Skip to content

Commit

Permalink
chore(appsync): rds data source service integration with grantDataApi (
Browse files Browse the repository at this point in the history
…aws#14671)

Utilize the `grantDataApi` from RDS to complete service integration.

Fixes: aws#13189 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
  • Loading branch information
BryanPan342 authored and hollanddd committed Aug 26, 2021
1 parent 2ca6c31 commit 73eb6e2
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 2 deletions.
4 changes: 3 additions & 1 deletion packages/@aws-cdk/aws-appsync/lib/data-source.ts
Original file line number Diff line number Diff line change
Expand Up @@ -350,12 +350,14 @@ export class RdsDataSource extends BackedDataSource {
props.secretStore.grantRead(this);

// Change to grant with RDS grant becomes implemented

props.serverlessCluster.grantDataApiAccess(this);

Grant.addToPrincipal({
grantee: this,
actions: [
'rds-data:DeleteItems',
'rds-data:ExecuteSql',
'rds-data:ExecuteStatement',
'rds-data:GetItems',
'rds-data:InsertItems',
'rds-data:UpdateItems',
Expand Down
20 changes: 19 additions & 1 deletion packages/@aws-cdk/aws-appsync/test/appsync-rds.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -58,11 +58,29 @@ describe('Rds Data Source configuration', () => {
Effect: 'Allow',
Resource: { Ref: 'AuroraSecret41E6E877' },
},
{
Action: [
'rds-data:BatchExecuteStatement',
'rds-data:BeginTransaction',
'rds-data:CommitTransaction',
'rds-data:ExecuteStatement',
'rds-data:RollbackTransaction',
],
Effect: 'Allow',
Resource: '*',
},
{
Action: [
'secretsmanager:GetSecretValue',
'secretsmanager:DescribeSecret',
],
Effect: 'Allow',
Resource: { Ref: 'AuroraClusterSecretAttachmentDB8032DA' },
},
{
Action: [
'rds-data:DeleteItems',
'rds-data:ExecuteSql',
'rds-data:ExecuteStatement',
'rds-data:GetItems',
'rds-data:InsertItems',
'rds-data:UpdateItems',
Expand Down

0 comments on commit 73eb6e2

Please sign in to comment.