.0.0" + } + }, + "CustomResourceHandler": { + "id": "CustomResourceHandler", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/CustomResourceHandler", + "constructInfo": { + "fqn": "aws-cdk-lib.aws_lambda.SingletonFunction", + "version": "0.0.0" + } + }, + "Asset1": { + "id": "Asset1", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/Asset1", + "children": { + "Stage": { + "id": "Stage", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/Asset1/Stage", + "constructInfo": { + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" + } + }, + "AssetBucket": { + "id": "AssetBucket", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/Asset1/AssetBucket", + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.BucketBase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3_assets.Asset", + "version": "0.0.0" + } + }, + "CustomResource": { + "id": "CustomResource", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/CustomResource", + "children": { + "Default": { + "id": "Default", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/CustomResource/Default", + "constructInfo": { + "fqn": "aws-cdk-lib.CfnResource", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.CustomResource", + "version": "0.0.0" + } + }, + "Asset2": { + "id": "Asset2", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/Asset2", + "children": { + "Stage": { + "id": "Stage", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/Asset2/Stage", + "constructInfo": { + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" + } + }, + "AssetBucket": { + "id": "AssetBucket", + "path": "integ-servicecatalog-product-encrypted-asset/AssetsBucketDeployment/Asset2/AssetBucket", + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.BucketBase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3_assets.Asset", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3_deployment.BucketDeployment", + "version": "0.0.0" + } + }, + "Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C": { + "id": "Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C", + "children": { + "ServiceRole": { + "id": "ServiceRole", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/ServiceRole", + "children": { + "ImportServiceRole": { + "id": "ImportServiceRole", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/ServiceRole/ImportServiceRole", + "constructInfo": { + "fqn": "aws-cdk-lib.Resource", + "version": "0.0.0" + } + }, + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/ServiceRole/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Role", + "aws:cdk:cloudformation:props": { + "assumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "lambda.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "managedPolicyArns": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + ] + ] + } + ] + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_iam.CfnRole", + "version": "0.0.0" + } + }, + "DefaultPolicy": { + "id": "DefaultPolicy", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/ServiceRole/DefaultPolicy", + "children": { + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/ServiceRole/DefaultPolicy/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Policy", + "aws:cdk:cloudformation:props": { + "policyDocument": { + "Statement": [ + { + "Action": [ + "s3:GetBucket*", + "s3:GetObject*", + "s3:List*" + ], + "Effect": "Allow", + "Resource": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":s3:::cdk-hnb659fds-assets-12345678-test-region" + ] + ] + }, + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":s3:::cdk-hnb659fds-assets-12345678-test-region/*" + ] + ] + } + ] + }, + { + "Action": [ + "s3:Abort*", + "s3:DeleteObject*", + "s3:GetBucket*", + "s3:GetObject*", + "s3:List*", + "s3:PutObject", + "s3:PutObjectLegalHold", + "s3:PutObjectRetention", + "s3:PutObjectTagging", + "s3:PutObjectVersionTagging" + ], + "Effect": "Allow", + "Resource": [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "TestAssetBucket9434EFAE", + "Arn" + ] + }, + "/*" + ] + ] + } + ] + }, + { + "Action": [ + "kms:Decrypt", + "kms:DescribeKey", + "kms:Encrypt", + "kms:GenerateDataKey*", + "kms:ReEncrypt*" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "KmsKey46693ADD", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "policyName": "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRoleDefaultPolicy88902FDF", + "roles": [ + { + "Ref": "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265" + } + ] + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_iam.CfnPolicy", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_iam.Policy", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_iam.Role", + "version": "0.0.0" + } + }, + "Code": { + "id": "Code", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/Code", + "children": { + "Stage": { + "id": "Stage", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/Code/Stage", + "constructInfo": { + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" + } + }, + "AssetBucket": { + "id": "AssetBucket", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/Code/AssetBucket", + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.BucketBase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3_assets.Asset", + "version": "0.0.0" + } + }, + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::Lambda::Function", + "aws:cdk:cloudformation:props": { + "code": { + "s3Bucket": "cdk-hnb659fds-assets-12345678-test-region", + "s3Key": "9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd.zip" + }, + "role": { + "Fn::GetAtt": [ + "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265", + "Arn" + ] + }, + "environment": { + "variables": { + "AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem" + } + }, + "handler": "index.handler", + "layers": [ + { + "Ref": "AssetsBucketDeploymentAwsCliLayer9BCEE17F" + } + ], + "runtime": "python3.9", + "timeout": 900 + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_lambda.CfnFunction", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_lambda.Function", + "version": "0.0.0" + } + }, + "TestProduct": { + "id": "TestProduct", + "path": "integ-servicecatalog-product-encrypted-asset/TestProduct", + "children": { + "Template492cd2a08509": { + "id": "Template492cd2a08509", + "path": "integ-servicecatalog-product-encrypted-asset/TestProduct/Template492cd2a08509", + "children": { + "Stage": { + "id": "Stage", + "path": "integ-servicecatalog-product-encrypted-asset/TestProduct/Template492cd2a08509/Stage", + "constructInfo": { + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" + } + }, + "AssetBucket": { + "id": "AssetBucket", + "path": "integ-servicecatalog-product-encrypted-asset/TestProduct/Template492cd2a08509/AssetBucket", + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.BucketBase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3_assets.Asset", + "version": "0.0.0" + } + }, + "Template77185cb33408": { + "id": "Template77185cb33408", + "path": "integ-servicecatalog-product-encrypted-asset/TestProduct/Template77185cb33408", + "children": { + "Stage": { + "id": "Stage", + "path": "integ-servicecatalog-product-encrypted-asset/TestProduct/Template77185cb33408/Stage", + "constructInfo": { + "fqn": "aws-cdk-lib.AssetStaging", + "version": "0.0.0" + } + }, + "AssetBucket": { + "id": "AssetBucket", + "path": "integ-servicecatalog-product-encrypted-asset/TestProduct/Template77185cb33408/AssetBucket", + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3.BucketBase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_s3_assets.Asset", + "version": "0.0.0" + } + }, + "Resource": { + "id": "Resource", + "path": "integ-servicecatalog-product-encrypted-asset/TestProduct/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::ServiceCatalog::CloudFormationProduct", + "aws:cdk:cloudformation:props": { + "name": "testProduct", + "owner": "testOwner", + "provisioningArtifactParameters": [ + { + "disableTemplateValidation": true, + "info": { + "LoadTemplateFromURL": "https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template" + } + }, + { + "disableTemplateValidation": false, + "info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/b59f768286e16b69628bb23b9c1a1f07300a24101b8979d8e2a94ff1ab03d09e.json" + } + } + }, + { + "disableTemplateValidation": false, + "info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/6412a5f4524c6b41d26fbeee226c68c2dad735393940a51008d77e6f8b1038f5.json" + } + } + }, + { + "disableTemplateValidation": false, + "info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/dd2d087eeb6ede1d2a9166639ccbde7bd1b10eef9ba2b4cb3d9855faa4fe8c1f.json" + } + } + }, + { + "disableTemplateValidation": false, + "info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/dd2d087eeb6ede1d2a9166639ccbde7bd1b10eef9ba2b4cb3d9855faa4fe8c1f.json" + } + } + }, + { + "name": "testAssetProduct", + "disableTemplateValidation": true, + "info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/c6a724b9f87d5f730d400d518f32edba51cf14c851d05c5eea07a9170b9e510a.json" + } + } + }, + { + "name": "v1", + "disableTemplateValidation": false, + "info": { + "LoadTemplateFromURL": { + "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/dd2d087eeb6ede1d2a9166639ccbde7bd1b10eef9ba2b4cb3d9855faa4fe8c1f.json" + } + } + } + ] + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_servicecatalog.CfnCloudFormationProduct", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.aws_servicecatalog.CloudFormationProduct", + "version": "0.0.0" + } + }, + "PortfolioId": { + "id": "PortfolioId", + "path": "integ-servicecatalog-product-encrypted-asset/PortfolioId", + "constructInfo": { + "fqn": "aws-cdk-lib.CfnOutput", + "version": "0.0.0" + } + }, + "BootstrapVersion": { + "id": "BootstrapVersion", + "path": "integ-servicecatalog-product-encrypted-asset/BootstrapVersion", + "constructInfo": { + "fqn": "aws-cdk-lib.CfnParameter", + "version": "0.0.0" + } + }, + "CheckBootstrapVersion": { + "id": "CheckBootstrapVersion", + "path": "integ-servicecatalog-product-encrypted-asset/CheckBootstrapVersion", + "constructInfo": { + "fqn": "aws-cdk-lib.CfnRule", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.Stack", + "version": "0.0.0" + } + }, + "integ-product-encrypted-asset": { + "id": "integ-product-encrypted-asset", + "path": "integ-product-encrypted-asset", + "children": { + "DefaultTest": { + "id": "DefaultTest", + "path": "integ-product-encrypted-asset/DefaultTest", + "children": { + "Default": { + "id": "Default", + "path": "integ-product-encrypted-asset/DefaultTest/Default", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.2.55" + } + }, + "DeployAssert": { + "id": "DeployAssert", + "path": "integ-product-encrypted-asset/DefaultTest/DeployAssert", + "children": { + "BootstrapVersion": { + "id": "BootstrapVersion", + "path": "integ-product-encrypted-asset/DefaultTest/DeployAssert/BootstrapVersion", + "constructInfo": { + "fqn": "aws-cdk-lib.CfnParameter", + "version": "0.0.0" + } + }, + "CheckBootstrapVersion": { + "id": "CheckBootstrapVersion", + "path": "integ-product-encrypted-asset/DefaultTest/DeployAssert/CheckBootstrapVersion", + "constructInfo": { + "fqn": "aws-cdk-lib.CfnRule", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.Stack", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/integ-tests-alpha.IntegTestCase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/integ-tests-alpha.IntegTest", + "version": "0.0.0" + } + }, + "Tree": { + "id": "Tree", + "path": "Tree", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.2.55" + } + } + }, + "constructInfo": { + "fqn": "aws-cdk-lib.App", + "version": "0.0.0" + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.ts