Skip to content

Commit 38d82c4

Browse files
authored
fix(events): now EventBus.grantPutEventsTo correctly handles service principals (under feature flag) (#33729)
### Issue #22080 Closes #22080. ### Reason for this change When trying to grant PutEvents permissions to an AWS Service Principal using `grantPutEventsTo`, the method performed a no-op without any warnings or errors. This prevented users from properly granting permissions to service principals, even though this is a valid use case that can be done through the AWS Console. The change implements the correct behavior by creating an EventBusPolicy when dealing with service principals. ### Description of changes - Added special handling for service principals in `EventBus.grantPutEventsTo` method - When granting permissions to a service principal, creates an EventBusPolicy instead of attempting to modify IAM policies - Returns `iam.Grant.drop()` for service principals to indicate permissions are handled via EventBusPolicy - Added test cases to verify both service principal and IAM principal scenarios ### Describe any new or updated permissions being added The change introduces the creation of EventBusPolicy resources with `events:PutEvents` permission when granting access to service principals. This is not a new permission, but rather a different way of granting the same permission through resource-based policies instead of identity-based policies. ### Description of how you validated changes Added new test cases that verify: - EventBusPolicy is correctly created when granting permissions to service principals - IAM policies are correctly created when granting permissions to IAM roles/users ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent e307404 commit 38d82c4

30 files changed

+67798
-9
lines changed

packages/@aws-cdk-testing/framework-integ/test/aws-events/test/integ.eventbus-cross-account-grants.js.snapshot/CrossAccountDeployDefaultTestDeployAssertB5328BEF.assets.json

+32
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-events/test/integ.eventbus-cross-account-grants.js.snapshot/CrossAccountDeployDefaultTestDeployAssertB5328BEF.template.json

+303
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)