Skip to content

Commit 59ef00d

Browse files
otaviomacedootaviomacedo
authored
feat(stepfunctions): add StateMachineGrants (#36094)
Create a new class, `StateMachineGrants`, that has all the grants methods, and delegate the `grant*()` methods in `StateMachine` to it. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 51d805e commit 59ef00d

File tree

3 files changed

+179
-70
lines changed

3 files changed

+179
-70
lines changed

‎packages/aws-cdk-lib/aws-stepfunctions/lib/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ export * from './input';
44
export * from './types';
55
export * from './condition';
66
export * from './state-machine';
7+
export * from './state-machine-grants';
78
export * from './state-machine-fragment';
89
export * from './state-transition-metrics';
910
export * from './chain';

‎packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine-grants.ts‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
import * as stepfunctions from './stepfunctions.generated';
2+
import * as iam from '../../aws-iam';
3+
import { Arn, ArnFormat, Stack } from '../../core';
4+
5+
/**
6+
* Properties for StateMachineGrants
7+
*/
8+
export interface StateMachineGrantsProps {
9+
/**
10+
* The resource on which actions will be allowed
11+
*/
12+
readonly resource: stepfunctions.IStateMachineRef;
13+
}
14+
15+
/**
16+
* Collection of grant methods for a IStateMachineRef
17+
*/
18+
export class StateMachineGrants {
19+
/**
20+
* Creates grants for StateMachineGrants
21+
*
22+
* @internal
23+
*/
24+
public static _fromStateMachine(resource: stepfunctions.IStateMachineRef): StateMachineGrants {
25+
return new StateMachineGrants({
26+
resource: resource,
27+
});
28+
}
29+
30+
protected readonly resource: stepfunctions.IStateMachineRef;
31+
32+
private constructor(props: StateMachineGrantsProps) {
33+
this.resource = props.resource;
34+
}
35+
36+
/**
37+
* Grant the given identity task response permissions on a state machine
38+
*/
39+
public taskResponse(grantee: iam.IGrantable): iam.Grant {
40+
const actions = ['states:SendTaskSuccess', 'states:SendTaskFailure', 'states:SendTaskHeartbeat'];
41+
return iam.Grant.addToPrincipal({
42+
actions: actions,
43+
grantee: grantee,
44+
resourceArns: [stepfunctions.CfnStateMachine.arnForStateMachine(this.resource)],
45+
});
46+
}
47+
48+
/**
49+
* Grant the given identity permission to redrive the execution of the state machine
50+
*/
51+
public redriveExecution(grantee: iam.IGrantable): iam.Grant {
52+
const actions = ['states:RedriveExecution'];
53+
return iam.Grant.addToPrincipal({
54+
actions: actions,
55+
grantee: grantee,
56+
resourceArns: [stepfunctions.CfnStateMachine.arnForStateMachine(this.resource) + ':*'],
57+
});
58+
}
59+
60+
/**
61+
* Grant the given identity permissions to read results from state
62+
* machine.
63+
*/
64+
public read(grantee: iam.IGrantable): iam.Grant {
65+
iam.Grant.addToPrincipal({
66+
grantee: grantee,
67+
actions: [
68+
'states:ListExecutions',
69+
'states:ListStateMachines',
70+
],
71+
resourceArns: [stepfunctions.CfnStateMachine.arnForStateMachine(this.resource)],
72+
});
73+
iam.Grant.addToPrincipal({
74+
grantee: grantee,
75+
actions: [
76+
'states:DescribeExecution',
77+
'states:DescribeStateMachineForExecution',
78+
'states:GetExecutionHistory',
79+
],
80+
resourceArns: [this.executionArn() + ':*'],
81+
});
82+
return iam.Grant.addToPrincipal({
83+
grantee: grantee,
84+
actions: [
85+
'states:ListActivities',
86+
'states:DescribeStateMachine',
87+
'states:DescribeActivity',
88+
],
89+
resourceArns: ['*'],
90+
});
91+
}
92+
93+
/**
94+
* Grant the given identity permissions to start an execution of this state
95+
* machine.
96+
*
97+
* @param grantee The principal
98+
*/
99+
public startExecution(grantee: iam.IGrantable): iam.Grant {
100+
return iam.Grant.addToPrincipal({
101+
grantee: grantee,
102+
actions: ['states:StartExecution'],
103+
resourceArns: [this.resource.stateMachineRef.stateMachineArn],
104+
});
105+
}
106+
107+
/**
108+
* Grant the given identity permissions to start a synchronous execution of
109+
* this state machine.
110+
*
111+
* @param grantee The principal
112+
*/
113+
public startSyncExecution(grantee: iam.IGrantable): iam.Grant {
114+
return iam.Grant.addToPrincipal({
115+
grantee: grantee,
116+
actions: ['states:StartSyncExecution'],
117+
resourceArns: [this.resource.stateMachineRef.stateMachineArn],
118+
});
119+
}
120+
121+
/**
122+
* Grant the given identity permissions to start an execution of
123+
* this state machine.
124+
*
125+
* @param grantee The principal
126+
*/
127+
public execution(grantee: iam.IGrantable, ...actions: string[]) {
128+
return iam.Grant.addToPrincipal({
129+
grantee: grantee,
130+
actions,
131+
resourceArns: [this.executionArn() + ':*'],
132+
});
133+
}
134+
135+
/**
136+
* Grant the given identity custom permissions
137+
*/
138+
public actions(identity: iam.IGrantable, ...actions: string[]): iam.Grant {
139+
return iam.Grant.addToPrincipal({
140+
grantee: identity,
141+
actions,
142+
resourceArns: [this.resource.stateMachineRef.stateMachineArn],
143+
});
144+
}
145+
146+
/**
147+
* Returns the pattern for the execution ARN's of the state machine
148+
*/
149+
private executionArn(): string {
150+
return Stack.of(this.resource).formatArn({
151+
resource: 'execution',
152+
service: 'states',
153+
resourceName: Arn.split(this.resource.stateMachineRef.stateMachineArn, ArnFormat.COLON_RESOURCE_NAME).resourceName,
154+
arnFormat: ArnFormat.COLON_RESOURCE_NAME,
155+
});
156+
}
157+
}

