feat(kinesis): support resource policy for a data stream #31909
Conversation
github-actions
bot
added
effort/medium
mazyu36
force-pushed
the
kinesis-policy-28814
branch
from
f2be286
to
07a5140
Compare
mazyu36
force-pushed
the
kinesis-policy-28814
branch
from
07a5140
to
c2d91b7
Compare
aws-cdk-automation
added
the
pr/needs-community-review
| ```ts | ||
| const stream = new kinesis.Stream(this, 'MyStream'); | ||
|
|
||
| // add resource policy | ||
| stream.addToResourcePolicy(new iam.PolicyStatement({ | ||
| resources: [stream.streamArn], | ||
| actions: ['kinesis:GetRecords'], | ||
| principals: [new iam.AnyPrincipal()], | ||
| })); | ||
| ``` | ||
|
|
||
| A policy document can also be passed on `ResourcePolicy` construction | ||
|
|
||
| ```ts | ||
| const stream = new kinesis.Stream(this, 'MyStream'); | ||
|
|
||
| const policyDocument = new iam.PolicyDocument({ | ||
| assignSids: true, | ||
| statements: [ | ||
| new iam.PolicyStatement({ | ||
| actions: ['kinesis:GetRecords'], | ||
| resources: [stream.streamArn], | ||
| principals: [new iam.AnyPrincipal()], | ||
| }), | ||
| ], | ||
| }); | ||
|
|
||
| // create resource policy | ||
| new kinesis.ResourcePolicy(this, 'ResourcePolicy', { | ||
| stream, | ||
| policyDocument, | ||
| }); | ||
| ``` |
There was a problem hiding this comment.
Would prefer to add a couple of sentences explicitly stating that the first example is Creating a ResourcePolicy using addToResourcePolicyand the second beingCreating a ResourcePolicy manually.
The sentence A policy document can also be passed on ResourcePolicy construction is also a little bit confusing, are we saying that you must pass a policy document when manually creating a ResourcePolicy or that when manually creating a ResourcePolicy you can optionally pass in your own PolicyDocument?
There was a problem hiding this comment.
Thanks. I've updated.
aws-cdk-automation
removed
the
pr/needs-community-review
Co-authored-by: paulhcsun <[email protected]>
Co-authored-by: paulhcsun <[email protected]>
Co-authored-by: paulhcsun <[email protected]>
mergify
bot
dismissed
paulhcsun’s stale review
Pull request has been modified.
|
@paulhcsun |
aws-cdk-automation
added
the
pr/needs-community-review
|
@Mergifyio update |
✅ Branch has been successfully updated |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
aws-cdk-automation
removed
the
pr/needs-community-review
mergify
bot
dismissed
paulhcsun’s stale review
Pull request has been modified.
|
@Mergifyio update |
✅ Branch has been successfully updated |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
Comments on closed issues and PRs are hard for our team to see. |
Issue # (if applicable)
Closes #28814 .
Reason for this change
To support resource policy for a Kinesis Data stream.
Description of changes
ResourcePolicyConstruct.addToResourcePolicymethod toStreamConstruct.Description of how you validated changes
Add unit tests and integ test.
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license