new file mode 100644 index 0000000000000..aca01bc42d66f --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/integ.product.encrypted.asset.ts @@ -0,0 +1,142 @@ +import * as path from 'path'; +import * as iam from 'aws-cdk-lib/aws-iam'; +import * as kms from 'aws-cdk-lib/aws-kms'; +import * as lambda from 'aws-cdk-lib/aws-lambda'; +import * as s3 from 'aws-cdk-lib/aws-s3'; +import { BucketEncryption } from 'aws-cdk-lib/aws-s3'; +import * as sns from 'aws-cdk-lib/aws-sns'; +import * as cdk from 'aws-cdk-lib'; +import { IntegTest } from '@aws-cdk/integ-tests-alpha'; +import * as servicecatalog from 'aws-cdk-lib/aws-servicecatalog'; +import { ProductStackHistory, ProductStackProps } from 'aws-cdk-lib/aws-servicecatalog'; +import { ServerSideEncryption } from 'aws-cdk-lib/aws-s3-deployment'; + +const app = new cdk.App(); +const stack = new cdk.Stack(app, 'integ-servicecatalog-product-encrypted-asset', { + env: { + account: process.env.CDK_INTEG_ACCOUNT ?? process.env.CDK_DEFAULT_ACCOUNT, + region: process.env.CDK_INTEG_REGION ?? process.env.CDK_DEFAULT_REGION, + }, +}); + +class TestProductStack extends servicecatalog.ProductStack { + constructor(scope: any, id: string) { + super(scope, id); + + new sns.Topic(this, 'TopicProduct'); + } +} + +const portfolio = new servicecatalog.Portfolio(stack, 'TestPortfolio', { + displayName: 'TestPortfolio', + providerName: 'TestProvider', + description: 'This is our Service Catalog Portfolio', + messageLanguage: servicecatalog.MessageLanguage.EN, +}); + +class TestAssetProductStack extends servicecatalog.ProductStack { + constructor(scope: any, id: string, props?: ProductStackProps) { + super(scope, id, props); + + new lambda.Function(this, 'HelloHandler', { + runtime: lambda.Runtime.PYTHON_3_9, + code: lambda.Code.fromAsset('./assets'), + handler: 'index.handler', + }); + + new lambda.Function(this, 'HelloHandler2', { + runtime: lambda.Runtime.PYTHON_3_9, + code: lambda.Code.fromAsset('./assetsv2'), + handler: 'index.handler', + }); + } +} + +const productStackHistory = new ProductStackHistory(stack, 'ProductStackHistory', { + productStack: new TestProductStack(stack, 'SNSTopicProduct3'), + currentVersionName: 'v1', + currentVersionLocked: false, +}); + +const kmsKey = new kms.Key(stack, 'KmsKey', { + description: 'Kms key for asset bucket', +}); + +const testAssetBucket = new s3.Bucket(stack, 'TestAssetBucket', { + bucketName: `product-stack-asset-bucket-${stack.account}-${stack.region}`, + removalPolicy: cdk.RemovalPolicy.DESTROY, + autoDeleteObjects: true, + enforceSSL: true, + encryption: BucketEncryption.KMS, + encryptionKey: kmsKey, + bucketKeyEnabled: true, +}); + +testAssetBucket.addToResourcePolicy(new iam.PolicyStatement({ + actions: ['s3:PutObject'], + effect: iam.Effect.DENY, + principals: [new iam.AnyPrincipal()], + resources: [testAssetBucket.arnForObjects('*')], + conditions: { + StringNotEquals: { + 's3:x-amz-server-side-encryption': 'aws:kms', + }, + }, +})); + +testAssetBucket.addToResourcePolicy(new iam.PolicyStatement({ + actions: ['s3:PutObject'], + effect: iam.Effect.DENY, + principals: [new iam.AnyPrincipal()], + resources: [testAssetBucket.arnForObjects('*')], + conditions: { + Null: { + 's3:x-amz-server-side-encryption': true, + }, + }, +})); + +const product = new servicecatalog.CloudFormationProduct(stack, 'TestProduct', { + productName: 'testProduct', + owner: 'testOwner', + productVersions: [ + { + validateTemplate: false, + cloudFormationTemplate: servicecatalog.CloudFormationTemplate.fromUrl( + 'https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template'), + }, + { + cloudFormationTemplate: servicecatalog.CloudFormationTemplate.fromAsset(path.join(__dirname, 