Merge branch 'master' into iotevents-rest-events

.github/workflows/cr-checklist.yml

@@ -9,7 +9,7 @@ jobs:
  name: Creates a checklist for PRs that contain changes to custom resources
  steps:
  - name: Checkout repo
- uses: actions/checkout@v2
+ uses: actions/checkout@v3
  - name: Dynamic checklist action
  uses: vishalsinha21/dynamic-checklist@v1
  with:

.github/workflows/pr-linter.yml

@@ -21,7 +21,7 @@ jobs:
  steps:
 
  - name: Checkout
- uses: actions/checkout@v2
+ uses: actions/checkout@v3
 
  - name: Install & Build prlint
  run: yarn install --frozen-lockfile && cd tools/@aws-cdk/prlint && yarn build+test

.github/workflows/v2-pull-request.yml

@@ -23,7 +23,7 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: checkout
- uses: actions/checkout@v2
+ uses: actions/checkout@v3
  with:
  branch: ${{ github.event.pull_request.head.ref }}
  token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/yarn-upgrade.yml

@@ -15,7 +15,7 @@ jobs:
  steps:
 
  - name: Check Out
- uses: actions/checkout@v2
+ uses: actions/checkout@v3
 
  - name: Set up Node
  uses: actions/setup-node@v3
@@ -87,7 +87,7 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: Check Out
- uses: actions/checkout@v2
+ uses: actions/checkout@v3
 
  - name: Download patch
  uses: actions/download-artifact@v2

packages/@aws-cdk/aws-apigateway/lib/integrations/stepfunctions.ts

@@ -203,7 +203,7 @@ function integrationResponse() {
  '#if($input.path(\'$.status\').toString().equals("FAILED"))', 
  '#set($context.responseOverride.status = 500)', 
  '{',
- '"error": "$input.path(\'$.error\')"',
+ '"error": "$input.path(\'$.error\')",',
  '"cause": "$input.path(\'$.cause\')"',
  '}',
  '#else',

packages/@aws-cdk/aws-apigateway/test/integ.stepfunctions-api.expected.json

@@ -160,7 +160,7 @@
  "IntegrationResponses": [
  {
  "ResponseTemplates": {
- "application/json": "#set($inputRoot = $input.path('$'))\n#if($input.path('$.status').toString().equals(\"FAILED\"))\n#set($context.responseOverride.status = 500)\n{\n\"error\": \"$input.path('$.error')\"\n\"cause\": \"$input.path('$.cause')\"\n}\n#else\n$input.path('$.output')\n#end"
+ "application/json": "#set($inputRoot = $input.path('$'))\n#if($input.path('$.status').toString().equals(\"FAILED\"))\n#set($context.responseOverride.status = 500)\n{\n\"error\": \"$input.path('$.error')\",\n\"cause\": \"$input.path('$.cause')\"\n}\n#else\n$input.path('$.output')\n#end"
  },
  "StatusCode": "200"
  },

packages/@aws-cdk/aws-apigateway/test/integrations/stepfunctions.test.ts

@@ -418,7 +418,7 @@ function getIntegrationResponse() {
  '#if($input.path(\'$.status\').toString().equals("FAILED"))',
  '#set($context.responseOverride.status = 500)',
  '{',
- '"error": "$input.path(\'$.error\')"',
+ '"error": "$input.path(\'$.error\')",',
  '"cause": "$input.path(\'$.cause\')"',
  '}',
  '#else',

packages/@aws-cdk/aws-apigateway/test/stepfunctions-api.test.ts

@@ -181,7 +181,7 @@ function getIntegrationResponse() {
  '#if($input.path(\'$.status\').toString().equals("FAILED"))',
  '#set($context.responseOverride.status = 500)',
  '{',
- '"error": "$input.path(\'$.error\')"',
+ '"error": "$input.path(\'$.error\')",',
  '"cause": "$input.path(\'$.cause\')"',
  '}',
  '#else',

packages/@aws-cdk/aws-apigatewayv2-integrations/lib/http/lambda.ts

@@ -50,7 +50,7 @@ export class HttpLambdaIntegration extends HttpRouteIntegration {
  this._id = id;
  }
 
- public bind(options: HttpRouteIntegrationBindOptions): HttpRouteIntegrationConfig {
+ protected completeBind(options: HttpRouteIntegrationBindOptions) {
  const route = options.route;
  this.handler.addPermission(`${this._id}-Permission`, {
  scope: options.scope,
@@ -61,7 +61,9 @@ export class HttpLambdaIntegration extends HttpRouteIntegration {
  resourceName: `*/*${route.path ?? ''}`, // empty string in the case of the catch-all route $default
  }),
  });
+ }
 
+ public bind(_: HttpRouteIntegrationBindOptions): HttpRouteIntegrationConfig {
  return {
  type: HttpIntegrationType.AWS_PROXY,
  uri: this.handler.functionArn,

packages/@aws-cdk/aws-apigatewayv2-integrations/test/http/lambda.test.ts

@@ -1,4 +1,4 @@
-import { Template } from '@aws-cdk/assertions';
+import { Match, Template } from '@aws-cdk/assertions';
 import { HttpApi, HttpRoute, HttpRouteKey, MappingValue, ParameterMapping, PayloadFormatVersion } from '@aws-cdk/aws-apigatewayv2';
 import { Code, Function, Runtime } from '@aws-cdk/aws-lambda';
 import { App, Stack } from '@aws-cdk/core';
@@ -71,6 +71,41 @@ describe('LambdaProxyIntegration', () => {
 
  expect(() => app.synth()).not.toThrow();
  });
+
+ test('multiple routes for the same lambda integration', () => {
+ const app = new App();
+ const lambdaStack = new Stack(app, 'lambdaStack');
+ const fooFn = fooFunction(lambdaStack, 'Fn');
+
+ const stack = new Stack(app, 'apigwStack');
+ const api = new HttpApi(stack, 'httpApi');
+ const integration = new HttpLambdaIntegration('Integration', fooFn);
+
+ api.addRoutes({
+ path: '/foo',
+ integration,
+ });
+
+ api.addRoutes({
+ path: '/bar',
+ integration,
+ });
+
+ // Make sure we have two permissions -- one for each method -- but a single integration
+ Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Permission', {
+ SourceArn: {
+ 'Fn::Join': ['', Match.arrayWith([':execute-api:', '/*/*/foo'])],
+ },
+ });
+
+ Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Permission', {
+ SourceArn: {
+ 'Fn::Join': ['', Match.arrayWith([':execute-api:', '/*/*/bar'])],
+ },
+ });
+
+ Template.fromStack(stack).resourceCountIs('AWS::ApiGatewayV2::Integration', 1);
+ });
 });
 
 function fooFunction(stack: Stack, id: string) {

packages/@aws-cdk/aws-apigatewayv2/lib/http/integration.ts

@@ -332,9 +332,22 @@ export abstract class HttpRouteIntegration {
  credentials: config.credentials,
  });
  }
+ this.completeBind(options);
  return { integrationId: this.integration.integrationId };
  }
 
+ /**
+ * Complete the binding of the integration to the route. In some cases, there is
+ * some additional work to do, such as adding permissions for the API to access
+ * the target. This work is necessary whether the integration has just been
+ * created for this route or it is an existing one, previously created for other
+ * routes. In most cases, however, concrete implementations do not need to
+ * override this method.
+ */
+ protected completeBind(_options: HttpRouteIntegrationBindOptions): void {
+ // no-op by default
+ }
+
  /**
  * Bind this integration to the route.
  */

packages/@aws-cdk/aws-codebuild/README.md

@@ -280,11 +280,12 @@ can use the `environment` property to customize the build environment:
 ## Images
 
 The CodeBuild library supports both Linux and Windows images via the
-`LinuxBuildImage` and `WindowsBuildImage` classes, respectively.
+`LinuxBuildImage` (or `LinuxArmBuildImage`), and `WindowsBuildImage` classes, respectively.
 
 You can specify one of the predefined Windows/Linux images by using one
 of the constants such as `WindowsBuildImage.WIN_SERVER_CORE_2019_BASE`,
-`WindowsBuildImage.WINDOWS_BASE_2_0` or `LinuxBuildImage.STANDARD_2_0`.
+`WindowsBuildImage.WINDOWS_BASE_2_0`, `LinuxBuildImage.STANDARD_2_0`, or
+`LinuxArmBuildImage.AMAZON_LINUX_2_ARM`.
 
 Alternatively, you can specify a custom image using one of the static methods on
 `LinuxBuildImage`:
@@ -302,6 +303,10 @@ or one of the corresponding methods on `WindowsBuildImage`:
 * `WindowsBuildImage.fromEcrRepository(repo[, tag, imageType])`
 * `WindowsBuildImage.fromAsset(parent, id, props, [, imageType])`
 
+or one of the corresponding methods on `LinuxArmBuildImage`:
+
+* `LinuxArmBuildImage.fromEcrRepository(repo[, tag])`
+
 Note that the `WindowsBuildImage` version of the static methods accepts an optional parameter of type `WindowsImageType`,
 which can be either `WindowsImageType.STANDARD`, the default, or `WindowsImageType.SERVER_2019`:
 

packages/@aws-cdk/aws-codebuild/lib/index.ts

@@ -11,6 +11,7 @@ export * from './build-spec';
 export * from './file-location';
 export * from './linux-gpu-build-image';
 export * from './untrusted-code-boundary-policy';
+export * from './linux-arm-build-image';
 
