feat(neptune): introduce cluster grant method for granular actions

[humanzz]

• neptune engine version 1.2.0.0 introduced more granular access control https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html
• introduce grant method to facilitate working with different actions

#21877

This PR is split from #21908 as per the discussion with @TheRealAmazonKendra

All Submissions:

• Have you followed the guidelines in our Contributing guide?

Adding new Unconventional Dependencies:

• This PR adds new unconventional dependencies following the process described here

New Features

• Have you added the new feature to an integration test?
  • Did you use yarn integ to deploy the infrastructure and generate the snapshot (i.e. yarn integ without --dry-run)?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[TheRealAmazonKendra]

This looks good for the most part. I'd like to see the new grant functions used in integration tests somewhere.

Pull request has been modified.

[humanzz]

This looks good for the most part. I'd like to see the new grant functions used in integration tests somewhere.

Let's do that after the other PR is merged to avoid conflicts in integ tests.

[TheRealAmazonKendra]

Just two very minor things inline.

[TheRealAmazonKendra]

Suggested change

	throw new Error('Cannot grant actions as IAM authentication is not enabled');
	throw new Error('Cannot grant permissions when IAM authentication is not enabled');

[TheRealAmazonKendra]

Quick question here, the README says:

const cluster = new neptune.DatabaseCluster(this, 'Cluster', {
  vpc,
  instanceType: neptune.InstanceType.R5_LARGE,
  iamAuthentication: true, // Optional - will be automatically set if you call grantConnect().
});

It seems that this sort of contradicts that. Can you add a clarifying line that explicitly setting this to false and trying to grant permissions will throw an error?

[humanzz]

tbh, I found the existing implementation of grantConnect and its side effect of possibly enabling iam auth, and how enabling iamAuth is handled a bit surprising!

https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-neptune/lib/cluster.ts#L368

In terms of the error message, now that I look at it, I think the older version that uses "disabled" actually makes more sense and is more consistent with the implemented behaviour which

1. Defaults to disabled (I think a cloudformation default rather than a cdk default)
2. Requires one to explicitly disable iam auth if they don't want it and want grant methods to throw such exceptions

I get that grant enabling iam auth might be a convenience, but it's a bit twisted IMHO!

So, for this PR, how about

1. change the error message to Cannot grant permissions when IAM authentication is disabled
2. update the README to say // Optional - will be automatically set if you call grant() or grantConnect()

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 3d369be
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository