Merge pull request #97 from glb/85-use-partition-pseudo-parameter

fix: use AWS::Partition pseudo-parameter in ARNs
serverless-operations · Aug 18, 2020 · 2858498 · 2858498
2 parents bd51680 + f40bbdf
commit 2858498
Show file tree

Hide file tree

Showing 24 changed files with 142 additions and 97 deletions.
diff --git a/lib/package/dynamodb/compileIamRoleToDynamodb.js b/lib/package/dynamodb/compileIamRoleToDynamodb.js
@@ -26,7 +26,7 @@ module.exports = {
         Action: `dynamodb:${action}`,
         Resource: {
           'Fn::Sub': [
-            'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
+            'arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
             { tableName }
           ]
         }

diff --git a/lib/package/dynamodb/compileIamRoleToDynamodb.test.js b/lib/package/dynamodb/compileIamRoleToDynamodb.test.js
@@ -96,7 +96,7 @@ describe('#compileIamRoleToDynamodb()', () => {
                     Action: 'dynamodb:PutItem',
                     Resource: {
                       'Fn::Sub': [
-                        'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
+                        'arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
                         {
                           tableName: { Ref: 'mytable' }
                         }
@@ -108,7 +108,7 @@ describe('#compileIamRoleToDynamodb()', () => {
                     Action: 'dynamodb:GetItem',
                     Resource: {
                       'Fn::Sub': [
-                        'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
+                        'arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
                         {
                           tableName: 'mytable'
                         }
@@ -120,7 +120,7 @@ describe('#compileIamRoleToDynamodb()', () => {
                     Action: 'dynamodb:DeleteItem',
                     Resource: {
                       'Fn::Sub': [
-                        'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
+                        'arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}',
                         {
                           tableName: 'mytable'
                         }

diff --git a/lib/package/dynamodb/compileMethodsToDynamodb.js b/lib/package/dynamodb/compileMethodsToDynamodb.js
@@ -53,7 +53,7 @@ module.exports = {
       },
       Uri: {
         'Fn::Sub': [
-          'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
+          'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
           { action: http.action }
         ]
       },

diff --git a/lib/package/dynamodb/compileMethodsToDynamodb.test.js b/lib/package/dynamodb/compileMethodsToDynamodb.test.js
@@ -146,7 +146,7 @@ describe('#compileMethodsToDynamodb()', () => {
 
     const uri = {
       'Fn::Sub': [
-        'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
+        'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
         {
           action: 'PutItem'
         }
@@ -183,7 +183,7 @@ describe('#compileMethodsToDynamodb()', () => {
 
     const uri = {
       'Fn::Sub': [
-        'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
+        'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
         {
           action: 'GetItem'
         }
@@ -220,7 +220,7 @@ describe('#compileMethodsToDynamodb()', () => {
 
     const uri = {
       'Fn::Sub': [
-        'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
+        'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
         {
           action: 'DeleteItem'
         }
@@ -757,7 +757,7 @@ describe('#compileMethodsToDynamodb()', () => {
               Credentials: { 'Fn::GetAtt': ['ApigatewayToDynamodbRole', 'Arn'] },
               Uri: {
                 'Fn::Sub': [
-                  'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
+                  'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
                   { action: 'PutItem' }
                 ]
               },
@@ -873,7 +873,7 @@ describe('#compileMethodsToDynamodb()', () => {
               Credentials: { 'Fn::GetAtt': ['ApigatewayToDynamodbRole', 'Arn'] },
               Uri: {
                 'Fn::Sub': [
-                  'arn:aws:apigateway:${AWS::Region}:dynamodb:action/${action}',
+                  'arn:${AWS::Partition}:apigateway:${AWS::Region}:dynamodb:action/${action}',
                   { action: 'PutItem' }
                 ]
               },

diff --git a/lib/package/eventbridge/compileIamRoleToEventBridge.js b/lib/package/eventbridge/compileIamRoleToEventBridge.js
@@ -19,7 +19,7 @@ module.exports = {
 
     const policyResource = eventBusNames.map((eventBusName) => ({
       'Fn::Sub': [
-        'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
+        'arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
         { eventBusName }
       ]
     }))

diff --git a/lib/package/eventbridge/compileIamRoleToEventBridge.test.js b/lib/package/eventbridge/compileIamRoleToEventBridge.test.js
@@ -83,13 +83,13 @@ describe('#compileIamRoleToEventBridge()', () => {
                     Resource: [
                       {
                         'Fn::Sub': [
-                          'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
+                          'arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
                           { eventBusName: { Ref: 'EventBus1' } }
                         ]
                       },
                       {
                         'Fn::Sub': [
-                          'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
+                          'arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}',
                           { eventBusName: { Ref: 'EventBus2' } }
                         ]
                       }