'product1.template.json')), + }, + { + cloudFormationTemplate: servicecatalog.CloudFormationTemplate.fromAsset(path.join(__dirname, 'product2.template.json')), + }, + { + cloudFormationTemplate: servicecatalog.CloudFormationTemplate.fromProductStack(new TestProductStack(stack, 'SNSTopicProduct1')), + }, + { + cloudFormationTemplate: servicecatalog.CloudFormationTemplate.fromProductStack(new TestProductStack(stack, 'SNSTopicProduct2')), + }, + { + productVersionName: 'testAssetProduct', + validateTemplate: false, + cloudFormationTemplate: servicecatalog.CloudFormationTemplate.fromProductStack(new TestAssetProductStack(stack, 'S3AssetProduct', { + assetBucket: testAssetBucket, + serverSideEncryption: ServerSideEncryption.AWS_KMS, + serverSideEncryptionAwsKmsKeyId: kmsKey.keyId, + })), + }, + productStackHistory.currentVersion(), + ], +}); + +new IntegTest(app, 'integ-product-encrypted-asset', { + testCases: [stack], + enableLookups: true, +}); + +portfolio.addProduct(product); + +new cdk.CfnOutput(stack, 'PortfolioId', { value: portfolio.portfolioId }); + +app.synth(); diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/product-stack-snapshots/integservicecatalogproductencryptedassetProductStackHistory50DC14D9.integservicecatalogproductencryptedassetSNSTopicProduct3DB08679D.v1.product.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/product-stack-snapshots/integservicecatalogproductencryptedassetProductStackHistory50DC14D9.integservicecatalogproductencryptedassetSNSTopicProduct3DB08679D.v1.product.template.json new file mode 100644 index 0000000000000..2f2f4704a22ad --- /dev/null +++ b/packages/@aws-cdk-testing/framework-integ/test/aws-servicecatalog/test/product-stack-snapshots/integservicecatalogproductencryptedassetProductStackHistory50DC14D9.integservicecatalogproductencryptedassetSNSTopicProduct3DB08679D.v1.product.template.json @@ -0,0 +1,7 @@ +{ + "Resources": { + "TopicProductD757E287": { + "Type": "AWS::SNS::Topic" + } + } +} \ No newline at end of file diff --git a/packages/aws-cdk-lib/aws-servicecatalog/lib/private/product-stack-synthesizer.ts b/packages/aws-cdk-lib/aws-servicecatalog/lib/private/product-stack-synthesizer.ts index 2971c6c0fceff..6c963443374ff 100644 --- a/packages/aws-cdk-lib/aws-servicecatalog/lib/private/product-stack-synthesizer.ts +++ b/packages/aws-cdk-lib/aws-servicecatalog/lib/private/product-stack-synthesizer.ts @@ -1,6 +1,6 @@ import * as path from 'path'; import { CfnBucket, IBucket } from '../../../aws-s3'; -import { BucketDeployment, Source } from '../../../aws-s3-deployment'; +import { BucketDeployment, ServerSideEncryption, Source } from '../../../aws-s3-deployment'; import * as cdk from '../../../core'; import { ProductStack } from '../product-stack'; @@ -11,17 +11,27 @@ import { ProductStack } from '../product-stack'; */ export class ProductStackSynthesizer extends cdk.StackSynthesizer { private readonly assetBucket?: IBucket; + private readonly serverSideEncryption? : ServerSideEncryption; + private readonly serverSideEncryptionAwsKmsKeyId? : string; private bucketDeployment?: BucketDeployment; - constructor(assetBucket?: IBucket) { + constructor(assetBucket?: IBucket, serverSideEncryption? : ServerSideEncryption, serverSideEncryptionAwsKmsKeyId? : string) { super(); this.assetBucket = assetBucket; + this.serverSideEncryption = serverSideEncryption; + this.serverSideEncryptionAwsKmsKeyId = serverSideEncryptionAwsKmsKeyId; } public addFileAsset(asset: cdk.FileAssetSource): cdk.FileAssetLocation { if (!this.assetBucket) { throw new Error('An Asset Bucket must be provided to use Assets'); } + if (this.serverSideEncryption == ServerSideEncryption.AWS_KMS && !this.serverSideEncryptionAwsKmsKeyId) { + throw new Error('A KMS Key must be provided to use SSE_KMS'); + } + if (this.serverSideEncryption != ServerSideEncryption.AWS_KMS && this.serverSideEncryptionAwsKmsKeyId) { + throw new Error('A SSE_KMS encryption must be enabled if you provide KMS Key'); + } const outdir = cdk.App.of(this.boundStack)?.outdir ?? 