Assets: upload to and grant permissions on prefix

We need to give asset consumers permissions on all versions of an asset, not just the latest version. Otherwise, we will never be able to do rolling updates. Also add caching on AWS client instances, so with multiple asset uploads we don't have to construct a new S3 client for every asset (incurring credential lookups for each one). This fixes #484.
aws · Aug 6, 2018 · a0ed0f8 · a0ed0f8
1 parent a449907
commit a0ed0f8
Show file tree

Hide file tree

Showing 9 changed files with 246 additions and 288 deletions.
diff --git a/packages/@aws-cdk/assets/lib/asset.ts b/packages/@aws-cdk/assets/lib/asset.ts
@@ -67,6 +67,8 @@ export class Asset extends cdk.Construct {
 
     private readonly bucket: s3.BucketRef;
 
+    private readonly s3PrefixParam: cdk.Parameter;
+
     constructor(parent: cdk.Construct, id: string, props: GenericAssetProps) {
         super(parent, id);
 
@@ -84,33 +86,45 @@ export class Asset extends cdk.Construct {
             description: `S3 bucket for asset "${this.path}"`,
         });
 
-        const keyParam = new cdk.Parameter(this, 'S3ObjectKey', {
+        this.s3PrefixParam = new cdk.Parameter(this, 'S3Prefix', {
+            type: 'String',
+            description: `S3 prefix for asset "${this.path}"`
+        });
+
+        const keyParam = new cdk.Parameter(this, 'S3VersionKey', {
             type: 'String',
-            description: `S3 object for asset "${this.path}"`
+            description: `S3 key for asset version "${this.path}"`
         });
 
         this.s3BucketName = bucketParam.value;
         this.s3ObjectKey = keyParam.value;
 
-        // grant the lambda's role read permissions on the code s3 object
-
         this.bucket = s3.BucketRef.import(parent, 'AssetBucket', {
             bucketName: this.s3BucketName
         });
 
         // form the s3 URL of the object key
         this.s3Url = this.bucket.urlForObject(this.s3ObjectKey);
 
+        // Get a unique identifier for this asset, which will be used
+        // as a folder to group different versions of the same asset together.
+        //
+        // Even though this code looks horrible, this is actually not a terrible thing
+        // to do. The generated ID will contain the *stack name* as well, which is a
+        // perfectly nice thing to do to disambiguate similarly named assets in different stacks.
+        const uniqueId = new cdk.HashedAddressingScheme().allocateAddress(this.path.split('/'));
+
         // attach metadata to the lambda function which includes information
         // for tooling to be able to package and upload a directory to the
         // s3 bucket and plug in the bucket name and key in the correct
         // parameters.
-
         const asset: cxapi.AssetMetadataEntry = {
             path: this.assetPath,
+            id: uniqueId,
             packaging: props.packaging,
             s3BucketParameter: bucketParam.logicalId,
             s3KeyParameter: keyParam.logicalId,
+            s3PrefixParameter: this.s3PrefixParam.logicalId
         };
 
         this.addMetadata(cxapi.ASSET_METADATA, asset);
@@ -124,7 +138,11 @@ export class Asset extends cdk.Construct {
      * Grants read permissions to the principal on the asset's S3 object.
      */
     public grantRead(principal?: iam.IPrincipal) {
-        this.bucket.grantRead(principal, this.s3ObjectKey);
+        // We give permissions on all files with the same prefix. Presumably
+        // different versions of the same file will have the same prefix
+        // and we don't want to accidentally revoke permission on old versions
+        // when deploying a new version.
+        this.bucket.grantRead(principal, new cdk.FnConcat(this.s3PrefixParam.value, "*"));
     }
 }
 

diff --git a/packages/@aws-cdk/assets/test/integ.assets.directory.lit.expected.json b/packages/@aws-cdk/assets/test/integ.assets.directory.lit.expected.json
@@ -4,9 +4,13 @@
       "Type": "String",
       "Description": "S3 bucket for asset \"aws-cdk-asset-test/SampleAsset\""
     },
-    "SampleAssetS3ObjectKey6F5D200B": {
+    "SampleAssetS3Prefix6E89595F": {
       "Type": "String",
-      "Description": "S3 object for asset \"aws-cdk-asset-test/SampleAsset\""
+      "Description": "S3 prefix for asset \"aws-cdk-asset-test/SampleAsset\""
+    },
+    "SampleAssetS3VersionKey3E106D34": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"aws-cdk-asset-test/SampleAsset\""
     }
   },
   "Resources": {
@@ -76,7 +80,15 @@
                       },
                       "/",
                       {
-                        "Ref": "SampleAssetS3ObjectKey6F5D200B"
+                        "Fn::Join": [
+                          "",
+                          [
+                            {
+                              "Ref": "SampleAssetS3Prefix6E89595F"
+                            },
+                            "*"
+                          ]
+                        ]
                       }
                     ]
                   ]

