Skip to content

Commit 6059c19

Browse files
hawflauhawflau
authored
fix: propagate condition to sqs queue policy for sqssubscription (#1798)
* fix: propagate condition to sqs queue policy for sqssubscription * Update unit test for function_event_conditions * Update black commands in Makefile to check only .py files * Update test with one more SNS event source with sqsSubscription set * Revert "Update black commands in Makefile to check only .py files" This reverts commit 115ff09.
1 parent 16fa852 commit 6059c19

File tree

5 files changed

+542
-88
lines changed

5 files changed

+542
-88
lines changed

‎samtranslator/model/eventsources/push.py‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -438,7 +438,7 @@ def to_cloudformation(self, **kwargs):
438438
queue_arn = queue.get_runtime_attr("arn")
439439
queue_url = queue.get_runtime_attr("queue_url")
440440

441-
queue_policy = self._inject_sqs_queue_policy(self.Topic, queue_arn, queue_url)
441+
queue_policy = self._inject_sqs_queue_policy(self.Topic, queue_arn, queue_url, function.resource_attributes)
442442
subscription = self._inject_subscription(
443443
"sqs", queue_arn, self.Topic, self.Region, self.FilterPolicy, function.resource_attributes
444444
)
@@ -461,7 +461,9 @@ def to_cloudformation(self, **kwargs):
461461
batch_size = self.SqsSubscription.get("BatchSize", None)
462462
enabled = self.SqsSubscription.get("Enabled", None)
463463

464-
queue_policy = self._inject_sqs_queue_policy(self.Topic, queue_arn, queue_url, queue_policy_logical_id)
464+
queue_policy = self._inject_sqs_queue_policy(
465+
self.Topic, queue_arn, queue_url, function.resource_attributes, queue_policy_logical_id
466+
)
465467
subscription = self._inject_subscription(
466468
"sqs", queue_arn, self.Topic, self.Region, self.FilterPolicy, function.resource_attributes
467469
)
@@ -497,8 +499,11 @@ def _inject_sqs_event_source_mapping(self, function, role, queue_arn, batch_size
497499
event_source.Enabled = enabled or True
498500
return event_source.to_cloudformation(function=function, role=role)
499501

500-
def _inject_sqs_queue_policy(self, topic_arn, queue_arn, queue_url, logical_id=None):
502+
def _inject_sqs_queue_policy(self, topic_arn, queue_arn, queue_url, resource_attributes, logical_id=None):
501503
policy = SQSQueuePolicy(logical_id or self.logical_id + "QueuePolicy")
504+
if CONDITION in resource_attributes:
505+
policy.set_resource_attribute(CONDITION, resource_attributes[CONDITION])
506+
502507
policy.PolicyDocument = SQSQueuePolicies.sns_topic_send_message_role_policy(topic_arn, queue_arn)
503508
policy.Queues = [queue_url]
504509
return policy

‎tests/translator/input/function_event_conditions.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,22 @@ Resources:
7979
Topic:
8080
Ref: Notifications
8181

82+
SNSTopicWithSQSSubscription:
83+
Type: SNS
84+
Properties:
85+
Topic:
86+
Ref: Notifications
87+
SqsSubscription:
88+
QueueArn: !GetAtt Queue.Arn
89+
QueueUrl: !Ref Queue
90+
91+
AnotherSNSWithSQSSubscription:
92+
Type: SNS
93+
Properties:
94+
Topic:
95+
Ref: Notifications
96+
SqsSubscription: true
97+
8298
KinesisStream:
8399
Type: Kinesis
84100
Properties:
@@ -99,3 +115,7 @@ Resources:
99115

