Skip to content

Commit 632179c

Browse files
TietewTietew
authored
feat(sns-subscriptions): support Amazon Data Firehose subscription (#33811)
### Issue # (if applicable) Closes #14391. ### Reason for this change We can subscribe Amazon Data Firehose delivery streams to Amazon SNS topics. For details, see https://docs.aws.amazon.com/sns/latest/dg/sns-firehose-as-subscriber.html ### Description of changes Added the `FirehoseSubscription` integration class. ### Describe any new or updated permissions being added A role will be created to write messages to Firehose. For details of permissions, see https://docs.aws.amazon.com/sns/latest/dg/prereqs-kinesis-data-firehose.html ### Description of how you validated changes Unit tests and integ tests. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 9534d2a commit 632179c

File tree

30 files changed

+34062
-37
lines changed

30 files changed

+34062
-37
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-sns-subscriptions/test/integ.firehose-cross-region.js.snapshot/asset.44e9c4d7a5d3fd2d677e1a7e416b2b56f6b0104bd5eff9cac5557b4c65a9dc61/index.js

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-sns-subscriptions/test/integ.firehose-cross-region.js.snapshot/aws-cdk-sns-firehose-firehosestack.assets.json

Lines changed: 36 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-sns-subscriptions/test/integ.firehose-cross-region.js.snapshot/aws-cdk-sns-firehose-firehosestack.template.json

Lines changed: 357 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,357 @@
1+
{
2+
"Resources": {
3+
"Bucket83908E77": {
4+
"Type": "AWS::S3::Bucket",
5+
"Properties": {
6+
"Tags": [
7+
{
8+
"Key": "aws-cdk:auto-delete-objects",
9+
"Value": "true"
10+
}
11+
]
12+
},
13+
"UpdateReplacePolicy": "Delete",
14+
"DeletionPolicy": "Delete"
15+
},
16+
"BucketPolicyE9A3008A": {
17+
"Type": "AWS::S3::BucketPolicy",
18+
"Properties": {
19+
"Bucket": {
20+
"Ref": "Bucket83908E77"
21+
},
22+
"PolicyDocument": {
23+
"Statement": [
24+
{
25+
"Action": [
26+
"s3:DeleteObject*",
27+
"s3:GetBucket*",
28+
"s3:List*",
29+
"s3:PutBucketPolicy"
30+
],
31+
"Effect": "Allow",
32+
"Principal": {
33+
"AWS": {
34+
"Fn::GetAtt": [
35+
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
36+
"Arn"
37+
]
38+
}
39+
},
40+
"Resource": [
41+
{
42+
"Fn::GetAtt": [
43+
"Bucket83908E77",
44+
"Arn"
45+
]
46+
},
47+
{
48+
"Fn::Join": [
49+
"",
50+
[
51+
{
52+
"Fn::GetAtt": [
53+
"Bucket83908E77",
54+
"Arn"
55+
]
56+
},
57+
"/*"
58+
]
59+
]
60+
}
61+
]
62+
}
63+
],
64+
"Version": "2012-10-17"
65+
}
66+
}
67+
},
68+
"BucketAutoDeleteObjectsCustomResourceBAFD23C2": {
69+
"Type": "Custom::S3AutoDeleteObjects",
70+
"Properties": {
71+
"ServiceToken": {
72+
"Fn::GetAtt": [
73+
"CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F",
74+
"Arn"
75+
]
76+
},
77+
"BucketName": {
78+
"Ref": "Bucket83908E77"
79+
}
80+
},
81+
"DependsOn": [
82+
"BucketPolicyE9A3008A"
83+
],
84+
"UpdateReplacePolicy": "Delete",
85+
"DeletionPolicy": "Delete"
86+
},
87+
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092": {
88+
"Type": "AWS::IAM::Role",
89+
"Properties": {
90+
"AssumeRolePolicyDocument": {
91+
"Version": "2012-10-17",
92+
"Statement": [
93+
{
94+
"Action": "sts:AssumeRole",
95+
"Effect": "Allow",
96+
"Principal": {
97+
"Service": "lambda.amazonaws.com"
98+
}
99+
}
100+
]
101+
},
102+
"ManagedPolicyArns": [
103+
{
104+
"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
105+
}
106+
]
107+
}
108+
},
109+
"CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F": {
110+
"Type": "AWS::Lambda::Function",
111+
"Properties": {
112+
"Code": {
113+
"S3Bucket": {
114+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-us-east-2"
115+
},
116+
"S3Key": "44e9c4d7a5d3fd2d677e1a7e416b2b56f6b0104bd5eff9cac5557b4c65a9dc61.zip"
117+
},
118+
"Timeout": 900,
119+
"MemorySize": 128,
120+
"Handler": "index.handler",
121+
"Role": {
122+
"Fn::GetAtt": [
123+
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
124+
"Arn"
125+
]
126+
},
127+
"Runtime": "nodejs22.x",
128+
"Description": {
129+
"Fn::Join": [
130+
"",
131+
[
132+
"Lambda function for auto-deleting objects in ",
133+
{
134+
"Ref": "Bucket83908E77"
135+
},
136+
" S3 bucket."
137+
]
138+
]
139+
}
140+
},
141+
"DependsOn": [
142+
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092"
143+
]
144+
},
145+
"DeliveryStreamS3DestinationRoleD96B8345": {
146+
"Type": "AWS::IAM::Role",
147+
"Properties": {
148+
"AssumeRolePolicyDocument": {
149+
"Statement": [
150+
{
151+
"Action": "sts:AssumeRole",
152+
"Effect": "Allow",
153+
"Principal": {
154+
"Service": "firehose.amazonaws.com"
155+
}
156+
}
157+
],
158+
"Version": "2012-10-17"
159+
}
160+
}
161+
},
162+
"DeliveryStreamS3DestinationRoleDefaultPolicyF652AD65": {
163+
"Type": "AWS::IAM::Policy",
164+
"Properties": {
165+
"PolicyDocument": {
166+
"Statement": [
167+
{
168+
"Action": [
169+
"s3:Abort*",
170+
"s3:DeleteObject*",
171+
"s3:GetBucket*",
172+
"s3:GetObject*",
173+
"s3:List*",
174+
"s3:PutObject",
175+
"s3:PutObjectLegalHold",
