Skip to content

Commit 6e20cbf

Browse files
lpizzinidevlpizzinidev
authored
feat(opensearchservice): SAML authorization properties for Domain construct (#26673)
Allows to specify [SAML authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/saml.html) for OpenSearch domains via high-level construct properties. Example: ``` const domain = new Domain(this, 'Domain', { version: EngineVersion.OPENSEARCH_1_0, enforceHttps: true, nodeToNodeEncryption: true, encryptionAtRest: { enabled: true, }, fineGrainedAccessControl: { masterUserName: 'master-user', samlAuthenticationEnabled: true, samlAuthenticationOptions: { idpEntityId: 'entity-id', idpMetadataContent: 'metadata-content-with-quotes-escaped', }, }, }); ``` Closes #26600. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent e0ca252 commit 6e20cbf

13 files changed

+1053
-0
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-opensearchservice/test/integ.opensearch.advancedsecurity-with-saml.js.snapshot/cdk-opensearch-advancedsecurity-with-saml.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "33.0.0",
3+
"files": {
4+
"026445656dddc9b7080faac1092d4280a9c24fdf2b21a398f4c44f31d96fcc22": {
5+
"source": {
6+
"path": "cdk-opensearch-advancedsecurity-with-saml.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "026445656dddc9b7080faac1092d4280a9c24fdf2b21a398f4c44f31d96fcc22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-opensearchservice/test/integ.opensearch.advancedsecurity-with-saml.js.snapshot/cdk-opensearch-advancedsecurity-with-saml.template.json

Lines changed: 95 additions & 0 deletions
Large diffs are not rendered by default.

‎packages/@aws-cdk-testing/framework-integ/test/aws-opensearchservice/test/integ.opensearch.advancedsecurity-with-saml.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"33.0.0"}

‎packages/@aws-cdk-testing/framework-integ/test/aws-opensearchservice/test/integ.opensearch.advancedsecurity-with-saml.js.snapshot/integ.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "33.0.0",
3+
"testCases": {
4+
"integ-opensearch-advancedsecurity-with-saml/DefaultTest": {
5+
"stacks": [
6+
"cdk-opensearch-advancedsecurity-with-saml"
7+
],
8+
"assertionStack": "integ-opensearch-advancedsecurity-with-saml/DefaultTest/DeployAssert",
9+
"assertionStackName": "integopensearchadvancedsecuritywithsamlDefaultTestDeployAssertA27B274A"
10+
}
11+
}
12+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-opensearchservice/test/integ.opensearch.advancedsecurity-with-saml.js.snapshot/integopensearchadvancedsecuritywithsamlDefaultTestDeployAssertA27B274A.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "33.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "integopensearchadvancedsecuritywithsamlDefaultTestDeployAssertA27B274A.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-opensearchservice/test/integ.opensearch.advancedsecurity-with-saml.js.snapshot/integopensearchadvancedsecuritywithsamlDefaultTestDeployAssertA27B274A.template.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-opensearchservice/test/integ.opensearch.advancedsecurity-with-saml.js.snapshot/manifest.json

