Skip to content

Commit ae87e26

Browse files
authored
fix(rds): can not lookup VPC Security Groups with fromLookup method (#34906)
### Issue # (if applicable) N/A ### Reason for this change Currently, the fromLookup method uses `DBSecurityGroups`, which is designed for EC2-Classic resources. However, since EC2-Classic was retired, this property is no longer relevant. Reference: * https://repost.aws/questions/QUK2WnHCaYQxqkXbDBS5fODA/is-it-still-ok-to-use-aws-rds-dbsecuritygroup-in-cloudformation-templates * https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbsecuritygroupingress.html ### Description of changes Added `VPCSecurityGroups` to the `fromLookup` method to properly handle VPC security group lookups. ### Describe any new or updated permissions being added N/A ### Description of how you validated changes Add unit tests and an integ test. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 6525d51 commit ae87e26

11 files changed

+734
-14
lines changed

packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-lookup.js.snapshot/aws-cdk-rds-instance-lookup.assets.json

Lines changed: 21 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
{
2+
"Outputs": {
3+
"LookedUpInstanceEndpoint": {
4+
"Value": "TESTADDRESS:5432"
5+
},
6+
"LookedUpInstanceIdentifier": {
7+
"Value": "test-instance-lookup"
8+
},
9+
"LookedUpInstanceResourceIdentifier": {
10+
"Value": "TESTID"
11+
},
12+
"LookedUpInstanceArn": {
13+
"Value": {
14+
"Fn::Join": [
15+
"",
16+
[
17+
"arn:",
18+
{
19+
"Ref": "AWS::Partition"
20+
},
21+
":rds:test-region:12345678:db:test-instance-lookup"
22+
]
23+
]
24+
}
25+
},
26+
"SecurityGroupIds": {
27+
"Value": ""
28+
}
29+
},
30+
"Resources": {
31+
"DbAccessRole408BD73D": {
32+
"Type": "AWS::IAM::Role",
33+
"Properties": {
34+
"AssumeRolePolicyDocument": {
35+
"Statement": [
36+
{
37+
"Action": "sts:AssumeRole",
38+
"Effect": "Allow",
39+
"Principal": {
40+
"Service": "ec2.amazonaws.com"
41+
}
42+
}
43+
],
44+
"Version": "2012-10-17"
45+
},
46+
"Description": "Role for accessing the RDS instance via IAM authentication"
47+
}
48+
},
49+
"DbAccessRoleDefaultPolicy8020DC70": {
50+
"Type": "AWS::IAM::Policy",
51+
"Properties": {
52+
"PolicyDocument": {
53+
"Statement": [
54+
{
55+
"Action": "rds-db:connect",
56+
"Effect": "Allow",
57+
"Resource": {
58+
"Fn::Join": [
59+
"",
60+
[
61+
"arn:",
62+
{
63+
"Ref": "AWS::Partition"
64+
},
65+
":rds-db:test-region:12345678:dbuser:TESTID/admin"
66+
]
67+
]
68+
}
69+
}
70+
],
71+
"Version": "2012-10-17"
72+
},
73+
"PolicyName": "DbAccessRoleDefaultPolicy8020DC70",
74+
"Roles": [
75+
{
76+
"Ref": "DbAccessRole408BD73D"
77+
}
78+
]
79+
}
80+
},
81+
"HighCPUAlarm56BE6E7D": {
82+
"Type": "AWS::CloudWatch::Alarm",
83+
"Properties": {
84+
"AlarmDescription": "Database CPU utilization is high",
85+
"ComparisonOperator": "GreaterThanThreshold",
86+
"Dimensions": [
87+
{
88+
"Name": "DBInstanceIdentifier",
89+
"Value": "test-instance-lookup"
90+
}
91+
],
92+
"EvaluationPeriods": 3,
93+
"MetricName": "CPUUtilization",
94+
"Namespace": "AWS/RDS",
95+
"Period": 300,
96+
"Statistic": "Average",
97+
"Threshold": 90
98+
}
99+
},
100+
"LowMemoryAlarmD9E02E14": {
101+
"Type": "AWS::CloudWatch::Alarm",
102+
"Properties": {
103+
"AlarmDescription": "Database is running low on memory",
104+
"ComparisonOperator": "LessThanThreshold",
105+
"Dimensions": [
106+
{
107+
"Name": "DBInstanceIdentifier",
108+
"Value": "test-instance-lookup"
109+
}
110+
],
111+
"EvaluationPeriods": 3,
112+
"MetricName": "FreeableMemory",
113+
"Namespace": "AWS/RDS",
114+
"Period": 300,
115+
"Statistic": "Average",
116+
"Threshold": 104857600
117+
}
118+
}
119+
},
120+
"Parameters": {
121+
"BootstrapVersion": {
122+
"Type": "AWS::SSM::Parameter::Value<String>",
123+
"Default": "/cdk-bootstrap/hnb659fds/version",
124+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
125+
}
126+
},
127+
"Rules": {
128+
"CheckBootstrapVersion": {
129+
"Assertions": [
130+
{
131+
"Assert": {
132+
"Fn::Not": [
133+
{
134+
"Fn::Contains": [
135+
[
136+
"1",
137+
"2",
138+
"3",
139+
"4",
140+
"5"
141+
],
142+
{
143+
"Ref": "BootstrapVersion"
144+
}
145+
]
146+
}
147+
]
148+
},
149+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
150+
}
151+
]
152+
}
153+
}
154+
}

packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-lookup.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-lookup.js.snapshot/integ.json

Lines changed: 24 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-lookup.js.snapshot/integrdsinstancefromlookupDefaultTestDeployAssert675A9017.assets.json

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-lookup.js.snapshot/integrdsinstancefromlookupDefaultTestDeployAssert675A9017.template.json

Lines changed: 36 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)