Skip to content

Commit c9b2548

Browse files
rix0rrrrix0rrr
authored
fix(aws-custom-resource): switch off installLatestAwsSdk by default (#23591)
The `AwsCustomResource` reaches out to the internet to install the latest AWS SDK by default. This will make it fail if it is being bound to a VPC that doesn't have internet connectivity, or in regions/partitions that are not able to freely connect to `npmjs.com`. This was a poorly chosen default from the time we didn't know any better, but we do know right now. Switch the behavior off by default (under feature flag), and explicitly disable it for all `AwsCustomResource`s the L2 library uses. Lambda advertises 2.1055.0 of the SDK everywhere, and I checked to make sure that all APIs we use are part of that SDK version, so we don't need any newer version. That version is a year old (!) so this is not the end of the story, but it's at least an improvement over what we currently have. Fixes #23113. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 2dfaaf4 commit c9b2548

File tree

421 files changed

+49757
-5081
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

421 files changed

+49757
-5081
lines changed

‎packages/@aws-cdk/aws-codedeploy/lib/lambda/custom-deployment-config.ts

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,8 @@ export class CustomLambdaDeploymentConfig extends Resource implements ILambdaDep
151151
policy: AwsCustomResourcePolicy.fromSdkCalls({
152152
resources: AwsCustomResourcePolicy.ANY_RESOURCE,
153153
}),
154+
// APIs are available in 2.1055.0
155+
installLatestAwsSdk: false,
154156
});
155157

156158
this.node.addValidation({ validate: () => validateName('Deployment config', this.deploymentConfigName) });

‎packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -464,6 +464,8 @@ export class UserPoolClient extends Resource implements IUserPoolClient {
464464
policy: AwsCustomResourcePolicy.fromSdkCalls({
465465
resources: [this.userPool.userPoolArn],
466466
}),
467+
// APIs are available in 2.1055.0
468+
installLatestAwsSdk: false,
467469
},
468470
).getResponseField('UserPoolClient.ClientSecret'));
469471
}

‎packages/@aws-cdk/aws-cognito/lib/user-pool-domain.ts

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,8 @@ export class UserPoolDomain extends Resource implements IUserPoolDomain {
145145
// https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncognitouserpools.html#amazoncognitouserpools-actions-as-permissions
146146
resources: ['*'],
147147
}),
148+
// APIs are available in 2.1055.0
149+
installLatestAwsSdk: false,
148150
});
149151
}
150152
return this.cloudFrontCustomResource.getResponseField('DomainDescription.CloudFrontDistribution');

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.js.snapshot/cdk.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"21.0.0"}
1+
{"version":"22.0.0"}

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.js.snapshot/integ-user-pool-client-explicit-props.assets.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "21.0.0",
2+
"version": "22.0.0",
33
"files": {
44
"a268caa53756f51bda8ad5f499be4ed8484a81b314811806fbb66f874837c476": {
55
"source": {
@@ -14,15 +14,15 @@
1414
}
1515
}
1616
},
17-
"c2d925005ce1ea0db47e73cb0e76cc9f0f9347ede3ba8abe8f0768effe102872": {
17+
"be03a3e392c69c83e42480095a0bbc5f0bb315abc56be4db3af345689cf1505a": {
1818
"source": {
1919
"path": "integ-user-pool-client-explicit-props.template.json",
2020
"packaging": "file"
2121
},
2222
"destinations": {
2323
"current_account-current_region": {
2424
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25-
"objectKey": "c2d925005ce1ea0db47e73cb0e76cc9f0f9347ede3ba8abe8f0768effe102872.json",
25+
"objectKey": "be03a3e392c69c83e42480095a0bbc5f0bb315abc56be4db3af345689cf1505a.json",
2626
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
2727
}
2828
}

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.js.snapshot/integ-user-pool-client-explicit-props.template.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@
132132
]
133133
]
134134
},
135-
"InstallLatestAwsSdk": true
135+
"InstallLatestAwsSdk": false
136136
},
137137
"DependsOn": [
138138
"myuserpoolmyuserpoolclientDescribeCognitoUserPoolClientCustomResourcePolicyF83BED40"

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.js.snapshot/integ.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "21.0.0",
2+
"version": "22.0.0",
33
"testCases": {
44
"integ.user-pool-client-explicit-props": {
55
"stacks": [

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.js.snapshot/manifest.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "21.0.0",
2+
"version": "22.0.0",
33
"artifacts": {
44
"integ-user-pool-client-explicit-props.assets": {
55
"type": "cdk:asset-manifest",
@@ -17,7 +17,7 @@
1717
"validateOnSynth": false,
1818
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
1919
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/c2d925005ce1ea0db47e73cb0e76cc9f0f9347ede3ba8abe8f0768effe102872.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/be03a3e392c69c83e42480095a0bbc5f0bb315abc56be4db3af345689cf1505a.json",
2121
"requiresBootstrapStackVersion": 6,
2222
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2323
"additionalDependencies": [

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-client-explicit-props.js.snapshot/tree.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -398,7 +398,7 @@
398398
"path": "Tree",
399399
"constructInfo": {
400400
"fqn": "constructs.Construct",
401-
"version": "10.1.161"
401+
"version": "10.1.189"
402402
}
403403
}
404404
},

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-domain-cfdist.js.snapshot/asset.105b4f39ae68785e705640aa91919e412fcba2dd454aca53412747be8d955286/index.js

Lines changed: 0 additions & 252 deletions
This file was deleted.