diff --git a/packages/@aws-cdk/assets/test/integ.assets.file.lit.expected.json b/packages/@aws-cdk/assets/test/integ.assets.file.lit.expected.json
@@ -4,9 +4,13 @@
       "Type": "String",
       "Description": "S3 bucket for asset \"aws-cdk-asset-file-test/SampleAsset\""
     },
-    "SampleAssetS3ObjectKey6F5D200B": {
+    "SampleAssetS3Prefix6E89595F": {
       "Type": "String",
-      "Description": "S3 object for asset \"aws-cdk-asset-file-test/SampleAsset\""
+      "Description": "S3 prefix for asset \"aws-cdk-asset-file-test/SampleAsset\""
+    },
+    "SampleAssetS3VersionKey3E106D34": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"aws-cdk-asset-file-test/SampleAsset\""
     }
   },
   "Resources": {
@@ -76,7 +80,15 @@
                       },
                       "/",
                       {
-                        "Ref": "SampleAssetS3ObjectKey6F5D200B"
+                        "Fn::Join": [
+                          "",
+                          [
+                            {
+                              "Ref": "SampleAssetS3Prefix6E89595F"
+                            },
+                            "*"
+                          ]
+                        ]
                       }
                     ]
                   ]

diff --git a/packages/@aws-cdk/assets/test/integ.assets.permissions.lit.expected.json b/packages/@aws-cdk/assets/test/integ.assets.permissions.lit.expected.json
@@ -4,9 +4,13 @@
       "Type": "String",
       "Description": "S3 bucket for asset \"aws-cdk-asset-refs/MyFile\""
     },
-    "MyFileS3ObjectKey4641930D": {
+    "MyFileS3PrefixF078A585": {
       "Type": "String",
-      "Description": "S3 object for asset \"aws-cdk-asset-refs/MyFile\""
+      "Description": "S3 prefix for asset \"aws-cdk-asset-refs/MyFile\""
+    },
+    "MyFileS3VersionKey568C3C9F": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"aws-cdk-asset-refs/MyFile\""
     }
   },
   "Resources": {
@@ -76,7 +80,15 @@
                       },
                       "/",
                       {
-                        "Ref": "MyFileS3ObjectKey4641930D"
+                        "Fn::Join": [
+                          "",
+                          [
+                            {
+                              "Ref": "MyFileS3PrefixF078A585"
+                            },
+                            "*"
+                          ]
+                        ]
                       }
                     ]
                   ]

diff --git a/packages/@aws-cdk/assets/test/integ.assets.refs.lit.expected.json b/packages/@aws-cdk/assets/test/integ.assets.refs.lit.expected.json
@@ -4,9 +4,13 @@
       "Type": "String",
       "Description": "S3 bucket for asset \"aws-cdk-asset-refs/SampleAsset\""
     },
-    "SampleAssetS3ObjectKey6F5D200B": {
+    "SampleAssetS3Prefix6E89595F": {
       "Type": "String",
-      "Description": "S3 object for asset \"aws-cdk-asset-refs/SampleAsset\""
+      "Description": "S3 prefix for asset \"aws-cdk-asset-refs/SampleAsset\""
+    },
+    "SampleAssetS3VersionKey3E106D34": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"aws-cdk-asset-refs/SampleAsset\""
     }
   },
   "Outputs": {
@@ -20,7 +24,7 @@
     },
     "S3ObjectKey": {
       "Value": {
-        "Ref": "SampleAssetS3ObjectKey6F5D200B"
+        "Ref": "SampleAssetS3VersionKey3E106D34"
       },
       "Export": {
         "Name": "aws-cdk-asset-refs:S3ObjectKey"
@@ -46,7 +50,7 @@
             },
             "/",
             {
-              "Ref": "SampleAssetS3ObjectKey6F5D200B"
+              "Ref": "SampleAssetS3VersionKey3E106D34"
             }
           ]
         ]
@@ -123,7 +127,15 @@
                       },
                       "/",
                       {
-                        "Ref": "SampleAssetS3ObjectKey6F5D200B"
+                        "Fn::Join": [
+                          "",
+                          [
+                            {
+                              "Ref": "SampleAssetS3Prefix6E89595F"
+                            },
+                            "*"
+                          ]
+                        ]
                       }
                     ]
                   ]