Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

chore: add support for IAM Identity Center in security diff #1052

Merged
merged 4 commits into from
Apr 30, 2024
Merged

chore: add support for IAM Identity Center in security diff #1052

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b754f1f
in progress fix
bergjaak Apr 24, 2024
e064961
in progress fix
bergjaak Apr 26, 2024
209010c
Merge branch 'main' of github.com:cdklabs/awscdk-service-spec into Aw…
bergjaak Apr 29, 2024
440922b
Merge branch 'main' into AwsSsoFix
bergjaak Apr 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions packages/@aws-cdk/aws-service-spec/build/scrutinies.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,8 @@ export class Scrutinies {
private autoPropertyScrutiny(propertyName: string, property: Property): PropertyScrutinyType | undefined {
const richDb = new RichSpecDatabase(this.db);

// Detect fields named like ManagedPolicyArns
if (propertyName === 'ManagedPolicyArns') {
// Detect fields named like ManagedPolicyArns or ManagedPolicies (AWS::SSO::PermissionSet, for example)
if (propertyName === 'ManagedPolicyArns' || propertyName === 'ManagedPolicies') {
return PropertyScrutinyType.ManagedPolicies;
}

Expand Down Expand Up @@ -93,6 +93,12 @@ export class Scrutinies {
this.setResourceScrutiny('AWS::EC2::SecurityGroupEgress', ResourceScrutinyType.EgressRuleResource);
this.setPropertyScrutiny('AWS::EC2::SecurityGroup', 'SecurityGroupIngress', PropertyScrutinyType.IngressRules);
this.setPropertyScrutiny('AWS::EC2::SecurityGroup', 'SecurityGroupEgress', PropertyScrutinyType.EgressRules);

// AWS IAM Identity Center (formerly AWS SSO)
// eslint-disable-next-line prettier/prettier
this.setResourceScrutiny('AWS::SSO::InstanceAccessControlAttributeConfiguration', ResourceScrutinyType.SsoInstanceACAConfigResource);
this.setResourceScrutiny('AWS::SSO::Assignment', ResourceScrutinyType.SsoAssignmentResource);
this.setResourceScrutiny('AWS::SSO::PermissionSet', ResourceScrutinyType.SsoPermissionSet);
}

private setResourceScrutiny(cfnType: string, scrutiny: ResourceScrutinyType) {
Expand Down
21 changes: 21 additions & 0 deletions packages/@aws-cdk/service-spec-types/src/types/resource.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -400,6 +400,27 @@ export enum ResourceScrutinyType {
* A set of egress rules
*/
EgressRuleResource = 'EgressRuleResource',

/**
* AWS::SSO::Assignment
*
* IAM Identity Center (formerly known as SSO)
*/
SsoAssignmentResource = 'SsoAssignmentResource',

/**
* AWS::SSO::InstanceAccessControlAttributeConfiguration
*
* IAM Identity Center (formerly known as SSO)
*/
SsoInstanceACAConfigResource = 'SsoInstanceACAConfigResource',

/**
* AWS::SSO::PermissionSet
*
* IAM Identity Center (formerly known as SSO)
*/
SsoPermissionSet = 'SsoPermissionSet',
}

/**
Expand Down
Loading