176+
"s3:PutObjectRetention",
177+
"s3:PutObjectTagging",
178+
"s3:PutObjectVersionTagging"
179+
],
180+
"Effect": "Allow",
181+
"Resource": [
182+
{
183+
"Fn::GetAtt": [
184+
"Bucket83908E77",
185+
"Arn"
186+
]
187+
},
188+
{
189+
"Fn::Join": [
190+
"",
191+
[
192+
{
193+
"Fn::GetAtt": [
194+
"Bucket83908E77",
195+
"Arn"
196+
]
197+
},
198+
"/*"
199+
]
200+
]
201+
}
202+
]
203+
}
204+
],
205+
"Version": "2012-10-17"
206+
},
207+
"PolicyName": "DeliveryStreamS3DestinationRoleDefaultPolicyF652AD65",
208+
"Roles": [
209+
{
210+
"Ref": "DeliveryStreamS3DestinationRoleD96B8345"
211+
}
212+
]
213+
}
214+
},
215+
"DeliveryStream58CF96DB": {
216+
"Type": "AWS::KinesisFirehose::DeliveryStream",
217+
"Properties": {
218+
"DeliveryStreamType": "DirectPut",
219+
"ExtendedS3DestinationConfiguration": {
220+
"BucketARN": {
221+
"Fn::GetAtt": [
222+
"Bucket83908E77",
223+
"Arn"
224+
]
225+
},
226+
"BufferingHints": {
227+
"IntervalInSeconds": 30,
228+
"SizeInMBs": 5
229+
},
230+
"RoleARN": {
231+
"Fn::GetAtt": [
232+
"DeliveryStreamS3DestinationRoleD96B8345",
233+
"Arn"
234+
]
235+
}
236+
}
237+
},
238+
"DependsOn": [
239+
"DeliveryStreamS3DestinationRoleDefaultPolicyF652AD65"
240+
]
241+
},
242+
"DeliveryStreamTopicSubscriptionRole4964AFE6": {
243+
"Type": "AWS::IAM::Role",
244+
"Properties": {
245+
"AssumeRolePolicyDocument": {
246+
"Statement": [
247+
{
248+
"Action": "sts:AssumeRole",
249+
"Effect": "Allow",
250+
"Principal": {
251+
"Service": "sns.amazonaws.com"
252+
}
253+
}
254+
],
255+
"Version": "2012-10-17"
256+
}
257+
}
258+
},
259+
"DeliveryStreamTopicSubscriptionRoleDefaultPolicy7B1E3A87": {
260+
"Type": "AWS::IAM::Policy",
261+
"Properties": {
262+
"PolicyDocument": {
263+
"Statement": [
264+
{
265+
"Action": [
266+
"firehose:DescribeDeliveryStream",
267+
"firehose:ListDeliveryStreams",
268+
"firehose:ListTagsForDeliveryStream",
269+
"firehose:PutRecord",
270+
"firehose:PutRecordBatch"
271+
],
272+
"Effect": "Allow",
273+
"Resource": {
274+
"Fn::GetAtt": [
275+
"DeliveryStream58CF96DB",
276+
"Arn"
277+
]
278+
}
279+
}
280+
],
281+
"Version": "2012-10-17"
282+
},
283+
"PolicyName": "DeliveryStreamTopicSubscriptionRoleDefaultPolicy7B1E3A87",
284+
"Roles": [
285+
{
286+
"Ref": "DeliveryStreamTopicSubscriptionRole4964AFE6"
287+
}
288+
]
289+
}
290+
},
291+
"DeliveryStreamawscdksnsfirehosetopicstackMyTopic20B70ED07AAF6F8C": {
292+
"Type": "AWS::SNS::Subscription",
293+
"Properties": {
294+
"Endpoint": {
295+
"Fn::GetAtt": [
296+
"DeliveryStream58CF96DB",
297+
"Arn"
298+
]
299+
},
300+
"Protocol": "firehose",
301+
"Region": "us-east-1",
302+
"SubscriptionRoleArn": {
303+
"Fn::GetAtt": [
304+
"DeliveryStreamTopicSubscriptionRole4964AFE6",
305+
"Arn"
306+
]
307+
},
308+
"TopicArn": {
309+
"Fn::Join": [
310+
"",
311+
[
312+
"arn:aws:sns:us-east-1:",
313+
{
314+
"Ref": "AWS::AccountId"
315+
},
316+
":sns-firehose-integ-topic"
317+
]
318+
]
319+
}
320+
}
321+
}
322+
},
323+
"Parameters": {
324+
"BootstrapVersion": {
325+
"Type": "AWS::SSM::Parameter::Value<String>",
326+
"Default": "/cdk-bootstrap/hnb659fds/version",
327+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
328+
}
329+
},
330+
"Rules": {
331+
"CheckBootstrapVersion": {
332+
"Assertions": [
333+
{
334+
"Assert": {
335+
"Fn::Not": [
336+
{
337+
"Fn::Contains": [
338+
[
339+
"1",
340+
"2",
341+
"3",
342+
"4",
343+
"5"
344+
],
345+
{
346+
"Ref": "BootstrapVersion"
347+
}
348+
]
349+
}
350+
]
351+
},
352+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
353+
}
354+
]
355+
}
356+
}
357+
}

0 commit comments

Comments
 (0)