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
{
2+
"version": "33.0.0",
3+
"artifacts": {
4+
"cdk-opensearch-advancedsecurity-with-saml.assets": {
5+
"type": "cdk:asset-manifest",
6+
"properties": {
7+
"file": "cdk-opensearch-advancedsecurity-with-saml.assets.json",
8+
"requiresBootstrapStackVersion": 6,
9+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
10+
}
11+
},
12+
"cdk-opensearch-advancedsecurity-with-saml": {
13+
"type": "aws:cloudformation:stack",
14+
"environment": "aws://unknown-account/unknown-region",
15+
"properties": {
16+
"templateFile": "cdk-opensearch-advancedsecurity-with-saml.template.json",
17+
"validateOnSynth": false,
18+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
19+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/026445656dddc9b7080faac1092d4280a9c24fdf2b21a398f4c44f31d96fcc22.json",
21+
"requiresBootstrapStackVersion": 6,
22+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
23+
"additionalDependencies": [
24+
"cdk-opensearch-advancedsecurity-with-saml.assets"
25+
],
26+
"lookupRole": {
27+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
28+
"requiresBootstrapStackVersion": 8,
29+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
30+
}
31+
},
32+
"dependencies": [
33+
"cdk-opensearch-advancedsecurity-with-saml.assets"
34+
],
35+
"metadata": {
36+
"/cdk-opensearch-advancedsecurity-with-saml/User/Resource": [
37+
{
38+
"type": "aws:cdk:logicalId",
39+
"data": "User00B015A1"
40+
}
41+
],
42+
"/cdk-opensearch-advancedsecurity-with-saml/Domain/Resource": [
43+
{
44+
"type": "aws:cdk:logicalId",
45+
"data": "Domain66AC69E0"
46+
}
47+
],
48+
"/cdk-opensearch-advancedsecurity-with-saml/BootstrapVersion": [
49+
{
50+
"type": "aws:cdk:logicalId",
51+
"data": "BootstrapVersion"
52+
}
53+
],
54+
"/cdk-opensearch-advancedsecurity-with-saml/CheckBootstrapVersion": [
55+
{
56+
"type": "aws:cdk:logicalId",
57+
"data": "CheckBootstrapVersion"
58+
}
59+
]
60+
},
61+
"displayName": "cdk-opensearch-advancedsecurity-with-saml"
62+
},
63+
"integopensearchadvancedsecuritywithsamlDefaultTestDeployAssertA27B274A.assets": {
64+
"type": "cdk:asset-manifest",
65+
"properties": {
66+
"file": "integopensearchadvancedsecuritywithsamlDefaultTestDeployAssertA27B274A.assets.json",
67+
"requiresBootstrapStackVersion": 6,
68+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
69+
}
70+
},
71+
"integopensearchadvancedsecuritywithsamlDefaultTestDeployAssertA27B274A": {
72+
"type": "aws:cloudformation:stack",
73+
"environment": "aws://unknown-account/unknown-region",
74+
"properties": {
75+
"templateFile": "integopensearchadvancedsecuritywithsamlDefaultTestDeployAssertA27B274A.template.json",
76+
"validateOnSynth": false,
77+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
78+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
79+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
80+
"requiresBootstrapStackVersion": 6,
81+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
82+
"additionalDependencies": [
83+
"integopensearchadvancedsecuritywithsamlDefaultTestDeployAssertA27B274A.assets"
84+
],
85+
"lookupRole": {
86+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
87+
"requiresBootstrapStackVersion": 8,
88+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
89+
}
90+
},
91+
"dependencies": [
92+
"integopensearchadvancedsecuritywithsamlDefaultTestDeployAssertA27B274A.assets"
93+
],
94+
"metadata": {
95+
"/integ-opensearch-advancedsecurity-with-saml/DefaultTest/DeployAssert/BootstrapVersion": [
96+
{
97+
"type": "aws:cdk:logicalId",
98+
"data": "BootstrapVersion"
99+
}
100+
],
101+
"/integ-opensearch-advancedsecurity-with-saml/DefaultTest/DeployAssert/CheckBootstrapVersion": [
102+
{
103+
"type": "aws:cdk:logicalId",
104+
"data": "CheckBootstrapVersion"
105+
}
106+
]
107+
},
108+
"displayName": "integ-opensearch-advancedsecurity-with-saml/DefaultTest/DeployAssert"
109+
},
110+
"Tree": {
111+
"type": "cdk:tree",
112+
"properties": {
113+
"file": "tree.json"
114+
}
115+
}
116+
}
117+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-opensearchservice/test/integ.opensearch.advancedsecurity-with-saml.js.snapshot/tree.json

Lines changed: 193 additions & 0 deletions
Large diffs are not rendered by default.

‎packages/@aws-cdk-testing/framework-integ/test/aws-opensearchservice/test/integ.opensearch.advancedsecurity-with-saml.ts

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
import * as path from 'path';
2+
import * as iam from 'aws-cdk-lib/aws-iam';
3+
import * as cdk from 'aws-cdk-lib';
4+
import * as opensearch from 'aws-cdk-lib/aws-opensearchservice';
5+
import * as integ from '@aws-cdk/integ-tests-alpha';
6+
7+
const app = new cdk.App();
8+
const stack = new cdk.Stack(app, 'cdk-opensearch-advancedsecurity-with-saml');
9+
10+
const user = new iam.User(stack, 'User');
11+
12+
const metadataDocument = iam.SamlMetadataDocument.fromFile(path.join(__dirname, 'saml-metadata-document.xml'));
13+
14+
new opensearch.Domain(stack, 'Domain', {
15+
removalPolicy: cdk.RemovalPolicy.DESTROY,
16+
version: opensearch.EngineVersion.ELASTICSEARCH_7_1,
17+
fineGrainedAccessControl: {
18+
masterUserArn: user.userArn,
19+
samlAuthenticationEnabled: true,
20+
samlAuthenticationOptions: {
21+
idpEntityId: 'entity-id',
22+
idpMetadataContent: metadataDocument.xml,
23+
masterBackendRole: 'backend-role',
24+
masterUserName: 'master-username',
25+
},
26+
},
27+
encryptionAtRest: {
28+
enabled: true,
29+
},
30+
nodeToNodeEncryption: true,
31+
enforceHttps: true,
32+
capacity: {
33+
multiAzWithStandbyEnabled: false,
34+
},
35+
});
36+
37+
new integ.IntegTest(app, 'integ-opensearch-advancedsecurity-with-saml', {
38+
testCases: [stack],
39+
});
40+
41+
app.synth();

0 commit comments

Comments
 (0)