Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AP-5187 Ability to define many sqs prefixes. #207

Merged
merged 3 commits into from
Sep 10, 2024
Merged

AP-5187 Ability to define many sqs prefixes. #207

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5652ecc
AP-5187 Ability to define many sqs prefixes.
kamilwylegala Sep 10, 2024
ac7bf9d
AP-5187 Type change.
kamilwylegala Sep 10, 2024
1492f79
AP-5187 Readonly.
kamilwylegala Sep 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/sns/lib/sns/AbstractSnsService.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ export type SNSTopicConfig = {
}

export type ExtraSNSCreationParams = {
queueUrlsWithSubscribePermissionsPrefix?: string
queueUrlsWithSubscribePermissionsPrefix?: string | readonly string[]
allowedSourceOwner?: string
}

Expand Down
29 changes: 27 additions & 2 deletions packages/sns/lib/utils/snsAttributeUtils.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,32 @@ describe('snsAttributeUtils', () => {
})

expect(resolvedPolicy).toBe(
`{"Version":"2012-10-17","Id":"__default_policy_ID","Statement":[{"Sid":"AllowSQSSubscription","Effect":"Allow","Principal":{"AWS":"*"},"Action":["sns:Subscribe"],"Resource":"arn:aws:sns:eu-central-1:632374391739:test-sns-some-service","Condition":{"StringEquals":{"AWS:SourceOwner": "111111111111"},"StringLike":{"sns:Endpoint":"arn:aws:sqs:eu-central-1:632374391739:test-sqs-*"}}}]}`,
`{"Version":"2012-10-17","Id":"__default_policy_ID","Statement":[{"Sid":"AllowSQSSubscription","Effect":"Allow","Principal":{"AWS":"*"},"Action":["sns:Subscribe"],"Resource":"arn:aws:sns:eu-central-1:632374391739:test-sns-some-service","Condition":{"StringEquals":{"AWS:SourceOwner":"111111111111"},"StringLike":{"sns:Endpoint":"arn:aws:sqs:eu-central-1:632374391739:test-sqs-*"}}}]}`,
)
})

it('resolves policy for array of sns:endpoints', () => {
const resolvedPolicy = generateTopicSubscriptionPolicy({
topicArn: 'arn:aws:sns:eu-central-1:632374391739:test-sns-some-service',
allowedSqsQueueUrlPrefix: [
'arn:aws:sqs:eu-central-1:632374391739:test1-sqs-*',
'arn:aws:sqs:eu-central-1:632374391739:test2-sqs-*',
],
})

expect(resolvedPolicy).toBe(
`{"Version":"2012-10-17","Id":"__default_policy_ID","Statement":[{"Sid":"AllowSQSSubscription","Effect":"Allow","Principal":{"AWS":"*"},"Action":["sns:Subscribe"],"Resource":"arn:aws:sns:eu-central-1:632374391739:test-sns-some-service","Condition":{"StringLike":{"sns:Endpoint":["arn:aws:sqs:eu-central-1:632374391739:test1-sqs-*","arn:aws:sqs:eu-central-1:632374391739:test2-sqs-*"]}}}]}`,
)
})

it('resolves policy without condition for sns:endpoint if provided array is empty', () => {
const resolvedPolicy = generateTopicSubscriptionPolicy({
topicArn: 'arn:aws:sns:eu-central-1:632374391739:test-sns-some-service',
allowedSqsQueueUrlPrefix: [],
})

expect(resolvedPolicy).toBe(
`{"Version":"2012-10-17","Id":"__default_policy_ID","Statement":[{"Sid":"AllowSQSSubscription","Effect":"Allow","Principal":{"AWS":"*"},"Action":["sns:Subscribe"],"Resource":"arn:aws:sns:eu-central-1:632374391739:test-sns-some-service","Condition":{}}]}`,
)
})

Expand All @@ -27,7 +52,7 @@ describe('snsAttributeUtils', () => {
})

expect(resolvedPolicy).toBe(
`{"Version":"2012-10-17","Id":"__default_policy_ID","Statement":[{"Sid":"AllowSQSSubscription","Effect":"Allow","Principal":{"AWS":"*"},"Action":["sns:Subscribe"],"Resource":"arn:aws:sns:eu-central-1:632374391739:test-sns-some-service","Condition":{"StringEquals":{"AWS:SourceOwner": "111111111111"}}}]}`,
`{"Version":"2012-10-17","Id":"__default_policy_ID","Statement":[{"Sid":"AllowSQSSubscription","Effect":"Allow","Principal":{"AWS":"*"},"Action":["sns:Subscribe"],"Resource":"arn:aws:sns:eu-central-1:632374391739:test-sns-some-service","Condition":{"StringEquals":{"AWS:SourceOwner":"111111111111"}}}]}`,
)
})

Expand Down
41 changes: 31 additions & 10 deletions packages/sns/lib/utils/snsAttributeUtils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,42 @@ const POLICY_VERSION = '2012-10-17'

export type TopicSubscriptionPolicyParams = {
topicArn: string
allowedSqsQueueUrlPrefix?: string
allowedSqsQueueUrlPrefix?: string | readonly string[]
allowedSourceOwner?: string
}

export function generateTopicSubscriptionPolicy(params: TopicSubscriptionPolicyParams) {
const sourceOwnerFragment = params.allowedSourceOwner
? `"StringEquals":{"AWS:SourceOwner": "${params.allowedSourceOwner}"}`
: ''
const supportedSqsQueueUrlPrefixFragment = params.allowedSqsQueueUrlPrefix
? `"StringLike":{"sns:Endpoint":"${params.allowedSqsQueueUrlPrefix}"}`
: ''
const commaFragment =
sourceOwnerFragment.length > 0 && supportedSqsQueueUrlPrefixFragment.length > 0 ? ',' : ''
const policyObject = {
Version: POLICY_VERSION,
Id: '__default_policy_ID',
Statement: [
{
Sid: 'AllowSQSSubscription',
Effect: 'Allow',
Principal: {
AWS: '*',
},
Action: ['sns:Subscribe'],
Resource: params.topicArn,
Condition: {},
},
],
}

if (params.allowedSourceOwner) {
// @ts-ignore
policyObject.Statement[0].Condition.StringEquals = {
'AWS:SourceOwner': params.allowedSourceOwner,
}
}
if (params.allowedSqsQueueUrlPrefix?.length && params.allowedSqsQueueUrlPrefix.length > 0) {
// @ts-ignore
policyObject.Statement[0].Condition.StringLike = {
'sns:Endpoint': params.allowedSqsQueueUrlPrefix,
}
}

return `{"Version":"${POLICY_VERSION}","Id":"__default_policy_ID","Statement":[{"Sid":"AllowSQSSubscription","Effect":"Allow","Principal":{"AWS":"*"},"Action":["sns:Subscribe"],"Resource":"${params.topicArn}","Condition":{${sourceOwnerFragment}${commaFragment}${supportedSqsQueueUrlPrefixFragment}}}]}`
return JSON.stringify(policyObject)
}

export function generateFilterAttributes(
Expand Down
Loading