ecs.Secret that uses dynamic references like so that it can resolve host, password etc. What would be the advised way of doing that? The secret itself is created from an ARN and from there I'd like to get the dynamic references such as {{resolve:secretsmanager:secret-id:secret-string:json-key:version-stage:version-id}} to be used as ValueFrom
@jkosternl @fogfish
@jforge > Is it possible to load a cloudfront webdistribution by id or arn with CDK in a multi stack environment? I would like to decouple creation of the distribution from creation of Route53 Zones, and I do not see some .fromXXX method with Cloudfront.
That's similar to my question, on how to decouple the creation of an S3 bucket, CloudFront with Route53 and Certificate and later set a bucket policy, referring back to the webdistribution. Until now, I don't have a working solution unfortunately, so maybe create a feature request out of it?
If there is no solid argument against such a feature: yes.
I scrutinize myself, whether it makes sense from the CDK creators point of view. In my case a .fromXXX method in the Cloudfront module allows me to establish a better logic/structure in the stack code improving maintainability and testability.
(Besides this I'm used to avoid "bigbangs" in such code, even if the actual outcome do so).
I'll keep you updated.
fromXXX on Cloudfront would help a bit maybe.This is the order I need:
- setup bucket in EU
- setup Cloudfront in US with reference to bucket
- add certificate and domain name
- go back to EU and add a bucket policy which is only open for our Cloudfront.
Since different regions needs to be done in a different Stack, I can't get this to work with CDK.
I'm facing this issue awslabs/serverless-application-model#271
@skinny85 I've got to reduce the problem to this: If I just write one Lambda function (nothing cross-stack inside the Lambda Construct) using e.g. an Asset Code (which should by itself create a zip file from a local lambda folder / take an already zipped lambda, upload it to an S3 bucket, and reference it afterwards), I get the exact same error (i.e. "Parameters must have values") in the pipeline's deploy stage when trying to create a CFN Change Set. Reference code is below.
Lambda function:
new lambda.Function(this, ‘LambdaFunction’, { handler: “index.handler", runtime: lambda.Runtime.NODEJS_8_10, code: lambda.Code.fromAsset(path.join(__dirname, 'lambda.zip')), });Exact error message during CFN Change Set creation (redacted parts are identifier characters only):
Parameters: [AssetParameters[…]S3VersionKey[...], AssetParameters[…]S3Bucket[...], AssetParameters[…]ArtifactHash[...]] must have values (Service: AmazonCloudFormation; Status Code: 400; Error Code: ValidationError; Request ID: […])
As a solution to my problem, as far as I got to it: In CDK, aws-codepipeline-actions.CloudFormationCreateReplaceChangeSetActionProps() and aws-codepipeline-actions.CloudFormationExecuteChangeSetActionProps() seem not to use cdk deploy during deployment, it deploys the CFN template alone. That means if you are deploying a CFN template with e.g. assets, these assets are not packed and uploaded into S3, hence the problem of the stack deployed from this CFN template not finding them afterwards. As a workaround, I've deployed my app through cdk deploy from the build environment's console at the end of the build phase. Works as expected this way.
So, if you are using any of these classes, do count with cdk deploy not being called.
(Any corrections/updates here are welcome).
At this point it's taken up far to much of my time, but I will be going back to my original stack to try and replicate the good results and will report back on any issues found.
deploy: true and deployOptions
LambdaIntergation
Hello, I'm trying to write an S3 bucket policy using typscript that limits access to an S3 endpoint. I;m having difficulty determining how to add a deny statement and how to get the vpceid. Here's the code I have do far:
var s3EndpointVpce = this.s3endpoint.getAtt(//vpceid);
const policyInStatement = new iam.PolicyStatement();
//Need to somehow specify a 'deny' effect
policyInStatement.addActions('s3:GetBucket');
policyInStatement.addActions('s3:GetObject');
policyInStatement.addActions('s3:List');
policyInStatement.addAnyPrincipal();
//policyInStatement.addResources(this.dataInBucket.bucketArn);
policyInStatement.addResources(`${this.dataInBucket.bucketArn}/`);
//policyInStatement.addArnPrincipal(s3EndpointArn.toString());
policyInStatement.addCondition('StringNotEquals', 'SourceVpce:'.concat(s3EndpointVpce.toString()));
this.dataInBucket.addToResourcePolicy(policyInStatement)
Any idea how I should go about accomplishing this?
cdk synth and manually putting them into CloudFormation. So is there something that cdk deploy is doing with an api gateway deploy that isn't included in the CFT?
GatewayVpcEndpoint? example here https://github.com/aws/aws-cdk/blob/v1.18.0/packages/@aws-cdk/aws-ec2/test/integ.vpc-endpoint.lit.ts
