Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(aws-appsync): grant data api access to rds data source #13189

Closed
MrArnoldPalmer opened this issue Feb 22, 2021 · 4 comments · Fixed by #14671
Closed

(aws-appsync): grant data api access to rds data source #13189

MrArnoldPalmer opened this issue Feb 22, 2021 · 4 comments · Fixed by #14671
Assignees
@skinny85 @MrArnoldPalmer
Labels
@aws-cdk/aws-appsync Related to AWS AppSync @aws-cdk/aws-rds Related to Amazon Relational Database effort/small Small work item – less than a day of effort feature/service-integration Add functionality to an L2 construct to enable easier integration with another service feature-request A feature should be added or improved. p2

Comments

@MrArnoldPalmer
Copy link
Contributor

Use Case

Currently, user's need to manually grant access to the RDS serverless cluster data api to their appsync data source that uses it. This can be done when calling addRdsDataSource on the passed in IServerlessCluster using grantDataApiAccess

Proposed Solution

Call grantDataApiAccess on the data source in the body of GraphQLApi.addRdsDataSource.

This is a 🚀 Feature Request
@MrArnoldPalmer MrArnoldPalmer added p2 feature-request A feature should be added or improved. effort/small Small work item – less than a day of effort @aws-cdk/aws-appsync Related to AWS AppSync labels Feb 22, 2021
@MrArnoldPalmer MrArnoldPalmer self-assigned this Feb 22, 2021
@github-actions github-actions bot added the @aws-cdk/aws-rds Related to Amazon Relational Database label Feb 22, 2021
@ericzbeard ericzbeard added the feature/service-integration Add functionality to an L2 construct to enable easier integration with another service label Apr 1, 2021
@BryanPan342
Copy link
Contributor

Currently we are already doing this

aws-cdk/packages/@aws-cdk/aws-appsync/lib/data-source.ts

Lines 351 to 364 in bf16642

// Change to grant with RDS grant becomes implemented
Grant.addToPrincipal({
grantee: this,
actions: [
'rds-data:DeleteItems',
'rds-data:ExecuteSql',
'rds-data:ExecuteStatement',
'rds-data:GetItems',
'rds-data:InsertItems',
'rds-data:UpdateItems',
],
resourceArns: [clusterArn, `${clusterArn}:*`],
scope: this,
});

When I looked into the grantDataApiAccess, I'm not sure if the iam policy is thorough enough?

@BryanPan342
Copy link
Contributor

We would be changing people's deploy if we switched to using the grantDataApiAccess function

@MrArnoldPalmer
Copy link
Contributor Author

@BryanPan342 we need to add grantDataApiAccess in addition to what we already have. This is for aurora serverless usage specifically which requires appsync have access to this data api in order to query the DB.

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/data-api.html

@BryanPan342 BryanPan342 mentioned this issue May 13, 2021
Merged
@mergify mergify bot closed this as completed in #14671 May 13, 2021
mergify bot pushed a commit that referenced this issue May 13, 2021
@BryanPan342
chore(appsync): rds data source service integration with grantDataApi (…
d82de05 
…#14671)

Utilize the `grantDataApi` from RDS to complete service integration.

Fixes: #13189 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@github-actions
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

BenChaimberg added a commit that referenced this issue May 18, 2021
@BenChaimberg
Squashed commit of the following:
55eb290 
commit 35a6202
Author: Ben Chaimberg <[email protected]>
Date:   Tue May 18 10:18:39 2021 -0700

    move supported conditions to function-base and minor name changes

commit 7c6c217
Author: Ben Chaimberg <[email protected]>
Date:   Mon May 17 20:23:55 2021 -0700

    remove extraneous whitespace

commit 02cf427
Author: Ben Chaimberg <[email protected]>
Date:   Mon May 17 17:31:01 2021 -0700

    add conditions snippet to README

commit 8ebf049
Author: Ben Chaimberg <[email protected]>
Date:   Mon May 17 17:22:25 2021 -0700

    format README

commit af2be84
Merge: ea53bcc 8856482
Author: Ben Chaimberg <[email protected]>
Date:   Mon May 17 17:19:14 2021 -0700

    Merge branch 'master' of github.com:aws/aws-cdk into chaimber/lambda_perm_cond

commit ea53bcc
Merge: 988b66c 1a695e2
Author: Ben Chaimberg <[email protected]>
Date:   Mon May 17 17:16:10 2021 -0700

    Merge branch 'chaimber/lambda_perm_cond' of github.com:aws/aws-cdk into chaimber/lambda_perm_cond

commit 988b66c
Author: Ben Chaimberg <[email protected]>
Date:   Mon May 17 17:10:48 2021 -0700

    add documentation for Permission to README

commit 8856482
Author: Elad Ben-Israel <[email protected]>
Date:   Mon May 17 23:19:30 2021 +0300

    chore: set license of eslint-plugin-cdk (#14720)

    Fixes #14594

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit b70a5fa
Author: Carter Van Deuren <[email protected]>
Date:   Mon May 17 11:29:47 2021 -0700

    docs(kinesis): correct grantRead and grantWrite comments (#14707)

    This commit swaps the comments for `grantRead` and `grantWrite` so that the comments match the permissions being granted.