'cdk.out'; const assetPath = `${outdir}/${asset.fileName}`; if (!this.bucketDeployment) { @@ -35,14 +45,14 @@ export class ProductStackSynthesizer extends cdk.StackSynthesizer { destinationBucket: this.assetBucket, extract: false, prune: false, + serverSideEncryption: this.serverSideEncryption, + serverSideEncryptionAwsKmsKeyId: this.serverSideEncryptionAwsKmsKeyId, }); } else { this.bucketDeployment.addSource(Source.asset(assetPath)); } - const physicalName = this.physicalNameOfBucket(this.assetBucket); - - const bucketName = physicalName; + const bucketName = this.physicalNameOfBucket(this.assetBucket);; if (!asset.fileName) { throw new Error('Asset file name is undefined'); } diff --git a/packages/aws-cdk-lib/aws-servicecatalog/lib/product-stack.ts b/packages/aws-cdk-lib/aws-servicecatalog/lib/product-stack.ts index 2f44246f7fcd1..3c9f3e9f58e9d 100644 --- a/packages/aws-cdk-lib/aws-servicecatalog/lib/product-stack.ts +++ b/packages/aws-cdk-lib/aws-servicecatalog/lib/product-stack.ts @@ -5,6 +5,7 @@ import { Construct } from 'constructs'; import { ProductStackSynthesizer } from './private/product-stack-synthesizer'; import { ProductStackHistory } from './product-stack-history'; import { IBucket } from '../../aws-s3'; +import { ServerSideEncryption } from '../../aws-s3-deployment'; import * as cdk from '../../core'; /** @@ -16,6 +17,16 @@ export interface ProductStackProps { * @default No Bucket provided and Assets will not be supported. */ readonly assetBucket?: IBucket; + /** + * A ServerSideEncryption can be enabled to encrypt assets that are put into assetBucket + * @default No encryption is used + */ + readonly serverSideEncryption? : ServerSideEncryption; + /** + * For AWS_KMS ServerSideEncryption a KMS KeyId must be provided which will be used to encrypt assets + * @default No KMS KeyId and SSE_KMS encryption cannot be used + */ + readonly serverSideEncryptionAwsKmsKeyId? : string; } /** @@ -37,7 +48,7 @@ export class ProductStack extends cdk.Stack { constructor(scope: Construct, id: string, props: ProductStackProps = {}) { super(scope, id, { - synthesizer: new ProductStackSynthesizer(props.assetBucket), + synthesizer: new ProductStackSynthesizer(props.assetBucket, props.serverSideEncryption, props.serverSideEncryptionAwsKmsKeyId), }); this._parentStack = findParentStack(scope); diff --git a/packages/aws-cdk-lib/aws-servicecatalog/test/product-stack.test.ts b/packages/aws-cdk-lib/aws-servicecatalog/test/product-stack.test.ts index 60d24e527c629..5a1addf28da22 100644 --- a/packages/aws-cdk-lib/aws-servicecatalog/test/product-stack.test.ts +++ b/packages/aws-cdk-lib/aws-servicecatalog/test/product-stack.test.ts @@ -2,9 +2,12 @@ import * as fs from 'fs'; import * as path from 'path'; import { Construct } from 'constructs'; import { Template } from '../../assertions'; +import * as kms from '../../aws-kms'; import * as lambda from '../../aws-lambda'; import * as s3 from '../../aws-s3'; +import { BucketEncryption } from '../../aws-s3'; import * as s3_assets from '../../aws-s3-assets'; +import { ServerSideEncryption } from '../../aws-s3-deployment'; import * as sns from '../../aws-sns'; import * as cdk from '../../core'; import * as servicecatalog from '../lib'; @@ -19,7 +22,7 @@ describe('ProductStack', () => { // THEN expect(productStack._getAssetBucket()).toBeUndefined(); - }), + }); test('Used defined Asset bucket in product stack with assets', () => { // GIVEN @@ -178,7 +181,7 @@ describe('ProductStack', () => { expect(() => { new servicecatalog.ProductStack(group, 'ProductStack'); }).toThrow(/must be defined within scope of another non-product stack/); - }), + }); test('can be