Skip to content

Commit

Permalink
fix: SecretsManagerRotationEnabled is non compliant after cdk v2.116.0 (
Browse files Browse the repository at this point in the history
#1566)

Fixes #1565 

Bumped CDK to v2.116.0 to reproduce the problem.
Changed some cloud9 tests as well because a parameter became required.

Changed `SecretsManagerRotationEnabled` rule to compliant state when either `AutomaticallyAfterDays` or `ScheduleExpression` exists.
see: https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-rotationrules.html#cfn-secretsmanager-rotationschedule-rotationrules-scheduleexpression

Existing SecretManager tests are not changed because just updating CDK version is enough to reproduce the error.
  • Loading branch information
clueleaf authored Jan 18, 2024
1 parent f5c8d49 commit d557683
Show file tree
Hide file tree
Showing 6 changed files with 42 additions and 25 deletions.
2 changes: 1 addition & 1 deletion .projen/deps.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .projenrc.js
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ const { awscdk, vscode, Task } = require('projen');
const project = new awscdk.AwsCdkConstructLibrary({
author: 'Arun Donti',
authorAddress: 'donti@amazon.com',
cdkVersion: '2.78.0',
cdkVersion: '2.116.0',
defaultReleaseBranch: 'main',
majorVersion: 2,
npmDistTag: 'latest',
Expand Down
4 changes: 2 additions & 2 deletions package.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 7 additions & 1 deletion src/rules/secretsmanager/SecretsManagerRotationEnabled.ts
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,13 @@ function isMatchingRotationSchedule(
const automaticallyAfterDays = Stack.of(node).resolve(
rotationRules.automaticallyAfterDays
);
if (automaticallyAfterDays !== undefined) {
const scheduleExpression = Stack.of(node).resolve(
rotationRules.scheduleExpression
);
if (
automaticallyAfterDays !== undefined ||
scheduleExpression !== undefined
) {
return true;
}
}
Expand Down
2 changes: 2 additions & 0 deletions test/rules/Cloud9.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ describe('AWS Cloud9', () => {
const ruleId = 'Cloud9InstanceNoIngressSystemsManager';
test('Noncompliance ', () => {
new CfnEnvironmentEC2(stack, 'rC9Env', {
imageId: 'ami-123456',
instanceType: InstanceType.of(
InstanceClass.T2,
InstanceSize.MICRO
Expand All @@ -31,6 +32,7 @@ describe('AWS Cloud9', () => {

test('Compliance', () => {
new CfnEnvironmentEC2(stack, 'rC9Env', {
imageId: 'ami-123456',
instanceType: InstanceType.of(
InstanceClass.T2,
InstanceSize.MICRO
Expand Down
49 changes: 29 additions & 20 deletions yarn.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit d557683

Please # to comment.