fix(cloudfront): use wildcard when grant some cloudfront permission #33802

phuhung273 · 2025-03-17T15:43:15Z

Issue # (if applicable)

Reason for this change

CloudFront doesn't support resource-level permission for some permission as per Actions, resources, and condition keys for Amazon CloudFront

Description of changes

Use wildcard(*) when grant some cloudfront permission

Describe any new or updated permissions being added

Use wildcard(*) when grant some cloudfront permission

Description of how you validated changes

Unit + Integ

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

codecov · 2025-03-17T15:52:34Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.98%. Comparing base (74cbe27) to head (5ac8de6).
Report is 12 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33802   +/-   ##
=======================================
  Coverage   83.98%   83.98%           
=======================================
  Files         120      120           
  Lines        6976     6976           
  Branches     1178     1178           
=======================================
  Hits         5859     5859           
  Misses       1005     1005           
  Partials      112      112

Flag	Coverage Δ
suite.unit	`83.98% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`83.98% <ø> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Tietew · 2025-03-18T01:08:50Z

packages/aws-cdk-lib/aws-cloudfront/test/distribution.test.ts

        {
          Action: [
            'cloudfront:ListInvalidations',
-            'cloudfront:GetInvalidation',
+            'cloudfront:ListDistributions',
          ],
+          Resource: '*',
+        },


This change seems to be incorrect because the ListInvalidations action can be restricted by distribution ARN. In other words, the action supports resource-level permissions.

Evidence:
Actions, resources, and condition keys for Amazon CloudFront
The ListDistributions row shows it requires distribution resource type.

Thanks for the doc reference, I've updated the list of wildcard only permission.

aws-cdk-automation

(This review is outdated)

aws-cdk-automation

(This review is outdated)

Dismissing outdated PRLinter review.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

aws-cdk-automation

(This review is outdated)

aws-cdk-automation · 2025-04-09T00:11:43Z

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. Note that PRs with failing linting check or builds are not reviewed, please ensure your build is passing

To prevent automatic closure:

Resume work on the PR
OR request an exemption by adding a comment containing 'Exemption Request' with justification e.x "Exemption Request: "
OR request clarification by adding a comment containing 'Clarification Request' with a question e.x "Clarification Request: "

This PR will automatically close in 14 days if no action is taken.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

packages/aws-cdk-lib/aws-cloudfront/lib/private/utils.ts

kumsmrit

Thank you for your contribution; the PR looks good, except for a few minor comment.

packages/aws-cdk-lib/aws-cloudfront/lib/private/utils.ts

mergify · 2025-06-06T22:22:49Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-06-06T22:54:17Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 067a99d
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-06-06T22:54:45Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-06-06T22:54:59Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

github-actions bot added admired-contributor [Pilot] contributed between 13-24 PRs to the CDK bug This issue is a bug. effort/small Small work item – less than a day of effort p2 labels Mar 17, 2025

aws-cdk-automation requested a review from a team March 17, 2025 15:43

aws-cdk-automation previously requested changes Mar 17, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 17, 2025

Tietew reviewed Mar 18, 2025

View reviewed changes

aws-cdk-automation previously requested changes Mar 18, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 18, 2025

phuhung273 requested a review from Tietew March 18, 2025 13:04

aws-cdk-automation previously requested changes Mar 18, 2025

View reviewed changes

phuhung273 changed the title ~~fix(cloudfront): use wildcard when grant cloudfront:List* permission~~ fix(cloudfront): use wildcard when grant some cloudfront permission Mar 18, 2025

github-actions bot mentioned this pull request Apr 1, 2025

Monthly PR metrics report #33994

Open

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 9, 2025

kumsmrit self-assigned this Jun 2, 2025

kumsmrit reviewed Jun 6, 2025

View reviewed changes

packages/aws-cdk-lib/aws-cloudfront/lib/private/utils.ts Outdated Show resolved Hide resolved

phuhung273 added 5 commits June 6, 2025 11:53

fix(cloudfront): use wildcard when grant cloudfront:List* permission

fef3da4

integ

fdf360b

list of wildcard action

74567a8

improve codecov

dd4fc08

adjust comment

ed81fad

phuhung273 force-pushed the cloudfront-grant-list branch from 5ac8de6 to ed81fad Compare June 6, 2025 11:55

kumsmrit reviewed Jun 6, 2025

View reviewed changes

packages/aws-cdk-lib/aws-cloudfront/lib/private/utils.ts Outdated Show resolved Hide resolved

remove cloudfront:CreateVpcOrigin from wildcardOnlyActions

8a77595

kumsmrit approved these changes Jun 6, 2025

View reviewed changes

Merge branch 'main' into cloudfront-grant-list

067a99d

mergify bot merged commit 452a5e1 into aws:main Jun 6, 2025
15 of 16 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Jun 6, 2025

phuhung273 deleted the cloudfront-grant-list branch June 7, 2025 09:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(cloudfront): use wildcard when grant some cloudfront permission #33802

fix(cloudfront): use wildcard when grant some cloudfront permission #33802

Uh oh!

phuhung273 commented Mar 17, 2025 •

edited

Loading

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

codecov bot commented Mar 17, 2025 •

edited

Loading

Uh oh!

Tietew Mar 18, 2025

Uh oh!

phuhung273 Mar 18, 2025

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

aws-cdk-automation commented Apr 9, 2025

Uh oh!

Uh oh!

kumsmrit left a comment

Uh oh!

Uh oh!

mergify bot commented Jun 6, 2025

Uh oh!

aws-cdk-automation commented Jun 6, 2025

Uh oh!

mergify bot commented Jun 6, 2025

Uh oh!

Uh oh!

github-actions bot commented Jun 6, 2025

Uh oh!

Uh oh!

fix(cloudfront): use wildcard when grant some cloudfront permission #33802

fix(cloudfront): use wildcard when grant some cloudfront permission #33802

Uh oh!

Conversation

phuhung273 commented Mar 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Mar 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Tietew Mar 18, 2025

Choose a reason for hiding this comment

Uh oh!

phuhung273 Mar 18, 2025

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation commented Apr 9, 2025

Uh oh!

Uh oh!

kumsmrit left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mergify bot commented Jun 6, 2025

Uh oh!

aws-cdk-automation commented Jun 6, 2025

AWS CodeBuild CI Report

Uh oh!

mergify bot commented Jun 6, 2025

Uh oh!

Uh oh!

github-actions bot commented Jun 6, 2025

Uh oh!

Uh oh!

phuhung273 commented Mar 17, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Mar 17, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading