Skip to content

Commit 13020c9

Browse files
horike37horike37
authored
Merge pull request #464 from chrsdietz/gov-cloud-support
Replace "aws" with parititon ref
2 parents a4531c1 + d226619 commit 13020c9

File tree

6 files changed

+159
-48
lines changed

6 files changed

+159
-48
lines changed

‎lib/deploy/stepFunctions/compileIamRole.js

Lines changed: 31 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ const _ = require('lodash');
44
const BbPromise = require('bluebird');
55
const path = require('path');
66
const { isIntrinsic, translateLocalFunctionNames, trimAliasFromLambdaArn } = require('../../utils/aws');
7+
const { getArnPartition } = require('../../utils/arn');
78

89
function getTaskStates(states) {
910
return _.flatMap(states, (state) => {
@@ -33,7 +34,8 @@ function sqsQueueUrlToArn(serverless, queueUrl) {
3334
const region = match[1];
3435
const accountId = match[2];
3536
const queueName = match[3];
36-
return `arn:aws:sqs:${region}:${accountId}:${queueName}`;
37+
const partition = getArnPartition(region);
38+
return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
3739
}
3840
if (isIntrinsic(queueUrl)) {
3941
if (queueUrl.Ref) {
@@ -91,7 +93,9 @@ function getDynamoDBArn(tableName) {
9193
'Fn::Join': [
9294
':',
9395
[
94-
'arn:aws:dynamodb',
96+
'arn',
97+
{ Ref: 'AWS::Partition' },
98+
'dynamodb',
9599
{ Ref: 'AWS::Region' },
96100
{ Ref: 'AWS::AccountId' },
97101
{
@@ -113,7 +117,9 @@ function getDynamoDBArn(tableName) {
113117
'Fn::Join': [
114118
':',
115119
[
116-
'arn:aws:dynamodb',
120+
'arn',
121+
{ Ref: 'AWS::Partition' },
122+
'dynamodb',
117123
{ Ref: 'AWS::Region' },
118124
{ Ref: 'AWS::AccountId' },
119125
`table/${tableName}`,
@@ -132,7 +138,9 @@ function getBatchPermissions() {
132138
'Fn::Join': [
133139
':',
134140
[
135-
'arn:aws:events',
141+
'arn',
142+
{ Ref: 'AWS::Partition' },
143+
'events',
136144
{ Ref: 'AWS::Region' },
137145
{ Ref: 'AWS::AccountId' },
138146
'rule/StepFunctionsGetEventsForBatchJobsRule',
@@ -159,7 +167,9 @@ function getEcsPermissions() {
159167
'Fn::Join': [
160168
':',
161169
[
162-
'arn:aws:events',
170+
'arn',
171+
{ Ref: 'AWS::Partition' },
172+
'events',
163173
{ Ref: 'AWS::Region' },
164174
{ Ref: 'AWS::AccountId' },
165175
'rule/StepFunctionsGetEventsForECSTaskRule',
@@ -188,7 +198,7 @@ function getLambdaPermissions(state) {
188198
const segments = functionName.split(':');
189199

