Skip to content

Commit fe4bc1d

Browse files
naiellonaiello
authored
feat(route53): allow specifying an STS region when creating a cross-account zone delegation (#29466)
### Issue # (if applicable) n/a ### Reason for this change In certain circumstances, the default STS region resolution logic will not properly select a region due to the hardcoded mapping between region prefixes and STS regions. ### Description of changes This change allows callers to specify a region in which STS will be called. ### Description of how you validated changes Unit tests were added to aws-cdk-lib. Integ tests were updated and pass on my personal accounts, but I'm not sure how to check if they'll pass in CI. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 8a7c5c8 commit fe4bc1d

File tree

23 files changed

+615
-33
lines changed

23 files changed

+615
-33
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/asset.aca4a134bf7ace6088b21213be7ab4357e3705f714362b690d76376b8f1df53a/index.js

-1
This file was deleted.

‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/asset.aca4a134bf7ace6088b21213be7ab4357e3705f714362b690d76376b8f1df53a/__entrypoint__.js renamed to ‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/asset.f43e5ef82b45e2e3ecb60cd54aa4a3599da7bb4c85d10cfe133dc43f54705458/__entrypoint__.js

File renamed without changes.

‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/asset.f43e5ef82b45e2e3ecb60cd54aa4a3599da7bb4c85d10cfe133dc43f54705458/index.js

+1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-opt-in-stack-with-assume-role-region.assets.json

+34
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-opt-in-stack-with-assume-role-region.template.json

+159
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
{
2+
"Resources": {
3+
"SubZoneF7955E1A": {
4+
"Type": "AWS::Route53::HostedZone",
5+
"Properties": {
6+
"Name": "sub3.uniqueexample.com."
7+
}
8+
},
9+
"delegatecrossaccountzonedelegationhandlerrolePolicychildoptinstackwithassumeroleregiondelegatecrossaccountzonedelegationhandlerroleA822DAE1970772B0": {
10+
"Type": "AWS::IAM::Policy",
11+
"Properties": {
12+
"PolicyDocument": {
13+
"Statement": [
14+
{
15+
"Action": "sts:AssumeRole",
16+
"Effect": "Allow",
17+
"Resource": "arn:aws:iam::12345678:role/MyUniqueDelegationRole"
18+
}
19+
],
20+
"Version": "2012-10-17"
21+
},
22+
"PolicyName": "PolicychildoptinstackwithassumeroleregiondelegatecrossaccountzonedelegationhandlerroleA822DAE1",
23+
"Roles": [
24+
{
25+
"Fn::Select": [
26+
1,
27+
{
28+
"Fn::Split": [
29+
"/",
30+
{
31+
"Fn::Select": [
32+
5,
33+
{
34+
"Fn::Split": [
35+
":",
36+
{
37+
"Fn::GetAtt": [
38+
"CustomCrossAccountZoneDelegationCustomResourceProviderRoleED64687B",
39+
"Arn"
40+
]
41+
}
42+
]
43+
}
44+
]
45+
}
46+
]
47+
}
48+
]
49+
}
50+
]
51+
}
52+
},
53+
"delegateCrossAccountZoneDelegationCustomResource23BD590B": {
54+
"Type": "Custom::CrossAccountZoneDelegation",
55+
"Properties": {
56+
"ServiceToken": {
57+
"Fn::GetAtt": [
58+
"CustomCrossAccountZoneDelegationCustomResourceProviderHandler44A84265",
59+
"Arn"
60+
]
61+
},
62+
"AssumeRoleArn": "arn:aws:iam::12345678:role/MyUniqueDelegationRole",
63+
"ParentZoneName": "uniqueexample.com",
64+
"DelegatedZoneName": "sub3.uniqueexample.com",
65+
"DelegatedZoneNameServers": {
66+
"Fn::GetAtt": [
67+
"SubZoneF7955E1A",
68+
"NameServers"
69+
]
70+
},
71+
"TTL": 172800,
72+
"AssumeRoleRegion": "eu-west-1"
73+
},
74+
"DependsOn": [
75+
"delegatecrossaccountzonedelegationhandlerrolePolicychildoptinstackwithassumeroleregiondelegatecrossaccountzonedelegationhandlerroleA822DAE1970772B0"
76+
],
77+
"UpdateReplacePolicy": "Delete",
78+
"DeletionPolicy": "Delete"
79+
},
80+
"CustomCrossAccountZoneDelegationCustomResourceProviderRoleED64687B": {
81+
"Type": "AWS::IAM::Role",
82+
"Properties": {
83+
"AssumeRolePolicyDocument": {
84+
"Version": "2012-10-17",
85+
"Statement": [
86+
{
87+
"Action": "sts:AssumeRole",
88+
"Effect": "Allow",
89+
"Principal": {
90+
"Service": "lambda.amazonaws.com"
91+
}
92+
}
93+
]
94+
},
95+
"ManagedPolicyArns": [
96+
{
97+
"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
98+
}
99+
]
100+
}
101+
},
102+
"CustomCrossAccountZoneDelegationCustomResourceProviderHandler44A84265": {
103+
"Type": "AWS::Lambda::Function",
104+
"Properties": {
105+
"Code": {
106+
"S3Bucket": "cdk-hnb659fds-assets-234567890123-af-south-1",
107+
"S3Key": "f43e5ef82b45e2e3ecb60cd54aa4a3599da7bb4c85d10cfe133dc43f54705458.zip"
108+
},
109+
"Timeout": 900,
110+
"MemorySize": 128,
111+
"Handler": "__entrypoint__.handler",
112+
"Role": {
113+
"Fn::GetAtt": [
114+
"CustomCrossAccountZoneDelegationCustomResourceProviderRoleED64687B",
115+
"Arn"
116+
]
117+
},
118+
"Runtime": "nodejs18.x"
119+
},
120+
"DependsOn": [
121+
"CustomCrossAccountZoneDelegationCustomResourceProviderRoleED64687B"
122+
]
123+
}
124+
},
125+
"Parameters": {
126+
"BootstrapVersion": {
127+
"Type": "AWS::SSM::Parameter::Value<String>",
128+
"Default": "/cdk-bootstrap/hnb659fds/version",
129+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
130+
}
131+
},
132+
"Rules": {
133+
"CheckBootstrapVersion": {
134+
"Assertions": [
135+
{
136+
"Assert": {
137+
"Fn::Not": [
138+
{
139+
"Fn::Contains": [
140+
[
141+
"1",
142+
"2",
143+
"3",
144+
"4",
145+
"5"
146+
],
147+
{
148+
"Ref": "BootstrapVersion"
149+
}
150+
]
151+
}
152+
]
153+
},
154+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
155+
}
156+
]
157+
}
158+
}
159+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-opt-in-stack.assets.json

+5-5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-opt-in-stack.template.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"SubZoneF7955E1A": {
44
"Type": "AWS::Route53::HostedZone",
55
"Properties": {
6-
"Name": "sub.uniqueexample.com."
6+
"Name": "sub2.uniqueexample.com."
77
}
88
},
99
"delegatecrossaccountzonedelegationhandlerrolePolicychildoptinstackdelegatecrossaccountzonedelegationhandlerroleD1C6F26DE28FC01D": {
@@ -61,7 +61,7 @@
6161
},
6262
"AssumeRoleArn": "arn:aws:iam::12345678:role/MyUniqueDelegationRole",
6363
"ParentZoneName": "uniqueexample.com",
64-
"DelegatedZoneName": "sub.uniqueexample.com",
64+
"DelegatedZoneName": "sub2.uniqueexample.com",
6565
"DelegatedZoneNameServers": {
6666
"Fn::GetAtt": [
6767
"SubZoneF7955E1A",
@@ -103,7 +103,7 @@
103103
"Properties": {
104104
"Code": {
105105
"S3Bucket": "cdk-hnb659fds-assets-234567890123-af-south-1",
106-
"S3Key": "aca4a134bf7ace6088b21213be7ab4357e3705f714362b690d76376b8f1df53a.zip"
106+
"S3Key": "f43e5ef82b45e2e3ecb60cd54aa4a3599da7bb4c85d10cfe133dc43f54705458.zip"
107107
},
108108
"Timeout": 900,
109109
"MemorySize": 128,

‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-stack.assets.json

+5-5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/child-stack.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@
103103
"Properties": {
104104
"Code": {
105105
"S3Bucket": "cdk-hnb659fds-assets-234567890123-us-east-1",
106-
"S3Key": "aca4a134bf7ace6088b21213be7ab4357e3705f714362b690d76376b8f1df53a.zip"
106+
"S3Key": "f43e5ef82b45e2e3ecb60cd54aa4a3599da7bb4c85d10cfe133dc43f54705458.zip"
107107
},
108108
"Timeout": 900,
109109
"MemorySize": 128,

‎packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.cross-account-zone-delegation.js.snapshot/integ.json

+2-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)