 // AWS::CodeBuild CloudFormation Resources:
 export * from './codebuild.generated';

packages/@aws-cdk/aws-codebuild/lib/linux-arm-build-image.ts

@@ -0,0 +1,105 @@
+import * as ecr from '@aws-cdk/aws-ecr';
+import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
+import { BuildSpec } from './build-spec';
+import { runScriptLinuxBuildSpec } from './private/run-script-linux-build-spec';
+import { BuildEnvironment, ComputeType, IBuildImage, ImagePullPrincipalType } from './project';
+
+/**
+ * Construction properties of {@link LinuxArmBuildImage}.
+ * Module-private, as the constructor of {@link LinuxArmBuildImage} is private.
+ */
+interface LinuxArmBuildImageProps {
+ readonly imageId: string;
+ readonly imagePullPrincipalType?: ImagePullPrincipalType;
+ readonly secretsManagerCredentials?: secretsmanager.ISecret;
+ readonly repository?: ecr.IRepository;
+}
+
+/**
+ * A CodeBuild image running aarch64 Linux.
+ *
+ * This class has a bunch of public constants that represent the CodeBuild ARM images.
+ *
+ * You can also specify a custom image using the static method:
+ *
+ * - LinuxBuildImage.fromEcrRepository(repo[, tag])
+ *
+ *
+ * @see https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-available.html
+ */
+export class LinuxArmBuildImage implements IBuildImage {
+ /** Image "aws/codebuild/amazonlinux2-aarch64-standard:1.0". */
+ public static readonly AMAZON_LINUX_2_STANDARD_1_0 = LinuxArmBuildImage.fromCodeBuildImageId('aws/codebuild/amazonlinux2-aarch64-standard:1.0');
+ /** Image "aws/codebuild/amazonlinux2-aarch64-standard:2.0". */
+ public static readonly AMAZON_LINUX_2_STANDARD_2_0 = LinuxArmBuildImage.fromCodeBuildImageId('aws/codebuild/amazonlinux2-aarch64-standard:2.0');
+
+ /**
+ * Returns an ARM image running Linux from an ECR repository.
+ *
+ * NOTE: if the repository is external (i.e. imported), then we won't be able to add
+ * a resource policy statement for it so CodeBuild can pull the image.
+ *
+ * @see https://docs.aws.amazon.com/codebuild/latest/userguide/sample-ecr.html
+ *
+ * @param repository The ECR repository
+ * @param tag Image tag (default "latest")
+ * @returns An aarch64 Linux build image from an ECR repository.
+ */
+ public static fromEcrRepository(repository: ecr.IRepository, tag: string = 'latest'): IBuildImage {
+ return new LinuxArmBuildImage({
+ imageId: repository.repositoryUriForTag(tag),
+ imagePullPrincipalType: ImagePullPrincipalType.SERVICE_ROLE,
+ repository,
+ });
+ }
+
+ /**
+ * Uses a Docker image provided by CodeBuild.
+ *
+ * @see https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-available.html
+ *
+ * @param id The image identifier
+ * @example 'aws/codebuild/amazonlinux2-aarch64-standard:1.0'
+ * @returns A Docker image provided by CodeBuild.
+ */
+ public static fromCodeBuildImageId(id: string): IBuildImage {
+ return new LinuxArmBuildImage({
+ imageId: id,
+ imagePullPrincipalType: ImagePullPrincipalType.CODEBUILD,
+ });
+ }
+
+ public readonly type = 'ARM_CONTAINER';
+ public readonly defaultComputeType = ComputeType.LARGE;
+ public readonly imageId: string;
+ public readonly imagePullPrincipalType?: ImagePullPrincipalType;
+ public readonly secretsManagerCredentials?: secretsmanager.ISecret;
+ public readonly repository?: ecr.IRepository;
+
+ private constructor(props: LinuxArmBuildImageProps) {
+ this.imageId = props.imageId;
+ this.imagePullPrincipalType = props.imagePullPrincipalType;
+ this.secretsManagerCredentials = props.secretsManagerCredentials;
+ this.repository = props.repository;
+ }
+
+ /**
+ * Validates by checking the BuildEnvironment computeType as aarch64 images only support ComputeType.SMALL and
+ * ComputeType.LARGE
+ * @param buildEnvironment BuildEnvironment
+ */
+ public validate(buildEnvironment: BuildEnvironment): string[] {
+ const ret = [];
+ if (buildEnvironment.computeType &&
+ buildEnvironment.computeType !== ComputeType.SMALL &&
+ buildEnvironment.computeType !== ComputeType.LARGE) {
+ ret.push(`ARM images only support ComputeTypes '${ComputeType.SMALL}' and '${ComputeType.LARGE}' - ` +
+ `'${buildEnvironment.computeType}' was given`);
+ }
+ return ret;
+ }
+
+ public runScriptBuildspec(entrypoint: string): BuildSpec {
+ return runScriptLinuxBuildSpec(entrypoint);
+ }
+}