Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cloudformation: add parameter for forwarder bucket name #516

Merged
merged 2 commits into from
Dec 21, 2021

Conversation

jimjh
Copy link
Contributor

@jimjh jimjh commented Nov 21, 2021

What does this PR do?

Allow the user to specify a name for the forwarder bucket. This is necessary to avoid a circular dependency when creating permissions boundaries and passed them in via PermissionsBoundaryArn.

From https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html

If you don't specify a name, AWS CloudFormation generates a unique ID and uses that ID for the bucket name.

Motivation

Use case: I would like to create a permission boundary that limits datadog S3 privileges, but continue to allow unfettered access to the forwarder bucket (see https://github.com/DataDog/datadog-serverless-functions/blob/master/aws/logs_monitoring/template.yaml#L635-L646).

Before this change, the forwarder bucket's name is always generated, which makes it impossible to create the permission boundary before creating the forwarder bucket/role using cloudformation.

Testing Guidelines

I am forking it and running this within my own CloudFormation pipeline.

Types of changes

Check all that apply

  • This PR's description is comprehensive
  • This PR contains breaking changes that are documented in the description
  • This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
  • This PR impacts documentation, and it has been updated (or a ticket has been logged)
  • This PR's changes are covered by the automated tests (should be covered by installation tests.)
  • This PR collects user input/sensitive content into Datadog
  • This PR passes the integration tests (ask a Datadog member to run the tests)
  • This PR passes the unit tests
  • This PR passes the installation tests (ask a Datadog member to run the tests)

@jimjh jimjh changed the title add parameter for forwarder bucket name cloudformation: add parameter for forwarder bucket name Nov 21, 2021
@jimjh
Copy link
Contributor Author

jimjh commented Dec 10, 2021

👋 hi can I get some help running these tests?

@tianchu
Copy link
Contributor

tianchu commented Dec 21, 2021

@jimjh I was able to test your changes and they worked just fine. Thanks for your contribution!

@tianchu tianchu merged commit 24dff24 into DataDog:master Dec 21, 2021
@jimjh jimjh deleted the jimjh/allow-forwarder-bucket-name branch January 20, 2022 07:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants