Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(iam): User.fromUserArn does not work for ARNs that include a path #16269

Merged
merged 4 commits into from
Oct 4, 2021
Merged

fix(iam): User.fromUserArn does not work for ARNs that include a path #16269

merged 4 commits into from
Oct 4, 2021

Conversation

jumic
Copy link
Contributor

@jumic jumic commented Aug 29, 2021

If a IAM user has a path, the ARN contains the path, e.g. arn:aws:iam::account-id:user/path/MyUserName.
Method User.fromUserArn parses this ARN to userName: path/MyUserName. The path is not removed correctly. The correct username would be MyUserName.

This PR changes the parsing of property userName to remove the path correctly. The logic is implemented according to iam.Role where a similar conversion is necessary to support service roles.

Fixes #16256.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@gitpod-io
Copy link

gitpod-io bot commented Aug 29, 2021

@peterwoodworth peterwoodworth added effort/small Small work item – less than a day of effort p1 @aws-cdk/aws-iam Related to AWS Identity and Access Management labels Sep 1, 2021
rix0rrr
rix0rrr previously requested changes Sep 7, 2021
View reviewed changes
Copy link
Contributor

@rix0rrr rix0rrr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a test that extracts a username from a Token as well.

@jumic
Copy link
Contributor Author

jumic commented Sep 7, 2021

In my opinion it is not possible to extract a username from a token. We would have to split the resourceName at character / and use the select function to get the username. However, we don't know the index we have to pass to the select function. As far as I know, there is no function to get the last element.

If I'm wrong and there is a solution for it, please let me know. Do you have an example in this case?

If I'm right: Sometimes CDK throws an error if an unresolved token is used in a method where it is not supported. In general, fromUserAttributes supports using token, therefore no error should be thrown. The limitation only exists for ARNs that contain a path.

@mergify mergify bot dismissed rix0rrr’s stale review September 8, 2021 21:06

Pull request has been modified.

@jumic
Copy link
Contributor Author

jumic commented Sep 8, 2021

I checked the test cases again. I added tests to extract username from token (without path) because they were missing.
Extracting the username from token which includes a path is not tested because it will not be possible (see comment above).

@jumic jumic requested a review from rix0rrr September 9, 2021 16:39
@rix0rrr rix0rrr changed the title fix(iam): userName in User.fromUserArn not parsed correctly if ARN includes path fix(iam): User.fromUserArn does not work for ARNs that include a path Oct 4, 2021
@mergify
Copy link
Contributor

mergify bot commented Oct 4, 2021

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
  • Commit ID: cd0deea
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit 5c69c94 into aws:master Oct 4, 2021
@mergify
Copy link
Contributor

mergify bot commented Oct 4, 2021

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

xykkong added a commit to xykkong/aws-cdk that referenced this pull request Oct 6, 2021
@xykkong
Merge branch '15588' of https://github.com/xykkong/aws-cdk into 15588
0208bd3 
* '15588' of https://github.com/xykkong/aws-cdk: (47 commits)
  chore: rollback `GenericSSMParameterImage` deprecation (backport aws#16798) (aws#16800)
  chore(deps): bump actions/setup-node from 2.4.0 to 2.4.1 (aws#16778)
  Update CHANGELOG.md
  chore(release): 1.126.0
  feat(assertions): matcher support for `templateMatches()` API (aws#16789)
  feat(stepfunctions-tasks): add step concurrency level to EmrCreateCluster (aws#15242)
  docs(s3): correct heading levels Object Ownership / Bucket deletion (aws#16790)
  chore(individual-pkg-gen): fix bug in setting alpha package visibility (aws#16787)
  fix(s3): setting `autoDeleteObjects` to `false` empties the bucket (aws#16756)
  fix(iam): `User.fromUserArn` does not work for ARNs that include a path (aws#16269)
  fix(cli): progress bar overshoots count by 1 for stack updates (aws#16168)
  fix(config): add SourceAccount condition to Lambda permission (aws#16617)
  docs(events): add a note about not using `EventPattern` with `CfnRule` (aws#16715)
  docs(core): fix reference to nonexistant enum value (aws#16716)
  chore(s3-deployments): update python version on BucketDeployment handler (aws#16771)
  chore: set response-requested length to 2 and closing-soon to 5 (aws#16763)
  fix(revert): "fix: CDK does not honor NO_PROXY settings (aws#16751)" (aws#16761)
  docs(GitHub issue templates): Upgrade to GitHub Issues v2 (aws#16592)
  chore: reset jsii-rosetta worker count to default (aws#16755)
  fix: CDK does not honor NO_PROXY settings (aws#16751)
  ...
njlynch pushed a commit that referenced this pull request Oct 11, 2021
@jumic @njlynch
fix(iam): User.fromUserArn does not work for ARNs that include a pa…
5d6c21a 
…th (#16269)

If a IAM user has a path, the ARN contains the path, e.g. `arn:aws:iam::account-id:user/path/MyUserName`.
Method `User.fromUserArn` parses this ARN to `userName`: `path/MyUserName`. The path is not removed correctly. The correct username would be `MyUserName`.

This PR changes the parsing of property `userName` to remove the path correctly. The logic is implemented according to [iam.Role](https://github.com/aws/aws-cdk/blob/d5ca419448e84f0cbb25dbd90d48fb4c407ede5c/packages/%40aws-cdk/aws-iam/lib/role.ts#L191-L194) where a similar conversion is necessary to support service roles.

Fixes #16256.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
TikiTDO pushed a commit to TikiTDO/aws-cdk that referenced this pull request Feb 21, 2022
@jumic @TikiTDO
fix(iam): User.fromUserArn does not work for ARNs that include a pa…
f9b47a4 
…th (aws#16269)

If a IAM user has a path, the ARN contains the path, e.g. `arn:aws:iam::account-id:user/path/MyUserName`.
Method `User.fromUserArn` parses this ARN to `userName`: `path/MyUserName`. The path is not removed correctly. The correct username would be `MyUserName`.

This PR changes the parsing of property `userName` to remove the path correctly. The logic is implemented according to [iam.Role](https://github.com/aws/aws-cdk/blob/d5ca419448e84f0cbb25dbd90d48fb4c407ede5c/packages/%40aws-cdk/aws-iam/lib/role.ts#L191-L194) where a similar conversion is necessary to support service roles.

Fixes aws#16256.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rix0rrr rix0rrr rix0rrr approved these changes

Assignees

@rix0rrr rix0rrr

Labels
@aws-cdk/aws-iam Related to AWS Identity and Access Management effort/small Small work item – less than a day of effort p1
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

(module name): short issue description
4 participants
@jumic @aws-cdk-automation @rix0rrr @peterwoodworth