100116
Images:
101117
Type: AWS::S3::Bucket
118+
119+
Queue:
120+
Condition: MyCondition
121+
Type: AWS::SQS::Queue

‎tests/translator/output/aws-cn/function_event_conditions.json‎

Lines changed: 144 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,8 @@
222222
"ManagedPolicyArns": [
223223
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
224224
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole",
225-
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaDynamoDBExecutionRole"
225+
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaDynamoDBExecutionRole",
226+
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole"
226227
],
227228
"Tags": [
228229
{
@@ -459,6 +460,148 @@
459460
"DependsOn": [
460461
"FunctionOneImageBucketPermission"
461462
]
463+
},
464+
"MyAwesomeFunctionSNSTopicWithSQSSubscription": {
465+
"Type": "AWS::SNS::Subscription",
466+
"Properties": {
467+
"Endpoint": {
468+
"Fn::GetAtt": [
469+
"Queue",
470+
"Arn"
471+
]
472+
},
473+
"Protocol": "sqs",
474+
"TopicArn": {
475+
"Ref": "Notifications"
476+
}
477+
},
478+
"Condition": "MyCondition"
479+
},
480+
"MyAwesomeFunctionSNSTopicWithSQSSubscriptionQueuePolicy": {
481+
"Type": "AWS::SQS::QueuePolicy",
482+
"Properties": {
483+
"Queues": [
484+
{
485+
"Ref": "Queue"
486+
}
487+
],
488+
"PolicyDocument": {
489+
"Version": "2012-10-17",
490+
"Statement": [
491+
{
492+
"Action": "sqs:SendMessage",
493+
"Resource": {
494+
"Fn::GetAtt": [
495+
"Queue",
496+
"Arn"
497+
]
498+
},
499+
"Effect": "Allow",
500+
"Condition": {
501+
"ArnEquals": {
502+
"aws:SourceArn": {
503+
"Ref": "Notifications"
504+
}
505+
}
506+
},
507+
"Principal": "*"
508+
}
509+
]
510+
}
511+
},
512+
"Condition": "MyCondition"
513+
},
514+
"MyAwesomeFunctionSNSTopicWithSQSSubscriptionEventSourceMapping": {
515+
"Type": "AWS::Lambda::EventSourceMapping",
516+
"Properties": {
517+
"BatchSize": 10,
518+
"Enabled": true,
519+
"FunctionName": {
520+
"Ref": "MyAwesomeFunctionAliasLive"
521+
},
522+
"EventSourceArn": {
523+
"Fn::GetAtt": [
524+
"Queue",
525+
"Arn"
526+
]
527+
}
528+
},
529+
"Condition": "MyCondition"
530+
},
531+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueue": {
532+
"Type": "AWS::SQS::Queue",
533+
"Properties": {}
534+
},
535+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionEventSourceMapping": {
536+
"Type": "AWS::Lambda::EventSourceMapping",
537+
"Properties": {
538+
"BatchSize": 10,
539+
"Enabled": true,
540+
"FunctionName": {
541+
"Ref": "MyAwesomeFunctionAliasLive"
542+
},
543+
"EventSourceArn": {
544+
"Fn::GetAtt": [
545+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueue",
546+
"Arn"
547+
]
548+
}
549+
},
550+
"Condition": "MyCondition"
551+
},
552+
"MyAwesomeFunctionAnotherSNSWithSQSSubscription": {
553+
"Type": "AWS::SNS::Subscription",
554+
"Properties": {
555+
"Endpoint": {
556+
"Fn::GetAtt": [
557+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueue",
558+
"Arn"
559+
]
560+
},
561+
"Protocol": "sqs",
562+
"TopicArn": {
563+
"Ref": "Notifications"
564+
}
565+
},
566+
"Condition": "MyCondition"
567+
},
568+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueuePolicy": {
569+
"Type": "AWS::SQS::QueuePolicy",
570+
"Properties": {
571+
"Queues": [
572+
{
573+
"Ref": "MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueue"
574+
}
575+
],
576+
"PolicyDocument": {
577+
"Version": "2012-10-17",
578+
"Statement": [
579+
{
580+
"Action": "sqs:SendMessage",
581+
"Resource": {
582+
"Fn::GetAtt": [
583+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueue",
584+
"Arn"
585+
]
586+
},
587+
"Effect": "Allow",
588+
"Condition": {
589+
"ArnEquals": {
590+
"aws:SourceArn": {
591+
"Ref": "Notifications"
592+
}
593+
}
594+
},
595+
"Principal": "*"
596+
}
597+
]
598+
}
599+
},
600+
"Condition": "MyCondition"
601+
},
602+
"Queue": {
603+
"Type": "AWS::SQS::Queue",
604+
"Condition": "MyCondition"
462605
}
463606
}
464607
}

‎tests/translator/output/aws-us-gov/function_event_conditions.json‎

Lines changed: 144 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,8 @@
222222
"ManagedPolicyArns": [
223223
"arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
224224
"arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole",
225-
"arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaDynamoDBExecutionRole"
225+
"arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaDynamoDBExecutionRole",
226+
"arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole"
226227
],
227228
"Tags": [
228229
{
@@ -459,6 +460,148 @@
459460
"DependsOn": [
460461
"FunctionOneImageBucketPermission"
461462
]
463+
},
464+
"MyAwesomeFunctionSNSTopicWithSQSSubscription": {
465+
"Type": "AWS::SNS::Subscription",
466+
"Properties": {
467+
"Endpoint": {
468+
"Fn::GetAtt": [
469+
"Queue",
470+
"Arn"
471+
]
472+
},
473+
"Protocol": "sqs",
474+
"TopicArn": {
475+
"Ref": "Notifications"
476+
}
477+
},
478+
"Condition": "MyCondition"
479+
},
480+
"MyAwesomeFunctionSNSTopicWithSQSSubscriptionQueuePolicy": {
481+
"Type": "AWS::SQS::QueuePolicy",
482+
"Properties": {
483+
"Queues": [
484+
{
485+
"Ref": "Queue"
486+
}
487+
],
488+
"PolicyDocument": {
489+
"Version": "2012-10-17",
490+
"Statement": [
491+
{
492+
"Action": "sqs:SendMessage",
493+
"Resource": {
494+
"Fn::GetAtt": [
495+
"Queue",
496+
"Arn"
497+
]
498+
},
499+
"Effect": "Allow",
500+
"Condition": {
501+
"ArnEquals": {
502+
"aws:SourceArn": {
503+
"Ref": "Notifications"
504+
}
505+
}
506+
},
507+
"Principal": "*"
508+
}
509+
]
510+
}
511+
},
512+
"Condition": "MyCondition"
513+
},
514+
"MyAwesomeFunctionSNSTopicWithSQSSubscriptionEventSourceMapping": {
515+
"Type": "AWS::Lambda::EventSourceMapping",
516+
"Properties": {
517+
"BatchSize": 10,
518+
"Enabled": true,
519+
"FunctionName": {
520+
"Ref": "MyAwesomeFunctionAliasLive"
521+
},
522+
"EventSourceArn": {
523+
"Fn::GetAtt": [
524+
"Queue",
525+
"Arn"
526+
]
527+
}
528+
},
529+
"Condition": "MyCondition"
530+
},
531+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueue": {
532+
"Type": "AWS::SQS::Queue",
533+
"Properties": {}
534+
},
535+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionEventSourceMapping": {
536+
"Type": "AWS::Lambda::EventSourceMapping",
537+
"Properties": {
538+
"BatchSize": 10,
539+
"Enabled": true,
540+
"FunctionName": {
541+
"Ref": "MyAwesomeFunctionAliasLive"
542+
},
543+
"EventSourceArn": {
544+
"Fn::GetAtt": [
545+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueue",
546+
"Arn"
547+
]
548+
}
549+
},
550+
"Condition": "MyCondition"
551+
},
552+
"MyAwesomeFunctionAnotherSNSWithSQSSubscription": {
553+
"Type": "AWS::SNS::Subscription",
554+
"Properties": {
555+
"Endpoint": {
556+
"Fn::GetAtt": [
557+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueue",
558+
"Arn"
559+
]
560+
},
561+
"Protocol": "sqs",
562+
"TopicArn": {
563+
"Ref": "Notifications"
564+
}
565+
},
566+
"Condition": "MyCondition"
567+
},
568+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueuePolicy": {
569+
"Type": "AWS::SQS::QueuePolicy",
570+
"Properties": {
571+
"Queues": [
572+
{
573+
"Ref": "MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueue"
574+
}
575+
],
576+
"PolicyDocument": {
577+
"Version": "2012-10-17",
578+
"Statement": [
579+
{
580+
"Action": "sqs:SendMessage",
581+
"Resource": {
582+
"Fn::GetAtt": [
583+
"MyAwesomeFunctionAnotherSNSWithSQSSubscriptionQueue",
584+
"Arn"
585+
]
586+
},
587+
"Effect": "Allow",
588+
"Condition": {
589+
"ArnEquals": {
590+
"aws:SourceArn": {
591+
"Ref": "Notifications"
592+
}
593+
}
594+
},
595+
"Principal": "*"
596+
}
597+
]
598+
}
599+
},
600+
"Condition": "MyCondition"
601+
},
602+
"Queue": {
603+
"Type": "AWS::SQS::Queue",
604+
"Condition": "MyCondition"
462605
}
463606
}
464607
}

0 commit comments

Comments
 (0)