Skip to content

Commit 3e0393e

Browse files
RomainMullerRomainMuller
authored
fix(appsync): incorrect region used for imported Cognito user pool (#20193)
Replaces all uses of `resource.stack.region` with `resource.env.region` so that imported resources can provide a different region than the current stack, wich can result in invalid configuration. Applying the same treatment to occurrences of `resources.stack.account` as this is also surfaced as `resources.env.account`. Fixes #20195 ---- ### All Submissions: * [X] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/master/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 66d5402 commit 3e0393e

File tree

16 files changed

+30
-30
lines changed

16 files changed

+30
-30
lines changed

‎packages/@aws-cdk/aws-apigatewayv2/lib/http/route.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ export class HttpRoute extends Resource implements IHttpRoute {
236236
// path variable and all that follows with a wildcard.
237237
const iamPath = path.replace(/\{.*?\}.*/, '*');
238238

239-
return `arn:aws:execute-api:${this.stack.region}:${this.stack.account}:${this.httpApi.apiId}/${stage}/${iamHttpMethod}${iamPath}`;
239+
return `arn:aws:execute-api:${this.env.region}:${this.env.account}:${this.httpApi.apiId}/${stage}/${iamHttpMethod}${iamPath}`;
240240
}
241241

242242
public grantInvoke(grantee: iam.IGrantable, options: GrantInvokeOptions = {}): iam.Grant {

‎packages/@aws-cdk/aws-appsync/lib/data-source.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ export class DynamoDbDataSource extends BackedDataSource {
219219
type: 'AMAZON_DYNAMODB',
220220
dynamoDbConfig: {
221221
tableName: props.table.tableName,
222-
awsRegion: props.table.stack.region,
222+
awsRegion: props.table.env.region,
223223
useCallerCredentials: props.useCallerCredentials,
224224
},
225225
});
@@ -337,7 +337,7 @@ export class RdsDataSource extends BackedDataSource {
337337
type: 'RELATIONAL_DATABASE',
338338
relationalDatabaseConfig: {
339339
rdsHttpEndpointConfig: {
340-
awsRegion: props.serverlessCluster.stack.region,
340+
awsRegion: props.serverlessCluster.env.region,
341341
dbClusterIdentifier: Lazy.string({
342342
produce: () => {
343343
return Stack.of(this).formatArn({
@@ -399,7 +399,7 @@ export class ElasticsearchDataSource extends BackedDataSource {
399399
super(scope, id, props, {
400400
type: 'AMAZON_ELASTICSEARCH',
401401
elasticsearchConfig: {
402-
awsRegion: props.domain.stack.region,
402+
awsRegion: props.domain.env.region,
403403
endpoint: `https://${props.domain.domainEndpoint}`,
404404
},
405405
});
@@ -426,7 +426,7 @@ export class OpenSearchDataSource extends BackedDataSource {
426426
super(scope, id, props, {
427427
type: 'AMAZON_OPENSEARCH_SERVICE',
428428
openSearchServiceConfig: {
429-
awsRegion: props.domain.stack.region,
429+
awsRegion: props.domain.env.region,
430430
endpoint: `https://${props.domain.domainEndpoint}`,
431431
},
432432
});

‎packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -633,7 +633,7 @@ export class GraphqlApi extends GraphqlApiBase {
633633
if (!config) return undefined;
634634
return {
635635
userPoolId: config.userPool.userPoolId,
636-
awsRegion: config.userPool.stack.region,
636+
awsRegion: config.userPool.env.region,
637637
appIdClientRegex: config.appIdClientRegex,
638638
defaultAction: config.defaultAction || UserPoolDefaultAction.ALLOW,
639639
};

‎packages/@aws-cdk/aws-batch/lib/compute-environment.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -581,7 +581,7 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment
581581
return props.computeResources.spotFleetRole;
582582
} else if (props.computeResources.type === ComputeResourceType.SPOT) {
583583
return iam.Role.fromRoleArn(this, 'Resource-SpotFleet-Role',
584-
`arn:${this.stack.partition}:iam::${this.stack.account}:role/aws-service-role/spotfleet.amazonaws.com/AWSServiceRoleForEC2SpotFleet`);
584+
`arn:${this.stack.partition}:iam::${this.env.account}:role/aws-service-role/spotfleet.amazonaws.com/AWSServiceRoleForEC2SpotFleet`);
585585
}
586586
}
587587

‎packages/@aws-cdk/aws-cloud9/lib/environment.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ export class Ec2Environment extends cdk.Resource implements IEc2Environment {
143143
this.environmentId = c9env.ref;
144144
this.ec2EnvironmentArn = c9env.getAtt('Arn').toString();
145145
this.ec2EnvironmentName = c9env.getAtt('Name').toString();
146-
this.ideUrl = `https://${this.stack.region}.console.aws.amazon.com/cloud9/ide/${this.environmentId}`;
146+
this.ideUrl = `https://${this.env.region}.console.aws.amazon.com/cloud9/ide/${this.environmentId}`;
147147
}
148148
}
149149

