Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(apprunner): make Service implement IGrantable #26130

Merged
merged 9 commits into from
Jul 24, 2023

Conversation

lpizzinidev
Copy link
Contributor

@lpizzinidev lpizzinidev commented Jun 27, 2023

Implementing IGrantable for cases when it's needed to grant permissions to a Service instance.

For example:

declare const bucket: IBucket;

const service = new apprunner.Service(this, 'Service', {
    source: apprunner.Source.fromEcrPublic({
        imageConfiguration: { port: 8000 },
        imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
    }),
});

bucket.grantRead(service);

Closes #26089.


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@gitpod-io
Copy link

gitpod-io bot commented Jun 27, 2023

@github-actions github-actions bot added effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p2 admired-contributor [Pilot] contributed between 13-24 PRs to the CDK labels Jun 27, 2023
@aws-cdk-automation aws-cdk-automation requested a review from a team June 27, 2023 08:04
@aws-cdk-automation aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jun 27, 2023
* This method exposes the Instance Role after creating it if not set.
* @returns iam.IRole
*/
public obtainInstanceRole(): iam.IRole {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if we instead made Service implement IGrantable? Then we could just do
things like

bucket.grantRead(service);

@corymhall corymhall removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jun 27, 2023
@corymhall corymhall self-assigned this Jun 27, 2023
@mergify mergify bot dismissed corymhall’s stale review June 28, 2023 07:39

Pull request has been modified.

@lpizzinidev lpizzinidev changed the title chore(apprunner): expose instanceRole from Service instance chore(apprunner): make Service implement IGrantable Jun 28, 2023
Copy link
Contributor

@corymhall corymhall left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you also add an addToRolePolicy method? I'm also going to change this to a feat. Adding the auto creation of the role should cause the integ test to update and we'll need a README update.

@@ -1052,6 +1053,7 @@ export class Service extends cdk.Resource {
this.props = props;

this.instanceRole = this.props.instanceRole;
this.grantPrincipal = this.instanceRole || new iam.UnknownPrincipal({ resource: this });
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should just go ahead and create the role if the user doesn't provide it. I'm not sure why we try to only generate one if needed.

@corymhall corymhall changed the title chore(apprunner): make Service implement IGrantable feat(apprunner): make Service implement IGrantable Jun 29, 2023
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@lpizzinidev
Copy link
Contributor Author

Exemption request.
I've updated the related integration tests.

@aws-cdk-automation aws-cdk-automation added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Jul 15, 2023
mrgrain
mrgrain previously approved these changes Jul 17, 2023
@mrgrain mrgrain added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Jul 17, 2023
@aws-cdk-automation aws-cdk-automation dismissed their stale review July 17, 2023 09:32

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@aws-cdk-automation
Copy link
Collaborator

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

@mergify mergify bot dismissed mrgrain’s stale review July 21, 2023 06:46

Pull request has been modified.

@mergify mergify bot dismissed corymhall’s stale review July 21, 2023 06:46

Pull request has been modified.

@lpizzinidev
Copy link
Contributor Author

Can you also add an addToRolePolicy method? I'm also going to change this to a feat. Adding the auto creation of the role should cause the integ test to update and we'll need a README update.

@corymhall I've implemented the requested changes.

@aws-cdk-automation aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jul 21, 2023
@mergify
Copy link
Contributor

mergify bot commented Jul 24, 2023

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: dfbe8d5
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit 6033c9a into aws:main Jul 24, 2023
5 checks passed
@mergify
Copy link
Contributor

mergify bot commented Jul 24, 2023

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

bmoffatt pushed a commit to bmoffatt/aws-cdk that referenced this pull request Jul 29, 2023
Implementing `IGrantable` for cases when it's needed to grant permissions to a `Service` instance.

For example:
```
declare const bucket: IBucket;

const service = new apprunner.Service(this, 'Service', {
    source: apprunner.Source.fromEcrPublic({
        imageConfiguration: { port: 8000 },
        imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
    }),
});

bucket.grantRead(service);
```

Closes aws#26089.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
admired-contributor [Pilot] contributed between 13-24 PRs to the CDK effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p2 pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. pr-linter/exempt-integ-test The PR linter will not require integ test changes pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

apprunner: Allow instanceRole to be obtained from Service instances.
4 participants