defined as a direct child or an indirect child of a Stack', () => { // GIVEN @@ -223,4 +226,113 @@ describe('ProductStack', () => { }, }); }); + + test('fails if KMS encryption for assetBucket enabled without a KMS key', () => { + // GIVEN + const app = new cdk.App(); + const mainStack = new cdk.Stack(app, 'MyStack'); + const testAssetBucket = new s3.Bucket(mainStack, 'TestAssetBucket', { + }); + const productStack = new servicecatalog.ProductStack(mainStack, 'MyProductStack', { + assetBucket: testAssetBucket, + serverSideEncryption: ServerSideEncryption.AWS_KMS, + }); + + // THEN + expect(() => { + new s3_assets.Asset(productStack, 'testAsset', { + path: path.join(__dirname, 'assets'), + }); + }).toThrow('A KMS Key must be provided to use SSE_KMS'); + }); + + test('fails if KMS key is provided without KMS encryption for assetBucket enabled', () => { + // GIVEN + const app = new cdk.App(); + const mainStack = new cdk.Stack(app, 'MyStack'); + const testKmsKey = new kms.Key(mainStack, 'TestKmsKey'); + const testAssetBucket = new s3.Bucket(mainStack, 'TestAssetBucket', { + }); + const productStack = new servicecatalog.ProductStack(mainStack, 'MyProductStack', { + assetBucket: testAssetBucket, + serverSideEncryptionAwsKmsKeyId: testKmsKey.keyId, + }); + + // THEN + expect(() => { + new s3_assets.Asset(productStack, 'testAsset', { + path: path.join(__dirname, 'assets'), + }); + }).toThrow('A SSE_KMS encryption must be enabled if you provide KMS Key'); + }); + + test('BucketDeployment with SSE_KMS encryption for assetBucket enabled', () => { + // GIVEN + const app = new cdk.App(); + const mainStack = new cdk.Stack(app, 'MyStack'); + const testKmsKey = new kms.Key(mainStack, 'TestKmsKey'); + const testAssetBucket = new s3.Bucket(mainStack, 'TestAssetBucket', { + bucketName: 'test-asset-bucket', + encryptionKey: testKmsKey, + encryption: BucketEncryption.KMS, + }); + const productStack = new servicecatalog.ProductStack(mainStack, 'MyProductStack', { + assetBucket: testAssetBucket, + serverSideEncryption: ServerSideEncryption.AWS_KMS, + serverSideEncryptionAwsKmsKeyId: testKmsKey.keyId, + }); + + new lambda.Function(productStack, 'HelloHandler', { + runtime: lambda.Runtime.PYTHON_3_9, + code: lambda.Code.fromAsset(path.join(__dirname, 'assets')), + handler: 'index.handler', + }); + + // WHEN + const assembly = app.synth(); + + // THEN + expect(productStack._getAssetBucket()).toBeDefined(); + const mainStackTemplate = JSON.parse(fs.readFileSync(path.join(assembly.directory, mainStack.templateFile), 'utf-8')); + Template.fromJSON(mainStackTemplate).hasResourceProperties('Custom::CDKBucketDeployment', { + SystemMetadata: { + sse: 'aws:kms', + 'sse-kms-key-id': { + Ref: 'TestKmsKeyF793768B', + }, + }, + }); + }); + + test('BucketDeployment with SSE_S3 encryption for assetBucket enabled', () => { + // GIVEN + const app = new cdk.App(); + const mainStack = new cdk.Stack(app, 'MyStack'); + const testAssetBucket = new s3.Bucket(mainStack, 'TestAssetBucket', { + bucketName: 'test-asset-bucket', + encryption: BucketEncryption.S3_MANAGED, + }); + const productStack = new servicecatalog.ProductStack(mainStack, 'MyProductStack', { + assetBucket: testAssetBucket, + serverSideEncryption: ServerSideEncryption.AES_256, + }); + + new lambda.Function(productStack, 'HelloHandler', { + runtime: lambda.Runtime.PYTHON_3_9, + code: lambda.Code.fromAsset(path.join(__dirname, 'assets')), + handler: 'index.handler', + }); + + // WHEN + const assembly = app.synth(); + + // THEN + expect(productStack._getAssetBucket()).toBeDefined(); + const mainStackTemplate = JSON.parse(fs.readFileSync(path.join(assembly.directory, mainStack.templateFile), 'utf-8')); + Template.fromJSON(mainStackTemplate).hasResourceProperties('Custom::CDKBucketDeployment', { + SystemMetadata: { + sse: 'AES256', + }, + }); + }); });