‎packages/@aws-cdk/aws-cloudfront/lib/experimental/edge-function.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ export class EdgeFunction extends Resource implements lambda.IVersion {
5555
super(scope, id);
5656

5757
// Create a simple Function if we're already in us-east-1; otherwise create a cross-region stack.
58-
const regionIsUsEast1 = !Token.isUnresolved(this.stack.region) && this.stack.region === 'us-east-1';
58+
const regionIsUsEast1 = !Token.isUnresolved(this.env.region) && this.env.region === 'us-east-1';
5959
const { edgeFunction, edgeArn } = regionIsUsEast1
6060
? this.createInRegionFunction(props)
6161
: this.createCrossRegionFunction(id, props);

‎packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -612,8 +612,8 @@ export class InterfaceVpcEndpoint extends VpcEndpoint implements IInterfaceVpcEn
612612
private validateCanLookupSupportedAzs(subnets: ISubnet[], serviceName: string) {
613613

614614
// Having any of these be true will cause the AZ lookup to fail at synthesis time
615-
const agnosticAcct = Token.isUnresolved(this.stack.account);
616-
const agnosticRegion = Token.isUnresolved(this.stack.region);
615+
const agnosticAcct = Token.isUnresolved(this.env.account);
616+
const agnosticRegion = Token.isUnresolved(this.env.region);
617617
const agnosticService = Token.isUnresolved(serviceName);
618618

619619
// Having subnets with Token AZs can cause the endpoint to be created with no subnets, failing at deployment time

‎packages/@aws-cdk/aws-ecs/lib/base/base-service.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -510,7 +510,7 @@ export abstract class BaseService extends Resource
510510
resources: ['*'],
511511
}));
512512

513-
const logGroupArn = logConfiguration?.cloudWatchLogGroup ? `arn:${this.stack.partition}:logs:${this.stack.region}:${this.stack.account}:log-group:${logConfiguration.cloudWatchLogGroup.logGroupName}:*` : '*';
513+
const logGroupArn = logConfiguration?.cloudWatchLogGroup ? `arn:${this.stack.partition}:logs:${this.env.region}:${this.env.account}:log-group:${logConfiguration.cloudWatchLogGroup.logGroupName}:*` : '*';
514514
this.taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
515515
actions: [
516516
'logs:CreateLogStream',
@@ -558,7 +558,7 @@ export abstract class BaseService extends Resource
558558
'kms:*',
559559
],
560560
resources: ['*'],
561-
principals: [new iam.ArnPrincipal(`arn:${this.stack.partition}:iam::${this.stack.account}:root`)],
561+
principals: [new iam.ArnPrincipal(`arn:${this.stack.partition}:iam::${this.env.account}:root`)],
562562
}));
563563

564564
if (logging === ExecuteCommandLogging.DEFAULT || this.cluster.executeCommandConfiguration?.logConfiguration?.cloudWatchEncryptionEnabled) {
@@ -571,9 +571,9 @@ export abstract class BaseService extends Resource
571571
'kms:Describe*',
572572
],
573573
resources: ['*'],
574-
principals: [new iam.ServicePrincipal(`logs.${this.stack.region}.amazonaws.com`)],
574+
principals: [new iam.ServicePrincipal(`logs.${this.env.region}.amazonaws.com`)],
575575
conditions: {
576-
ArnLike: { 'kms:EncryptionContext:aws:logs:arn': `arn:${this.stack.partition}:logs:${this.stack.region}:${this.stack.account}:*` },
576+
ArnLike: { 'kms:EncryptionContext:aws:logs:arn': `arn:${this.stack.partition}:logs:${this.env.region}:${this.env.account}:*` },
577577
},
578578
}));
579579
}

‎packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-load-balancer.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -266,7 +266,7 @@ export abstract class BaseLoadBalancer extends Resource {
266266
actions: ['s3:PutObject'],
267267
principals: [logsDeliveryServicePrincipal],
268268
resources: [
269-
bucket.arnForObjects(`${prefix ? prefix + '/' : ''}AWSLogs/${this.stack.account}/*`),
269+
bucket.arnForObjects(`${prefix ? prefix + '/' : ''}AWSLogs/${this.env.account}/*`),
270270
],
271271
conditions: {
272272
StringEquals: { 's3:x-amz-acl': 'bucket-owner-full-control' },

‎packages/@aws-cdk/aws-elasticsearch/lib/domain.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1110,7 +1110,7 @@ abstract class DomainBase extends cdk.Resource implements IDomain {
11101110
metricName,
11111111
dimensionsMap: {
11121112
DomainName: this.domainName,
1113-
ClientId: this.stack.account,
1113+
ClientId: this.env.account,
11141114
},
11151115
...props,
11161116
}).attachTo(this);

0 commit comments

Comments
 (0)