diff --git a/lib/package/eventbridge/compileMethodsToEventBridge.js b/lib/package/eventbridge/compileMethodsToEventBridge.js
@@ -53,7 +53,7 @@ module.exports = {
       Type: 'AWS',
       Credentials: roleArn,
       Uri: {
-        'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
+        'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
       },
       PassthroughBehavior: 'NEVER',
       RequestParameters: {

diff --git a/lib/package/eventbridge/compileMethodsToEventBridge.test.js b/lib/package/eventbridge/compileMethodsToEventBridge.test.js
@@ -69,7 +69,7 @@ describe('#compileMethodsToEventBridge()', () => {
             Type: 'AWS',
             Credentials: { 'Fn::GetAtt': ['ApigatewayToEventBridgeRole', 'Arn'] },
             Uri: {
-              'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
+              'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
             },
             PassthroughBehavior: 'NEVER',
             RequestParameters: {
@@ -189,7 +189,7 @@ describe('#compileMethodsToEventBridge()', () => {
             Type: 'AWS',
             Credentials: { 'Fn::GetAtt': ['ApigatewayToEventBridgeRole', 'Arn'] },
             Uri: {
-              'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
+              'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
             },
             PassthroughBehavior: 'NEVER',
             RequestParameters: {
@@ -308,7 +308,7 @@ describe('#compileMethodsToEventBridge()', () => {
             Type: 'AWS',
             Credentials: { 'Fn::GetAtt': ['ApigatewayToEventBridgeRole', 'Arn'] },
             Uri: {
-              'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
+              'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
             },
             PassthroughBehavior: 'NEVER',
             RequestParameters: {
@@ -687,7 +687,7 @@ describe('#compileMethodsToEventBridge()', () => {
             Type: 'AWS',
             Credentials: { 'Fn::GetAtt': ['ApigatewayToEventBridgeRole', 'Arn'] },
             Uri: {
-              'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
+              'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
             },
             PassthroughBehavior: 'NEVER',
             RequestParameters: {
@@ -794,7 +794,7 @@ describe('#compileMethodsToEventBridge()', () => {
             Type: 'AWS',
             Credentials: { 'Fn::GetAtt': ['ApigatewayToEventBridgeRole', 'Arn'] },
             Uri: {
-              'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
+              'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:events:action/PutEvents'
             },
             PassthroughBehavior: 'NEVER',
             RequestParameters: {

diff --git a/lib/package/kinesis/compileIamRoleToKinesis.js b/lib/package/kinesis/compileIamRoleToKinesis.js
@@ -19,7 +19,7 @@ module.exports = {
 
     const policyResource = kinesisStreamNames.map((streamName) => ({
       'Fn::Sub': [
-        'arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
+        'arn:${AWS::Partition}:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
         { streamName }
       ]
     }))

diff --git a/lib/package/kinesis/compileIamRoleToKinesis.test.js b/lib/package/kinesis/compileIamRoleToKinesis.test.js
@@ -83,13 +83,13 @@ describe('#compileIamRoleToKinesis()', () => {
                     Resource: [
                       {
                         'Fn::Sub': [
-                          'arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
+                          'arn:${AWS::Partition}:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
                           { streamName: { Ref: 'KinesisStream1' } }
                         ]
                       },
                       {
                         'Fn::Sub': [
-                          'arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
+                          'arn:${AWS::Partition}:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}',
                           { streamName: { Ref: 'KinesisStream2' } }
                         ]
                       }

diff --git a/lib/package/kinesis/compileMethodsToKinesis.js b/lib/package/kinesis/compileMethodsToKinesis.js
@@ -53,7 +53,7 @@ module.exports = {
       Type: 'AWS',
       Credentials: roleArn,
       Uri: {
-        'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
+        'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
       },
       PassthroughBehavior: 'NEVER',
       RequestTemplates: this.getKinesisIntegrationRequestTemplates(http)

diff --git a/lib/package/kinesis/compileMethodsToKinesis.test.js b/lib/package/kinesis/compileMethodsToKinesis.test.js
@@ -68,7 +68,7 @@ describe('#compileMethodsToKinesis()', () => {
             Type: 'AWS',
             Credentials: { 'Fn::GetAtt': ['ApigatewayToKinesisRole', 'Arn'] },
             Uri: {
-              'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
+              'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
             },
             PassthroughBehavior: 'NEVER',
             RequestTemplates: {
@@ -181,7 +181,7 @@ describe('#compileMethodsToKinesis()', () => {
             Type: 'AWS',
             Credentials: { 'Fn::GetAtt': ['ApigatewayToKinesisRole', 'Arn'] },
             Uri: {
-              'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
+              'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
             },
             PassthroughBehavior: 'NEVER',
             RequestTemplates: {
@@ -293,7 +293,7 @@ describe('#compileMethodsToKinesis()', () => {
             Type: 'AWS',
             Credentials: { 'Fn::GetAtt': ['ApigatewayToKinesisRole', 'Arn'] },
             Uri: {
-              'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
+              'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
             },
             PassthroughBehavior: 'NEVER',
             RequestTemplates: {
@@ -707,7 +707,7 @@ describe('#compileMethodsToKinesis()', () => {
             Type: 'AWS',
             Credentials: { 'Fn::GetAtt': ['ApigatewayToKinesisRole', 'Arn'] },
             Uri: {
-              'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
+              'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
             },
             PassthroughBehavior: 'NEVER',
             RequestTemplates: {
@@ -807,7 +807,7 @@ describe('#compileMethodsToKinesis()', () => {
             Type: 'AWS',
             Credentials: { 'Fn::GetAtt': ['ApigatewayToKinesisRole', 'Arn'] },
             Uri: {
-              'Fn::Sub': 'arn:aws:apigateway:${AWS::Region}:kinesis:action/PutRecord'
+              'Fn::Sub': 'arn:${AWS::Partition}:apigateway:${AWS::Region}:kinesis:action/PutRecord'
             },
             PassthroughBehavior: 'NEVER',
             RequestTemplates: {

