From 8df187d41b0bd9421531d452268f2c4a14baf5e8 Mon Sep 17 00:00:00 2001 From: awstools Date: Mon, 5 Feb 2024 19:12:07 +0000 Subject: [PATCH] feat(client-glue): Introduce Catalog Encryption Role within Glue Data Catalog Settings. Introduce SASL/PLAIN as an authentication method for Glue Kafka connections --- ...GetDataCatalogEncryptionSettingsCommand.ts | 3 +- ...PutDataCatalogEncryptionSettingsCommand.ts | 3 +- clients/client-glue/src/models/models_0.ts | 3 ++ clients/client-glue/src/models/models_1.ts | 21 +++++++++- codegen/sdk-codegen/aws-models/glue.json | 38 ++++++++++++++++++- 5 files changed, 64 insertions(+), 4 deletions(-) diff --git a/clients/client-glue/src/commands/GetDataCatalogEncryptionSettingsCommand.ts b/clients/client-glue/src/commands/GetDataCatalogEncryptionSettingsCommand.ts index ea6a0de187af..ea9860edeac9 100644 --- a/clients/client-glue/src/commands/GetDataCatalogEncryptionSettingsCommand.ts +++ b/clients/client-glue/src/commands/GetDataCatalogEncryptionSettingsCommand.ts @@ -48,8 +48,9 @@ export interface GetDataCatalogEncryptionSettingsCommandOutput * // { // GetDataCatalogEncryptionSettingsResponse * // DataCatalogEncryptionSettings: { // DataCatalogEncryptionSettings * // EncryptionAtRest: { // EncryptionAtRest - * // CatalogEncryptionMode: "DISABLED" || "SSE-KMS", // required + * // CatalogEncryptionMode: "DISABLED" || "SSE-KMS" || "SSE-KMS-WITH-SERVICE-ROLE", // required * // SseAwsKmsKeyId: "STRING_VALUE", + * // CatalogEncryptionServiceRole: "STRING_VALUE", * // }, * // ConnectionPasswordEncryption: { // ConnectionPasswordEncryption * // ReturnConnectionPasswordEncrypted: true || false, // required diff --git a/clients/client-glue/src/commands/PutDataCatalogEncryptionSettingsCommand.ts b/clients/client-glue/src/commands/PutDataCatalogEncryptionSettingsCommand.ts index dce8d0da5878..b08b44bab7bd 100644 --- a/clients/client-glue/src/commands/PutDataCatalogEncryptionSettingsCommand.ts +++ b/clients/client-glue/src/commands/PutDataCatalogEncryptionSettingsCommand.ts @@ -45,8 +45,9 @@ export interface PutDataCatalogEncryptionSettingsCommandOutput * CatalogId: "STRING_VALUE", * DataCatalogEncryptionSettings: { // DataCatalogEncryptionSettings * EncryptionAtRest: { // EncryptionAtRest - * CatalogEncryptionMode: "DISABLED" || "SSE-KMS", // required + * CatalogEncryptionMode: "DISABLED" || "SSE-KMS" || "SSE-KMS-WITH-SERVICE-ROLE", // required * SseAwsKmsKeyId: "STRING_VALUE", + * CatalogEncryptionServiceRole: "STRING_VALUE", * }, * ConnectionPasswordEncryption: { // ConnectionPasswordEncryption * ReturnConnectionPasswordEncrypted: true || false, // required diff --git a/clients/client-glue/src/models/models_0.ts b/clients/client-glue/src/models/models_0.ts index 88ec77d4dd1d..5844594fc77d 100644 --- a/clients/client-glue/src/models/models_0.ts +++ b/clients/client-glue/src/models/models_0.ts @@ -8943,6 +8943,7 @@ export const ConnectionPropertyKey = { CUSTOM_JDBC_CERT_STRING: "CUSTOM_JDBC_CERT_STRING", ENCRYPTED_KAFKA_CLIENT_KEYSTORE_PASSWORD: "ENCRYPTED_KAFKA_CLIENT_KEYSTORE_PASSWORD", ENCRYPTED_KAFKA_CLIENT_KEY_PASSWORD: "ENCRYPTED_KAFKA_CLIENT_KEY_PASSWORD", + ENCRYPTED_KAFKA_SASL_PLAIN_PASSWORD: "ENCRYPTED_KAFKA_SASL_PLAIN_PASSWORD", ENCRYPTED_KAFKA_SASL_SCRAM_PASSWORD: "ENCRYPTED_KAFKA_SASL_SCRAM_PASSWORD", ENCRYPTED_PASSWORD: "ENCRYPTED_PASSWORD", HOST: "HOST", @@ -8963,6 +8964,8 @@ export const ConnectionPropertyKey = { KAFKA_SASL_GSSAPI_PRINCIPAL: "KAFKA_SASL_GSSAPI_PRINCIPAL", KAFKA_SASL_GSSAPI_SERVICE: "KAFKA_SASL_GSSAPI_SERVICE", KAFKA_SASL_MECHANISM: "KAFKA_SASL_MECHANISM", + KAFKA_SASL_PLAIN_PASSWORD: "KAFKA_SASL_PLAIN_PASSWORD", + KAFKA_SASL_PLAIN_USERNAME: "KAFKA_SASL_PLAIN_USERNAME", KAFKA_SASL_SCRAM_PASSWORD: "KAFKA_SASL_SCRAM_PASSWORD", KAFKA_SASL_SCRAM_SECRETS_ARN: "KAFKA_SASL_SCRAM_SECRETS_ARN", KAFKA_SASL_SCRAM_USERNAME: "KAFKA_SASL_SCRAM_USERNAME", diff --git a/clients/client-glue/src/models/models_1.ts b/clients/client-glue/src/models/models_1.ts index 20a5d599cb4a..6fdfa288a11e 100644 --- a/clients/client-glue/src/models/models_1.ts +++ b/clients/client-glue/src/models/models_1.ts @@ -4693,7 +4693,19 @@ export interface Connection { * *
  • *

    - * KAFKA_SASL_MECHANISM - "SCRAM-SHA-512", "GSSAPI", or "AWS_MSK_IAM". These are the supported SASL Mechanisms.

    + * KAFKA_SASL_MECHANISM - "SCRAM-SHA-512", "GSSAPI", "AWS_MSK_IAM", or "PLAIN". These are the supported SASL Mechanisms.

    + *
    • + *
  • + *

    + * KAFKA_SASL_PLAIN_USERNAME - A plaintext username used to authenticate with the "PLAIN" mechanism.

    + *
    • + *
  • + *

    + * KAFKA_SASL_PLAIN_PASSWORD - A plaintext password used to authenticate with the "PLAIN" mechanism.

    + *
    • + *
  • + *

    + * ENCRYPTED_KAFKA_SASL_PLAIN_PASSWORD - The encrypted version of the Kafka SASL PLAIN password (if the user has the Glue encrypt passwords setting selected).

    *
    • *
  • *

    @@ -5249,6 +5261,7 @@ export interface ConnectionPasswordEncryption { export const CatalogEncryptionMode = { DISABLED: "DISABLED", SSEKMS: "SSE-KMS", + SSEKMSWITHSERVICEROLE: "SSE-KMS-WITH-SERVICE-ROLE", } as const; /** @@ -5272,6 +5285,12 @@ export interface EncryptionAtRest { *

    The ID of the KMS key to use for encryption at rest.

    */ SseAwsKmsKeyId?: string; + + /** + * @public + *

    The role that Glue assumes to encrypt and decrypt the Data Catalog objects on the caller's behalf.

    + */ + CatalogEncryptionServiceRole?: string; } /** diff --git a/codegen/sdk-codegen/aws-models/glue.json b/codegen/sdk-codegen/aws-models/glue.json index 1658a2ae3618..58c4cd91cdd9 100644 --- a/codegen/sdk-codegen/aws-models/glue.json +++ b/codegen/sdk-codegen/aws-models/glue.json @@ -4593,6 +4593,12 @@ "traits": { "smithy.api#enumValue": "SSE-KMS" } + }, + "SSEKMSWITHSERVICEROLE": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "SSE-KMS-WITH-SERVICE-ROLE" + } } } }, @@ -6478,7 +6484,7 @@ "ConnectionProperties": { "target": "com.amazonaws.glue#ConnectionProperties", "traits": { - "smithy.api#documentation": "

    These key-value pairs define parameters for the connection:

    \n " + "smithy.api#documentation": "

    These key-value pairs define parameters for the connection:

    \n " } }, "PhysicalConnectionRequirements": { @@ -6792,6 +6798,24 @@ "smithy.api#enumValue": "KAFKA_SASL_MECHANISM" } }, + "KAFKA_SASL_PLAIN_USERNAME": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "KAFKA_SASL_PLAIN_USERNAME" + } + }, + "KAFKA_SASL_PLAIN_PASSWORD": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "KAFKA_SASL_PLAIN_PASSWORD" + } + }, + "ENCRYPTED_KAFKA_SASL_PLAIN_PASSWORD": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "ENCRYPTED_KAFKA_SASL_PLAIN_PASSWORD" + } + }, "KAFKA_SASL_SCRAM_USERNAME": { "target": "smithy.api#Unit", "traits": { @@ -13939,6 +13963,12 @@ "traits": { "smithy.api#documentation": "

    The ID of the KMS key to use for encryption at rest.

    " } + }, + "CatalogEncryptionServiceRole": { + "target": "com.amazonaws.glue#IAMRoleArn", + "traits": { + "smithy.api#documentation": "

    The role that Glue assumes to encrypt and decrypt the Data Catalog objects on the caller's behalf.

    " + } } }, "traits": { @@ -21029,6 +21059,12 @@ "target": "com.amazonaws.glue#HudiTarget" } }, + "com.amazonaws.glue#IAMRoleArn": { + "type": "string", + "traits": { + "smithy.api#pattern": "^arn:aws(-(cn|us-gov|iso(-[bef])?))?:iam::[0-9]{12}:role/.+$" + } + }, "com.amazonaws.glue#IcebergInput": { "type": "structure", "members": {