‎packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts‎

Lines changed: 21 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,15 @@ import { CustomerManagedEncryptionConfiguration } from './customer-managed-key-e
33
import { EncryptionConfiguration } from './encryption-configuration';
44
import { buildEncryptionConfiguration } from './private/util';
55
import { StateGraph } from './state-graph';
6+
import { StateMachineGrants } from './state-machine-grants';
67
import { StatesMetrics } from './stepfunctions-canned-metrics.generated';
7-
import { CfnStateMachine } from './stepfunctions.generated';
8+
import { CfnStateMachine, IStateMachineRef, StateMachineReference } from './stepfunctions.generated';
89
import { IChainable, QueryLanguage } from './types';
910
import * as cloudwatch from '../../aws-cloudwatch';
1011
import * as iam from '../../aws-iam';
1112
import * as logs from '../../aws-logs';
1213
import * as s3_assets from '../../aws-s3-assets';
13-
import { Arn, ArnFormat, Duration, IResource, RemovalPolicy, Resource, Stack, Token, ValidationError } from '../../core';
14+
import { ArnFormat, Duration, IResource, RemovalPolicy, Resource, Stack, Token, ValidationError } from '../../core';
1415
import { addConstructMetadata, MethodMetadata } from '../../core/lib/metadata-resource';
1516
import { propertyInjectable } from '../../core/lib/prop-injectable';
1617

@@ -215,87 +216,53 @@ abstract class StateMachineBase extends Resource implements IStateMachine {
215216
*/
216217
public abstract readonly grantPrincipal: iam.IPrincipal;
217218

219+
/**
220+
* Collection of grant methods for a StateMachine
221+
*/
222+
public grants = StateMachineGrants._fromStateMachine(this);
223+
224+
public get stateMachineRef(): StateMachineReference {
225+
return {
226+
stateMachineArn: this.stateMachineArn,
227+
};
228+
}
229+
218230
/**
219231
* Grant the given identity permissions to start an execution of this state
220232
* machine.
221233
*/
222234
public grantStartExecution(identity: iam.IGrantable): iam.Grant {
223-
return iam.Grant.addToPrincipal({
224-
grantee: identity,
225-
actions: ['states:StartExecution'],
226-
resourceArns: [this.stateMachineArn],
227-
});
235+
return this.grants.startExecution(identity);
228236
}
229237

