Add custom role to cloudwatch event which trigger step functions

[bucha09]

Possible fix for this issue #306 It allows to add already created role to CloudWatch event

[theburningmonk]

@bucha09 LGTM and should work, can you add some tests around it?

[bucha09]

@bucha09 LGTM and should work, can you add some tests around it?

Made some research and add some fixes to code. It'll use iamRole when it defined in serverless.yml or if not defined, then leave as it was (create new role).
example:

Made some research and add some fixes to code. It'll use iamRole when it defined in serverless.yml or if not defined, then leave as it was (create new role).
example:

cloudwatchEvent:

    name: SwapApproveOrReject-${opt:stage}
        #iamRole: "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"
        event:
          source:
            - "aws.codepipeline"

cloudformation template

  "State": "ENABLED",

    "Name": "SwapApproveOrReject-test",
    "Targets": [
      {
        "Arn": {
          "Ref": "DeleteOldDeploymentDashtest"
        },
        "Id": "deleteOldDeploymentCloudWatchEvent",
        "RoleArn": "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"
      }
    ]

and if iamRole is defined:

• cloudwatchEvent:

      name: SwapApproveOrReject-${opt:stage}
      iamRole: "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"
      event:
        source:
  

then cloudformation template:

 "State": "ENABLED",

    "Name": "SwapApproveOrReject-test",
    "Targets": [
      {
        "Arn": {
          "Ref": "DeleteOldDeploymentDashtest"
        },
        "Id": "deleteOldDeploymentCloudWatchEvent",
        "RoleArn": {
          "Fn::GetAtt": [
            "DeleteOldDeploymentEventToStepFunctionsRole",
            "Arn"
          ]
        }
      }
    ]
  }
}

as result:

[bucha09]

@theburningmonk Finally, I've fixed issues and add description in readme.md, fixed lint problems. Tested, and looks like everything is ok

[theburningmonk]

@bucha09 I don't understand your example.. are the cloudformation templates pasted the wrong way round?

[theburningmonk]

this feels a bit weird, having the entire blob inside an if/else, can you do the if-else on ln47 when you assign the value of IamRole instead?

[bucha09]

@theburningmonk I'll do my best)

[bucha09]

@theburningmonk Now, cloudformation paste correct RoleArn if Role is defined in serverless.yml. If Role isn't defined in serverless.yml then leave as it was (it'll create new role)

[theburningmonk]

@bucha09 sorry, I meant the example you cited here. When you set the IAM role explicitly

name: SwapApproveOrReject-${opt:stage}
    iamRole: "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"

I'd have expected the CloudFormation template to reflect that:

    "State": "ENABLED",
    "Name": "SwapApproveOrReject-test",
    "Targets": [
      {
        "Arn": {
          "Ref": "DeleteOldDeploymentDashtest"
        },
        "Id": "deleteOldDeploymentCloudWatchEvent",
        "RoleArn": "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"
      }
    ]

is that not the case?

@bucha09 LGTM and should work, can you add some tests around it?

Made some research and add some fixes to code. It'll use iamRole when it defined in serverless.yml or if not defined, then leave as it was (create new role).
example:

Made some research and add some fixes to code. It'll use iamRole when it defined in serverless.yml or if not defined, then leave as it was (create new role).
example:

cloudwatchEvent:

    name: SwapApproveOrReject-${opt:stage}
        #iamRole: "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"
        event:
          source:
            - "aws.codepipeline"

cloudformation template

  "State": "ENABLED",

    "Name": "SwapApproveOrReject-test",
    "Targets": [
      {
        "Arn": {
          "Ref": "DeleteOldDeploymentDashtest"
        },
        "Id": "deleteOldDeploymentCloudWatchEvent",
        "RoleArn": "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"
      }
    ]

and if iamRole is defined:

• cloudwatchEvent:

      name: SwapApproveOrReject-${opt:stage}
      iamRole: "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"
      event:
        source:
  

then cloudformation template:

 "State": "ENABLED",

    "Name": "SwapApproveOrReject-test",
    "Targets": [
      {
        "Arn": {
          "Ref": "DeleteOldDeploymentDashtest"
        },
        "Id": "deleteOldDeploymentCloudWatchEvent",
        "RoleArn": {
          "Fn::GetAtt": [
            "DeleteOldDeploymentEventToStepFunctionsRole",
            "Arn"
          ]
        }
      }
    ]
  }
}

as result:

[bucha09]

@theburningmonk
Sorry, my mistake in description
If cloudwatch event looks like this. Role disabled or isn't defined:

cloudwatchEvent:

    name: SwapApproveOrReject-${opt:stage}
        #iamRole: "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"
        event:
          source:
            - "aws.codepipeline"

then cloudformation template:

"State": "ENABLED",

    "Name": "SwapApproveOrReject-test",
    "Targets": [
      {
        "Arn": {
          "Ref": "DeleteOldDeploymentDashtest"
        },
        "Id": "deleteOldDeploymentCloudWatchEvent",
        "RoleArn": {
          "Fn::GetAtt": [
            "DeleteOldDeploymentEventToStepFunctionsRole",
            "Arn"
          ]
        }
      }

and if iamRole is defined:

 cloudwatchEvent:

        name: SwapApproveOrReject-${opt:stage}
        iamRole: "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"
        event:
          source:

then cloudformation template

"State": "ENABLED",

    "Name": "SwapApproveOrReject-test",
    "Targets": [
      {
        "Arn": {
          "Ref": "DeleteOldDeploymentDashtest"
        },
        "Id": "deleteOldDeploymentCloudWatchEvent",
        "RoleArn": "arn:aws:iam::accountid:role/Events-InvokeStepFunctions-Role"
      }
    ]

[theburningmonk]

🎉 This PR is included in version 2.17.4 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[bucha09]

@theburningmonk Thanks!