190200
let functionArns;
191-
if (functionName.startsWith('arn:aws:lambda')) {
201+
if (functionName.match(/^arn:aws(-[a-z]+)*:lambda/)) {
192202
// full ARN
193203
functionArns = [
194204
functionName,
@@ -197,17 +207,17 @@ function getLambdaPermissions(state) {
197207
} else if (segments.length === 3 && segments[0].match(/^\d+$/)) {
198208
// partial ARN
199209
functionArns = [
200-
{ 'Fn::Sub': `arn:aws:lambda:\${AWS::Region}:${functionName}` },
201-
{ 'Fn::Sub': `arn:aws:lambda:\${AWS::Region}:${functionName}:*` },
210+
{ 'Fn::Sub': `arn:\${AWS::Partition}:lambda:\${AWS::Region}:${functionName}` },
211+
{ 'Fn::Sub': `arn:\${AWS::Partition}:lambda:\${AWS::Region}:${functionName}:*` },
202212
];
203213
} else {
204214
// name-only (with or without alias)
205215
functionArns = [
206216
{
207-
'Fn::Sub': `arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${functionName}`,
217+
'Fn::Sub': `arn:\${AWS::Partition}:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${functionName}`,
208218
},
209219
{
210-
'Fn::Sub': `arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${functionName}:*`,
220+
'Fn::Sub': `arn:\${AWS::Partition}:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${functionName}:*`,
211221
},
212222
];
213223
}
@@ -236,13 +246,13 @@ function getLambdaPermissions(state) {
236246
resource: [
237247
{
238248
'Fn::Sub': [
239-
'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${functionArn}',
249+
'arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${functionArn}',
240250
{ functionArn },
241251
],
242252
},
243253
{
244254
'Fn::Sub': [
245-
'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${functionArn}:*',
255+
'arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${functionArn}:*',
246256
{ functionArn },
247257
],
248258
},
@@ -282,7 +292,7 @@ function getStepFunctionsPermissions(state) {
282292
action: 'events:PutTargets,events:PutRule,events:DescribeRule',
283293
resource: {
284294
'Fn::Sub': [
285-
'arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule',
295+
'arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule',
286296
{},
287297
],
288298
},
@@ -296,15 +306,15 @@ function getCodeBuildPermissions(state) {
296306
action: 'codebuild:StartBuild,codebuild:StopBuild,codebuild:BatchGetBuilds',
297307
resource: {
298308
'Fn::Sub': [
299-
`arn:aws:codebuild:$\{AWS::Region}:$\{AWS::AccountId}:project/${projectName}`,
309+
`arn:\${AWS::Partition}:codebuild:$\{AWS::Region}:$\{AWS::AccountId}:project/${projectName}`,
300310
{},
301311
],
302312
},
303313
}, {
304314
action: 'events:PutTargets,events:PutRule,events:DescribeRule',
305315
resource: {
306316
'Fn::Sub': [
307-
'arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventForCodeBuildStartBuildRule',
317+
'arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventForCodeBuildStartBuildRule',
308318
{},
309319
],
310320
},
@@ -319,7 +329,7 @@ function getSageMakerPermissions(state) {
319329
action: 'sagemaker:CreateTransformJob,sagemaker:DescribeTransformJob,sagemaker:StopTransformJob',
320330
resource: {
321331
'Fn::Sub': [
322-
`arn:aws:sagemaker:$\{AWS::Region}:$\{AWS::AccountId}:transform-job/${transformJobName}*`,
332+
`arn:\${AWS::Partition}:sagemaker:$\{AWS::Region}:$\{AWS::AccountId}:transform-job/${transformJobName}*`,
323333
{},
324334
],
325335
},
@@ -332,7 +342,7 @@ function getSageMakerPermissions(state) {
332342
action: 'events:PutTargets,events:PutRule,events:DescribeRule',
333343
resource: {
334344
'Fn::Sub': [
335-
'arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventsForSageMakerTransformJobsRule',
345+
'arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventsForSageMakerTransformJobsRule',
336346
{},
337347
],
338348
},
@@ -352,7 +362,7 @@ function getEventBridgePermissions(state) {
352362
action: 'events:PutEvents',
353363
resource: [...eventBuses].map(eventBus => ({
354364
'Fn::Sub': [
355-
'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBus}',
365+
'arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBus}',
356366
{ eventBus },
357367
],
358368
})),
@@ -399,7 +409,8 @@ function consolidatePermissionsByResource(permissions) {
399409

400410
function getIamPermissions(taskStates) {
401411
return _.flatMap(taskStates, (state) => {
402-
switch (state.Resource) {
412+
const resourceName = typeof state.Resource === 'string' ? state.Resource.replace(/^arn:aws(-[a-z]+)*:/, 'arn:aws:') : state.Resource;
413+
switch (resourceName) {
403414
case 'arn:aws:states:::sqs:sendMessage':
404415
case 'arn:aws:states:::sqs:sendMessage.waitForTaskToken':
405416
return getSqsPermissions(this.serverless, state);
@@ -452,7 +463,7 @@ function getIamPermissions(taskStates) {
452463
return getEventBridgePermissions(state);
453464

454465
default:
455-
if (isIntrinsic(state.Resource) || state.Resource.startsWith('arn:aws:lambda')) {
466+
if (isIntrinsic(state.Resource) || !!state.Resource.match(/arn:aws(-[a-z]+)*:lambda/)) {
456467
const trimmedArn = trimAliasFromLambdaArn(state.Resource);
457468
const functionArn = translateLocalFunctionNames.bind(this)(trimmedArn);
458469
return [{

0 commit comments

Comments
 (0)