230238
/**
231239
* Grant the given identity permissions to start a synchronous execution of
232240
* this state machine.
233241
*/
234242
public grantStartSyncExecution(identity: iam.IGrantable): iam.Grant {
235-
return iam.Grant.addToPrincipal({
236-
grantee: identity,
237-
actions: ['states:StartSyncExecution'],
238-
resourceArns: [this.stateMachineArn],
239-
});
243+
return this.grants.startSyncExecution(identity);
240244
}
241245

242246
/**
243247
* Grant the given identity permissions to read results from state
244248
* machine.
245249
*/
246250
public grantRead(identity: iam.IGrantable): iam.Grant {
247-
iam.Grant.addToPrincipal({
248-
grantee: identity,
249-
actions: [
250-
'states:ListExecutions',
251-
'states:ListStateMachines',
252-
],
253-
resourceArns: [this.stateMachineArn],
254-
});
255-
iam.Grant.addToPrincipal({
256-
grantee: identity,
257-
actions: [
258-
'states:DescribeExecution',
259-
'states:DescribeStateMachineForExecution',
260-
'states:GetExecutionHistory',
261-
],
262-
resourceArns: [`${this.executionArn()}:*`],
263-
});
264-
return iam.Grant.addToPrincipal({
265-
grantee: identity,
266-
actions: [
267-
'states:ListActivities',
268-
'states:DescribeStateMachine',
269-
'states:DescribeActivity',
270-
],
271-
resourceArns: ['*'],
272-
});
251+
return this.grants.read(identity);
273252
}
274253

275254
/**
276255
* Grant the given identity task response permissions on a state machine
277256
*/
278257
public grantTaskResponse(identity: iam.IGrantable): iam.Grant {
279-
return iam.Grant.addToPrincipal({
280-
grantee: identity,
281-
actions: [
282-
'states:SendTaskSuccess',
283-
'states:SendTaskFailure',
284-
'states:SendTaskHeartbeat',
285-
],
286-
resourceArns: [this.stateMachineArn],
287-
});
258+
return this.grants.taskResponse(identity);
288259
}
289260

290261
/**
291262
* Grant the given identity permissions on all executions of the state machine
292263
*/
293264
public grantExecution(identity: iam.IGrantable, ...actions: string[]) {
294-
return iam.Grant.addToPrincipal({
295-
grantee: identity,
296-
actions,
297-
resourceArns: [`${this.executionArn()}:*`],
298-
});
265+
return this.grants.execution(identity, ...actions);
299266
}
300267

301268
/**
@@ -309,11 +276,7 @@ abstract class StateMachineBase extends Resource implements IStateMachine {
309276
* Grant the given identity custom permissions
310277
*/
311278
public grant(identity: iam.IGrantable, ...actions: string[]): iam.Grant {
312-
return iam.Grant.addToPrincipal({
313-
grantee: identity,
314-
actions,
315-
resourceArns: [this.stateMachineArn],
316-
});
279+
return this.grants.actions(identity, ...actions);
317280
}
318281

319282
/**
@@ -395,18 +358,6 @@ abstract class StateMachineBase extends Resource implements IStateMachine {
395358
return this.cannedMetric(StatesMetrics.executionTimeAverage, props);
396359
}
397360

398-
/**
399-
* Returns the pattern for the execution ARN's of the state machine
400-
*/
401-
private executionArn(): string {
402-
return Stack.of(this).formatArn({
403-
resource: 'execution',
404-
service: 'states',
405-
resourceName: Arn.split(this.stateMachineArn, ArnFormat.COLON_RESOURCE_NAME).resourceName,
406-
arnFormat: ArnFormat.COLON_RESOURCE_NAME,
407-
});
408-
}
409-
410361
private cannedMetric(
411362
fn: (dims: { StateMachineArn: string }) => cloudwatch.MetricProps,
412363
props?: cloudwatch.MetricOptions): cloudwatch.Metric {
@@ -657,7 +608,7 @@ export class StateMachine extends StateMachineBase {
657608
/**
658609
* A State Machine
659610
*/
660-
export interface IStateMachine extends IResource, iam.IGrantable {
611+
export interface IStateMachine extends IResource, iam.IGrantable, IStateMachineRef {
661612
/**
662613
* The ARN of the state machine
663614
* @attribute

0 commit comments

Comments
 (0)