    No extra verification was done for this change, as it only effects comments.

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit f65d826
Author: Jared Short <[email protected]>
Date:   Mon May 17 13:38:57 2021 -0400

    docs(stepfunctions-tasks): fix integration patterns of step-function-task docs (#14722)

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 50d486a
Author: Adam Wong <[email protected]>
Date:   Mon May 17 10:12:49 2021 -0700

    feat(stepfunctions): Add support for ResultSelector (#14648)

    ### Description

    Adds support for `ResultSelector`. [ResultSelector](https://docs.aws.amazon.com/step-functions/latest/dg/input-output-inputpath-params.html#input-output-resultselector) was added to ASL in August 2020 and is currently missing coverage in CDK.

    This change exposes a new `resultSelector` field to Task, Map, and Parallel state props. This is a JSON object that functions similarly to `Parameters` but where `$` refers to the state's raw result instead of the state input. This allows you to reshape the result without using extra Pass states.

    The implementation mimics what exists for Parameters. I'm not convinced we need extra types here.

    #### Example

    ```ts
    new tasks.LambdaInvoke(this, 'Invoke Handler', {
      lambdaFunction: fn,
      resultSelector: {
        lambdaOutput: sfn.JsonPath.stringAt('$.Payload'),
        invokeRequestId: sfn.JsonPath.stringAt('$.SdkResponseMetadata.RequestId'),
        staticValue: 'foo',
      },
    })
    ```

    Which produces the following ASL:

    ```json
    {
      "Type": "Task",
      "Resource": "arn:aws:states:::lambda:invoke",
      "Parameters": {
        "FunctionName": ${functionName},
        "Payload.$": "$"
      },
      "ResultSelector": {
          "lambdaOutput.$": "$.Payload",
          "invokeRequestId.$": "$.SdkResponseMetadata.RequestId",
          "staticValue": "foo",
      },
      "Next": ${nextState}
    }
    ```

    ### Testing
    * Unit tests for Map, Task, and Parallel states to include `resultSelector`
    * Unit test with ResultSelector for `LambdaInvoke` state updated to include `resultSelector`
    * Updated LambdaInvoke integ test to use ResultSelector for one of the states. Executed state machine manually through the AWS console to ensure the example actually works too.

    Closes #9904

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 4da78f6
Author: Kyle Roach <[email protected]>
Date:   Mon May 17 12:45:39 2021 -0400

    feat(apigatewayv2): http api - lambda authorizer (#13181)

    Second part of #10534

    Had to make small changes to `authorizerType` that route expects, since Route and Authorizer enums are not the same. See #10534 (comment).

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 49d18ab
Author: Austin Yattoni <[email protected]>
Date:   Mon May 17 11:18:49 2021 -0500

    fix(lambda): unable to access SingletonFunction vpc connections (#14533)

    fixes #6261

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 8154e91
Author: Nick Lynch <[email protected]>
Date:   Mon May 17 15:29:02 2021 +0100

    chore: skip Go proxy for lambda-go integ tests (#14727)

    Privacy-conscious users and/or organizations may choose to skip sending all
    package requests to the Google proxy (as is default). Some corporate
    environments may block network access to proxy.golang.org altogether.

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 3bca822
Author: Nick Lynch <[email protected]>
Date:   Mon May 17 11:47:57 2021 +0100

    chore(msk): add ignore-assets pragma to cluster integ test (#14725)

    The MSK module relies on custom resources, which in turn create a Lambda
    function with assets. The way the current (lerna/yarn) build works includes
    the .ts file (as well as the .d.ts and .js) files in the asset bundle. Using the
    new `nozem` build (correctly) only includes the .d.ts and .js files, leading to a
    different asset hash.

    Since we don't care about the actual hash anyway, adding the ignore-assets
    pragma so this test can pass with either build tool.