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-domain-cfdist.js.snapshot/asset.a268caa53756f51bda8ad5f499be4ed8484a81b314811806fbb66f874837c476/index.js

Lines changed: 253 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-domain-cfdist.js.snapshot/cdk.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"20.0.0"}
1+
{"version":"22.0.0"}

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-domain-cfdist.js.snapshot/integ-user-pool-domain-cfdist.assets.json

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,28 @@
11
{
2-
"version": "20.0.0",
2+
"version": "22.0.0",
33
"files": {
4-
"105b4f39ae68785e705640aa91919e412fcba2dd454aca53412747be8d955286": {
4+
"a268caa53756f51bda8ad5f499be4ed8484a81b314811806fbb66f874837c476": {
55
"source": {
6-
"path": "asset.105b4f39ae68785e705640aa91919e412fcba2dd454aca53412747be8d955286",
6+
"path": "asset.a268caa53756f51bda8ad5f499be4ed8484a81b314811806fbb66f874837c476",
77
"packaging": "zip"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "105b4f39ae68785e705640aa91919e412fcba2dd454aca53412747be8d955286.zip",
12+
"objectKey": "a268caa53756f51bda8ad5f499be4ed8484a81b314811806fbb66f874837c476.zip",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}
1616
},
17-
"10f00fba7097b5565c66640c64d9c8fa001e6fd23004b93a7aa44290e05c7bdf": {
17+
"c6b930c3a3c8cafda335e618b6c13046a02e9bcee0cd4a5b43521710670f651e": {
1818
"source": {
1919
"path": "integ-user-pool-domain-cfdist.template.json",
2020
"packaging": "file"
2121
},
2222
"destinations": {
2323
"current_account-current_region": {
2424
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25-
"objectKey": "10f00fba7097b5565c66640c64d9c8fa001e6fd23004b93a7aa44290e05c7bdf.json",
25+
"objectKey": "c6b930c3a3c8cafda335e618b6c13046a02e9bcee0cd4a5b43521710670f651e.json",
2626
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
2727
}
2828
}

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-domain-cfdist.js.snapshot/integ-user-pool-domain-cfdist.template.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@
8181
]
8282
]
8383
},
84-
"InstallLatestAwsSdk": true
84+
"InstallLatestAwsSdk": false
8585
},
8686
"DependsOn": [
8787
"UserPoolDomainCloudFrontDomainNameCustomResourcePolicy7DE54188"
@@ -148,7 +148,7 @@
148148
"S3Bucket": {
149149
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
150150
},
151-
"S3Key": "105b4f39ae68785e705640aa91919e412fcba2dd454aca53412747be8d955286.zip"
151+
"S3Key": "a268caa53756f51bda8ad5f499be4ed8484a81b314811806fbb66f874837c476.zip"
152152
},
153153
"Role": {
154154
"Fn::GetAtt": [

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-domain-cfdist.js.snapshot/integ.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "20.0.0",
2+
"version": "22.0.0",
33
"testCases": {
44
"integ.user-pool-domain-cfdist": {
55
"stacks": [

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-domain-cfdist.js.snapshot/manifest.json

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
{
2-
"version": "20.0.0",
2+
"version": "22.0.0",
33
"artifacts": {
4-
"Tree": {
5-
"type": "cdk:tree",
6-
"properties": {
7-
"file": "tree.json"
8-
}
9-
},
104
"integ-user-pool-domain-cfdist.assets": {
115
"type": "cdk:asset-manifest",
126
"properties": {
@@ -23,7 +17,7 @@
2317
"validateOnSynth": false,
2418
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
2519
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/10f00fba7097b5565c66640c64d9c8fa001e6fd23004b93a7aa44290e05c7bdf.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/c6b930c3a3c8cafda335e618b6c13046a02e9bcee0cd4a5b43521710670f651e.json",
2721
"requiresBootstrapStackVersion": 6,
2822
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2923
"additionalDependencies": [
@@ -101,6 +95,12 @@
10195
]
10296
},
10397
"displayName": "integ-user-pool-domain-cfdist"
98+
},
99+
"Tree": {
100+
"type": "cdk:tree",
101+
"properties": {
102+
"file": "tree.json"
103+
}
104104
}
105105
}
106106
}

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-domain-cfdist.js.snapshot/tree.json

Lines changed: 46 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,6 @@
44
"id": "App",
55
"path": "",
66
"children": {
7-
"Tree": {
8-
"id": "Tree",
9-
"path": "Tree",
10-
"constructInfo": {
11-
"fqn": "constructs.Construct",
12-
"version": "10.1.85"
13-
}
14-
},
157
"integ-user-pool-domain-cfdist": {
168
"id": "integ-user-pool-domain-cfdist",
179
"path": "integ-user-pool-domain-cfdist",
@@ -98,14 +90,14 @@
9890
"id": "Default",
9991
"path": "integ-user-pool-domain-cfdist/UserPool/Domain/CloudFrontDomainName/Resource/Default",
10092
"constructInfo": {
101-
"fqn": "constructs.Construct",
102-
"version": "10.1.85"
93+
"fqn": "@aws-cdk/core.CfnResource",
94+
"version": "0.0.0"
10395
}
10496
}
10597
},
10698
"constructInfo": {
107-
"fqn": "constructs.Construct",
108-
"version": "10.1.85"
99+
"fqn": "@aws-cdk/core.CustomResource",
100+
"version": "0.0.0"
109101
}
110102
},
111103
"CustomResourcePolicy": {
@@ -169,8 +161,8 @@
169161
"id": "Domain",
170162
"path": "integ-user-pool-domain-cfdist/Domain",
171163
"constructInfo": {
172-
"fqn": "constructs.Construct",
173-
"version": "10.1.85"
164+
"fqn": "@aws-cdk/core.CfnOutput",
165+
"version": "0.0.0"
174166
}
175167
},
176168
"AWS679f53fac002430cb0da5b7982bd2287": {
@@ -181,6 +173,14 @@
181173
"id": "ServiceRole",
182174
"path": "integ-user-pool-domain-cfdist/AWS679f53fac002430cb0da5b7982bd2287/ServiceRole",
183175
"children": {
176+
"ImportServiceRole": {
177+
"id": "ImportServiceRole",
178+
"path": "integ-user-pool-domain-cfdist/AWS679f53fac002430cb0da5b7982bd2287/ServiceRole/ImportServiceRole",
179+
"constructInfo": {
180+
"fqn": "@aws-cdk/core.Resource",
181+
"version": "0.0.0"
182+
}
183+
},
184184
"Resource": {
185185
"id": "Resource",
186186
"path": "integ-user-pool-domain-cfdist/AWS679f53fac002430cb0da5b7982bd2287/ServiceRole/Resource",
@@ -234,8 +234,8 @@
234234
"id": "Stage",
235235
"path": "integ-user-pool-domain-cfdist/AWS679f53fac002430cb0da5b7982bd2287/Code/Stage",
236236
"constructInfo": {
237-
"fqn": "constructs.Construct",
238-
"version": "10.1.85"
237+
"fqn": "@aws-cdk/core.AssetStaging",
238+
"version": "0.0.0"
239239
}
240240
},
241241
"AssetBucket": {
@@ -262,7 +262,7 @@
262262
"s3Bucket": {
263263
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
264264
},
265-
"s3Key": "105b4f39ae68785e705640aa91919e412fcba2dd454aca53412747be8d955286.zip"
265+
"s3Key": "a268caa53756f51bda8ad5f499be4ed8484a81b314811806fbb66f874837c476.zip"
266266
},
267267
"role": {
268268
"Fn::GetAtt": [
@@ -290,20 +290,44 @@
290290
"id": "CloudFrontDomainName",
291291
"path": "integ-user-pool-domain-cfdist/CloudFrontDomainName",
292292
"constructInfo": {
293-
"fqn": "constructs.Construct",
294-
"version": "10.1.85"
293+
"fqn": "@aws-cdk/core.CfnOutput",
294+
"version": "0.0.0"
295+
}
296+
},
297+
"BootstrapVersion": {
298+
"id": "BootstrapVersion",
299+
"path": "integ-user-pool-domain-cfdist/BootstrapVersion",
300+
"constructInfo": {
301+
"fqn": "@aws-cdk/core.CfnParameter",
302+
"version": "0.0.0"
303+
}
304+
},
305+
"CheckBootstrapVersion": {
306+
"id": "CheckBootstrapVersion",
307+
"path": "integ-user-pool-domain-cfdist/CheckBootstrapVersion",
308+
"constructInfo": {
309+
"fqn": "@aws-cdk/core.CfnRule",
310+
"version": "0.0.0"
295311
}
296312
}
297313
},
314+
"constructInfo": {
315+
"fqn": "@aws-cdk/core.Stack",
316+
"version": "0.0.0"
317+
}
318+
},
319+
"Tree": {
320+
"id": "Tree",
321+
"path": "Tree",
298322
"constructInfo": {
299323
"fqn": "constructs.Construct",
300-
"version": "10.1.85"
324+
"version": "10.1.189"
301325
}
302326
}
303327
},
304328
"constructInfo": {
305-
"fqn": "constructs.Construct",
306-
"version": "10.1.85"
329+
"fqn": "@aws-cdk/core.App",
330+
"version": "0.0.0"
307331
}
308332
}
309333
}

‎packages/@aws-cdk/aws-cognito/test/user-pool-client.test.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ describe('User Pool Client', () => {
9393
],
9494
],
9595
},
96-
InstallLatestAwsSdk: true,
96+
InstallLatestAwsSdk: false,
9797
});
9898

9999
Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {

0 commit comments

Comments
 (0)