diff --git a/lib/package/s3/compileIamRoleToS3.js b/lib/package/s3/compileIamRoleToS3.js
@@ -12,7 +12,14 @@ function convertToArn(bucket) {
       'Fn::GetAtt': [logicalId, 'Arn']
     }
   } else {
-    return `arn:aws:s3:::${bucket}`
+    return {
+      'Fn::Sub': [
+        'arn:${AWS::Partition}:s3:::${bucket}',
+        {
+          bucket
+        }
+      ]
+    }
   }
 }
 
@@ -40,12 +47,7 @@ module.exports = {
         Effect: 'Allow',
         Action: `s3:${action}*`, // e.g. PutObject*, GetObject*, DeleteObject*
         Resource: {
-          'Fn::Sub': [
-            '${bucket}/*',
-            {
-              bucket: convertToArn(bucket)
-            }
-          ]
+          'Fn::Join': ['', [convertToArn(bucket), '/*']]
         }
       }
     })

diff --git a/lib/package/s3/compileIamRoleToS3.test.js b/lib/package/s3/compileIamRoleToS3.test.js
@@ -103,49 +103,74 @@ describe('#compileIamRoleToS3()', () => {
                     Effect: 'Allow',
                     Action: 's3:PutObject*',
                     Resource: {
-                      'Fn::Sub': [
-                        '${bucket}/*',
-                        {
-                          bucket: 'arn:aws:s3:::myBucket'
-                        }
+                      'Fn::Join': [
+                        '',
+                        [
+                          {
+                            'Fn::Sub': [
+                              'arn:${AWS::Partition}:s3:::${bucket}',
+                              {
+                                bucket: 'myBucket'
+                              }
+                            ]
+                          },
+                          '/*'
+                        ]
                       ]
                     }
                   },
                   {
                     Effect: 'Allow',
                     Action: 's3:GetObject*',
                     Resource: {
-                      'Fn::Sub': [
-                        '${bucket}/*',
-                        {
-                          bucket: 'arn:aws:s3:::myBucket'
-                        }
+                      'Fn::Join': [
+                        '',
+                        [
+                          {
+                            'Fn::Sub': [
+                              'arn:${AWS::Partition}:s3:::${bucket}',
+                              {
+                                bucket: 'myBucket'
+                              }
+                            ]
+                          },
+                          '/*'
+                        ]
                       ]
                     }
                   },
                   {
                     Effect: 'Allow',
                     Action: 's3:DeleteObject*',
                     Resource: {
-                      'Fn::Sub': [
-                        '${bucket}/*',
-                        {
-                          bucket: {
+                      'Fn::Join': [
+                        '',
+                        [
+                          {
                             'Fn::GetAtt': ['MyBucket', 'Arn']
-                          }
-                        }
+                          },
+                          '/*'
+                        ]
                       ]
                     }
                   },
                   {
                     Effect: 'Allow',
                     Action: 's3:PutObject*',
                     Resource: {
-                      'Fn::Sub': [
-                        '${bucket}/*',
-                        {
-                          bucket: 'arn:aws:s3:::myBucketV2'
-                        }
+                      'Fn::Join': [
+                        '',
+                        [
+                          {
+                            'Fn::Sub': [
+                              'arn:${AWS::Partition}:s3:::${bucket}',
+                              {
+                                bucket: 'myBucketV2'
+                              }
+                            ]
+                          },
+                          '/*'
+                        ]
                       ]
                     }
                   }

diff --git a/lib/package/s3/compileMethodsToS3.js b/lib/package/s3/compileMethodsToS3.js
@@ -153,7 +153,7 @@ module.exports = {
       Type: 'AWS',
       Credentials: roleArn,
       Uri: {
-        'Fn::Sub': ['arn:aws:apigateway:${AWS::Region}:s3:path/' + pather, {}]
+        'Fn::Sub': ['arn:${AWS::Partition}:apigateway:${AWS::Region}:s3:path/' + pather, {}]
       },
       PassthroughBehavior: 'WHEN_NO_MATCH',
       RequestParameters: _.merge(requestParams, http.requestParameters)