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit fb0977a
Merge: 1effc9f df89694
Author: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Date:   Sat May 15 00:59:26 2021 +0000

    chore(merge-back): 1.104.0 (#14708)

    See [CHANGELOG](https:/aws/aws-cdk/blob/merge-back/1.104.0/CHANGELOG.md)

commit df89694
Merge: 44d3383 1effc9f
Author: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Date:   Sat May 15 00:33:23 2021 +0000

    Merge branch 'master' into merge-back/1.104.0

commit 1effc9f
Author: Hsing-Hui Hsu <[email protected]>
Date:   Fri May 14 15:18:14 2021 -0700

    docs(ecs): add contributing guide (#14672)

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 44d3383
Merge: bc13a66 aaa0d05
Author: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Date:   Fri May 14 21:59:31 2021 +0000

    chore(release): 1.104.0 (#14706)

    See [CHANGELOG](https:/aws/aws-cdk/blob/bump/1.104.0/CHANGELOG.md)

commit aaa0d05
Author: Neta Nir <[email protected]>
Date:   Fri May 14 14:33:52 2021 -0700

    Update CHANGELOG.md

commit 0328b03
Author: AWS CDK Team <[email protected]>
Date:   Fri May 14 21:30:07 2021 +0000

    chore(release): 1.104.0

commit 348e11e
Author: Madeline Kusters <[email protected]>
Date:   Fri May 14 14:27:19 2021 -0700

    fix(ecs): Classes FargateService and Ec2Service have no defaultChild (#14691)

    * fix(ecs): Class FargateService has no defaultChild

    fixes #14665

    * update unit tests

commit 1a695e2
Merge: 84045fd d82de05
Author: Ben Chaimberg <[email protected]>
Date:   Fri May 14 11:45:50 2021 -0700

    Merge branch 'master' into chaimber/lambda_perm_cond

commit d82de05
Author: Bryan Pan <[email protected]>
Date:   Thu May 13 08:48:46 2021 -0700

    chore(appsync): rds data source service integration with grantDataApi (#14671)

    Utilize the `grantDataApi` from RDS to complete service integration.

    Fixes: #13189

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 8296623
Author: Hsing-Hui Hsu <[email protected]>
Date:   Thu May 13 08:22:23 2021 -0700

    test(ecs-patterns): update l3 fargate integ tests (#14668)

    This adds integ tests for NLB fargate services -- previously, there were
    duplicate ALB fargate services being spun up. Also gives integ test
    stacks unique names.

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit b240f6e
Author: Nick Lynch <[email protected]>
Date:   Thu May 13 14:21:05 2021 +0100

    feat(cloudwatch): GraphWidget supports period and statistic (#14679)

    Dashboard metric widgets support overridding/setting both period and stat on the
    widget as a whole. This is often useful in combination with `MathExpression`
    metrics.

    Reference: https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/CloudWatch-Dashboard-Body-Structure.html#CloudWatch-Dashboard-Properties-Metric-Widget-Object

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 3063818
Author: Madeline Kusters <[email protected]>
Date:   Thu May 13 02:29:45 2021 -0700

    fix(events-targets): circular dependency when adding a KMS-encrypted SQS queue  (#14638)

    fixes #11158

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 9d97b7d
Author: Mitchell Valine <[email protected]>
Date:   Thu May 13 02:01:08 2021 -0700

    chore: init templates use node jest environment (#14632)

    Remove usage of the `jsdom` test environment in init templates to speed
    up unit testing by default.

    Testing: ran cdk init --language=(typescript|javascript) against local build of
    CLI then ran yarn test to verify that the testing config was valid and jest correctly
    used the node environment.

    fix: #14630

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 282d242
Author: Adam Ruka <[email protected]>
Date:   Thu May 13 00:37:33 2021 -0700

    chore(custom-resources): import the AWSLambda package explicitly (#14643)

    When linking the aws-cdk repository to a CDK app using the `link-all.sh` script,
    if the app uses `ts-node`,
    the Lambda code in the @aws-cdk/custom-resources package gets picked up by the TypeScript compiler.
    That code relied on the `aws-lambda` package being implicitly available,
    but that would cause `ts-node` to fail.
    Add an explicit import of it in the code -
    I checked the only difference in the generated JS code is the sourceMappingUrl,
    so it shouldn't make a difference at runtime,
    but allows `ts-node` to load that file successfully.

    Fixes #11627

    ----

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

commit 9a4d624
Author: Oliver Bowman <[email protected]>
Date:   Thu May 13 07:40:55 2021 +0100

    docs(lambda-nodejs): Example for esbuild missing comma in property (#13520)

    ----
    Example under esbuild appears to be missing comma.

    *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
hollanddd pushed a commit to hollanddd/aws-cdk that referenced this issue Aug 26, 2021
@BryanPan342 @hollanddd
chore(appsync): rds data source service integration with grantDataApi (…
73eb6e2 
…aws#14671)

Utilize the `grantDataApi` from RDS to complete service integration.

Fixes: aws#13189 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@skinny85 skinny85

@MrArnoldPalmer MrArnoldPalmer

Labels
@aws-cdk/aws-appsync Related to AWS AppSync @aws-cdk/aws-rds Related to Amazon Relational Database effort/small Small work item – less than a day of effort feature/service-integration Add functionality to an L2 construct to enable easier integration with another service feature-request A feature should be added or improved. p2
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

chore(appsync): rds data source service integration with grantDataApi BryanPan342/aws-cdk
4 participants
@skinny85 @ericzbeard @MrArnoldPalmer @BryanPan342