Skip to content

Commit d1f234b

Browse files
hawflauhawflau
authored
Fix missing xray policy for State Machine resource (#1941)
* Fix missing xray policy for State Machine resource * Update comment
1 parent a07fbec commit d1f234b

12 files changed

+449
-9
lines changed

‎samtranslator/model/sam_resources.py‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
from samtranslator.model.sns import SNSTopic
4848
from samtranslator.model.stepfunctions import StateMachineGenerator
4949
from samtranslator.model.role_utils import construct_role_for_resource
50+
from samtranslator.model.xray_utils import get_xray_managed_policy_name
5051

5152

5253
class SamFunction(SamResourceMacro):
@@ -453,13 +454,7 @@ def _construct_role(self, managed_policy_map, event_invoke_policies):
453454

454455
managed_policy_arns = [ArnGenerator.generate_aws_managed_policy_arn("service-role/AWSLambdaBasicExecutionRole")]
455456
if self.Tracing:
456-
# use previous (old) policy name for regular regions
457-
# for china and gov regions, use the newer policy name
458-
partition_name = ArnGenerator.get_partition_name()
459-
if partition_name == "aws":
460-
managed_policy_name = "AWSXrayWriteOnlyAccess"
461-
else:
462-
managed_policy_name = "AWSXRayDaemonWriteAccess"
457+
managed_policy_name = get_xray_managed_policy_name()
463458
managed_policy_arns.append(ArnGenerator.generate_aws_managed_policy_arn(managed_policy_name))
464459
if self.VpcConfig:
465460
managed_policy_arns.append(

‎samtranslator/model/stepfunctions/generators.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
from samtranslator.model.tags.resource_tagging import get_tag_list
1818

1919
from samtranslator.model.intrinsics import is_intrinsic
20+
from samtranslator.model.xray_utils import get_xray_managed_policy_name
2021
from samtranslator.utils.cfn_dynamic_references import is_dynamic_reference
2122

2223

@@ -210,8 +211,12 @@ def _construct_role(self):
210211
:returns: the generated IAM Role
211212
:rtype: model.iam.IAMRole
212213
"""
214+
policies = self.policies[:]
215+
if self.tracing and self.tracing.get("Enabled") is True:
216+
policies.append(get_xray_managed_policy_name())
217+
213218
state_machine_policies = ResourcePolicies(
214-
{"Policies": self.policies},
219+
{"Policies": policies},
215220
# No support for policy templates in the "core"
216221
policy_template_processor=None,
217222
)

‎samtranslator/model/xray_utils.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from samtranslator.translator.arn_generator import ArnGenerator
2+
3+
4+
def get_xray_managed_policy_name():
5+
# use previous (old) policy name for regular regions
6+
# for china and gov regions, use the newer policy name
7+
partition_name = ArnGenerator.get_partition_name()
8+
if partition_name == "aws":
9+
return "AWSXrayWriteOnlyAccess"
10+
return "AWSXRayDaemonWriteAccess"

‎tests/translator/input/state_machine_with_xray_policies.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
Resources:
2+
MyFunction:
3+
Type: "AWS::Serverless::Function"
4+
Properties:
5+
CodeUri: s3://sam-demo-bucket/hello.zip
6+
Handler: hello.handler
7+
Runtime: python2.7
8+
9+
StateMachine:
10+
Type: AWS::Serverless::StateMachine
11+
Properties:
12+
Name: MyBasicStateMachine
13+
Type: STANDARD
14+
DefinitionUri: s3://sam-demo-bucket/my-state-machine.asl.json
15+
Tracing:
16+
Enabled: true
17+
Policies:
18+
- Version: "2012-10-17"
19+
Statement:
20+
- Effect: Allow
21+
Action: lambda:InvokeFunction
22+
Resource: !GetAtt MyFunction.Arn

‎tests/translator/input/state_machine_with_xray.yaml‎ renamed to ‎tests/translator/input/state_machine_with_xray_role.yaml‎

File renamed without changes.

‎tests/translator/output/aws-cn/state_machine_with_xray_policies.json‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
{
2+
"Resources": {
3+
"MyFunction": {
4+
"Type": "AWS::Lambda::Function",
5+
"Properties": {
6+
"Code": {
7+
"S3Bucket": "sam-demo-bucket",
8+
"S3Key": "hello.zip"
9+
},
10+
"Handler": "hello.handler",
11+
"Role": {
12+
"Fn::GetAtt": [
13+
"MyFunctionRole",
14+
"Arn"
15+
]
16+
},
17+
"Runtime": "python2.7",
18+
"Tags": [
19+
{
20+
"Key": "lambda:createdBy",
21+
"Value": "SAM"
22+
}
23+
]
24+
}
25+
},
26+
"MyFunctionRole": {
27+
"Type": "AWS::IAM::Role",
28+
"Properties": {
29+
"AssumeRolePolicyDocument": {
30+
"Version": "2012-10-17",
31+
"Statement": [
32+
{
33+
"Action": [
34+
"sts:AssumeRole"
35+
],
36+
"Effect": "Allow",
37+
"Principal": {
38+
"Service": [
39+
"lambda.amazonaws.com"
40+
]
41+
}
42+
}
43+
]
44+
},
45+
"ManagedPolicyArns": [
46+
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
47+
],
48+
"Tags": [
49+
{
50+
"Key": "lambda:createdBy",
51+
"Value": "SAM"
52+
}
53+
]
54+
}
55+
},
56+
"StateMachine": {
57+
"Type": "AWS::StepFunctions::StateMachine",
58+
"Properties": {
59+
"DefinitionS3Location": {
60+
"Bucket": "sam-demo-bucket",
61+
"Key": "my-state-machine.asl.json"
62+
},
63+
"RoleArn": {
64+
"Fn::GetAtt": [
65+
"StateMachineRole",
66+
"Arn"
67+
]
68+
},
69+
"StateMachineName": "MyBasicStateMachine",
70+
"StateMachineType": "STANDARD",
71+
"Tags": [
72+
{
73+
"Key": "stateMachine:createdBy",
74+
"Value": "SAM"
75+
}
76+
],
77+
"TracingConfiguration": {
78+
"Enabled": true
79+
}
80+
}
81+
},
82+
"StateMachineRole": {
83+
"Type": "AWS::IAM::Role",
84+
"Properties": {
85+
"AssumeRolePolicyDocument": {
86+
"Version": "2012-10-17",
87+
"Statement": [
88+
{
89+
"Action": [
90+
"sts:AssumeRole"
91+
],
92+
"Effect": "Allow",
93+
"Principal": {
94+
"Service": [
95+
"states.amazonaws.com"
96+
]
97+
}
98+
}
99+
]
100+
},
101+
"ManagedPolicyArns": [
102+
"arn:aws-cn:iam::aws:policy/AWSXRayDaemonWriteAccess"
103+
],
104+
"Policies": [
105+
{
106+
"PolicyName": "StateMachineRolePolicy0",
107+
"PolicyDocument": {
108+
"Version": "2012-10-17",
109+
"Statement": [
110+
{
111+
"Effect": "Allow",
112+
"Action": "lambda:InvokeFunction",
113+
"Resource": {
114+
"Fn::GetAtt": [
115+
"MyFunction",
116+
"Arn"
117+
]
118+
}
119+
}
120+
]
121+
}
122+
}
123+
],
124+
"Tags": [
125+
{
126+
"Key": "stateMachine:createdBy",
127+
"Value": "SAM"
128+
}
129+
]
130+
}
131+
}
132+
}
133+
}

‎tests/translator/output/aws-cn/state_machine_with_xray.json‎ renamed to ‎tests/translator/output/aws-cn/state_machine_with_xray_role.json‎

File renamed without changes.

‎tests/translator/output/aws-us-gov/state_machine_with_xray_policies.json‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
{
2+
"Resources": {
3+
"MyFunction": {
4+
"Type": "AWS::Lambda::Function",
5+
"Properties": {
6+
"Code": {
7+
"S3Bucket": "sam-demo-bucket",
8+
"S3Key": "hello.zip"
9+
},
10+
"Handler": "hello.handler",
11+
"Role": {
12+
"Fn::GetAtt": [
13+
"MyFunctionRole",
14+
"Arn"
15+
]
16+
},
17+
"Runtime": "python2.7",
18+
"Tags": [
19+
{
20+
"Key": "lambda:createdBy",
21+
"Value": "SAM"
22+
}
23+
]
24+
}
25+
},
26+
"MyFunctionRole": {
27+
"Type": "AWS::IAM::Role",
28+
"Properties": {
29+
"AssumeRolePolicyDocument": {
30+
"Version": "2012-10-17",
31+
"Statement": [
32+
{
33+
"Action": [
34+
"sts:AssumeRole"
35+
],
36+
"Effect": "Allow",
37+
"Principal": {
38+
"Service": [
39+
"lambda.amazonaws.com"
40+
]
41+
}
42+
}
43+
]
44+
},
45+
"ManagedPolicyArns": [
46+
"arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
47+
],
48+
"Tags": [
49+
{
50+
"Key": "lambda:createdBy",
51+
"Value": "SAM"
52+
}
53+
]
54+
}
55+
},
56+
"StateMachine": {
57+
"Type": "AWS::StepFunctions::StateMachine",
58+
"Properties": {
59+
"DefinitionS3Location": {
60+
"Bucket": "sam-demo-bucket",
61+
"Key": "my-state-machine.asl.json"
62+
},
63+
"RoleArn": {
64+
"Fn::GetAtt": [
65+
"StateMachineRole",
66+
"Arn"
67+
]
68+
},
69+
"StateMachineName": "MyBasicStateMachine",
70+
"StateMachineType": "STANDARD",
71+
"Tags": [
72+
{
73+
"Key": "stateMachine:createdBy",
74+
"Value": "SAM"
75+
}
76+
],
77+
"TracingConfiguration": {
78+
"Enabled": true
79+
}
80+
}
81+
},
82+
"StateMachineRole": {
83+
"Type": "AWS::IAM::Role",
84+
"Properties": {
85+
"AssumeRolePolicyDocument": {
86+
"Version": "2012-10-17",
87+
"Statement": [
88+
{
89+
"Action": [
90+
"sts:AssumeRole"
91+
],
92+
"Effect": "Allow",
93+
"Principal": {
94+
"Service": [
95+
"states.amazonaws.com"
96+
]
97+
}
98+
}
99+
]
100+
},
101+
"ManagedPolicyArns": [
102+
"arn:aws-us-gov:iam::aws:policy/AWSXRayDaemonWriteAccess"
103+
],
104+
"Policies": [
105+
{
106+
"PolicyName": "StateMachineRolePolicy0",
107+
"PolicyDocument": {
108+
"Version": "2012-10-17",
109+
"Statement": [
110+
{
111+
"Effect": "Allow",
112+
"Action": "lambda:InvokeFunction",
113+
"Resource": {
114+
"Fn::GetAtt": [
115+
"MyFunction",
116+
"Arn"
117+
]
118+
}
119+
}
120+
]
121+
}
122+
}
123+
],
124+
"Tags": [
125+
{
126+
"Key": "stateMachine:createdBy",
127+
"Value": "SAM"
128+
}
129+
]
130+
}
131+
}
132+
}
133+
}

‎tests/translator/output/aws-us-gov/state_machine_with_xray.json‎ renamed to ‎tests/translator/output/aws-us-gov/state_machine_with_xray_role.json‎

File renamed without changes.

0 commit comments

Comments
 (0)