Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(integ-tests): allow multiple aws api calls with the same service and command #1

Closed
wants to merge 57 commits into from

Conversation

guiyom-e
Copy link
Owner

Allow multiple uses of integ-tests awsApiCall with the same service and command.

Should close aws#23049.


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@guiyom-e guiyom-e force-pushed the fix/multiple-aws-api-call branch 2 times, most recently from 03e7d70 to a250089 Compare April 21, 2023 16:13
pahud and others added 6 commits April 21, 2023 17:24
…Cloud regions (aws#25215)

Reopening this PR because aws#25170 was closed by accident.

As ECR Public is not available in China regions and GovCloud, `AmazonElasticContainerRegistryPublicReadOnly` IAM managed policy would not be available in those affected regions and should not be attached to the role. This PR implements a CfnCondition to determine if ECR public is available based on `Aws.Partition` of the deploying region and conditionally attach `AmazonElasticContainerRegistryPublicReadOnly` to the kubectl-provider handler role. 

This PR has been tested in the following regions:

- [x] *cn-north-1
- [x] *cn-northwest-1
- [x] us-east-1

* I can confirm the role is created correctly in cn regions but due to 
   - aws#24358 
   - aws#24696  
The cluster and nodegroup are still failing to create in CN.

Closes aws#24743 aws#24808 aws#25178
Replaces `functionActiveV2` with `functionActive`. 

`functionActiveV2` is not available in SDK versions < 2.1080.0, but the one that Lambda currently installs by default is 2.1055.0. The version that Lambda installs by default is the same that the CDK uses.

Closes aws#24358

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
See [CHANGELOG.v2.md](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
aws-cdk-automation and others added 20 commits April 24, 2023 09:30
…aws#25259)

`BackupVault.fromBackupVaultArn` parsed ARNs using the `ArnFormat.SLASH_RESOURCE_NAME` format.
This fix changes it to the [expected](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackup.html#awsbackup-resources-for-iam-policies) `ArnFormat.COLON_RESOURCE_NAME` format.

Closes aws#25212 .

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
https://aws.amazon.com/blogs/aws/amazon-ec2-inf2-instances-for-low-cost-high-performance-generative-ai-inference-are-now-generally-available/

Spiritual successor of aws#23160

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
`EcsJobDefinition.jobDefinitionName` returns the ARN.
This fix will return the name.

Closes aws#25197.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…Mapping (aws#24991)

Currently the eventsourceMappingArn (for example for SQS Lambda Trigger) needs to be constructed manually:
`arn:aws:lambda:eu-west-1:ACCOUNT_ID:event-source-mapping:EVENTSOURCEMAPPINGID`

With this change its no longer needed to construct it manually.
The solution now exposes the `eventSourceMappingArn` on the `IEventSourceMapping`. The ARN is constructed by the individual components (`service, resource, resourceName/eventSourceMappingId` and `format`).

I considered adding a static method `fromEventSourceMappingArn` to the `EventSourceMapping` class.  Wasnt sure if it provides any value, but let me know if you think its a good Idea to add it.

~Sidenote:
I had a bit of a struggle to build the project (during development I had a lot of heap memory issues). 
Additionally I wasnt able to execute the integration tests, I tried to follow https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md#running-integration-tests but either I make something wrong or the guide seems out of date? Would be great if I get some pointers in the right direction.~

Closes aws#24801 .

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
This fixes an issue that occurs when installing Helm charts from OCI repositories other than ECR (e.g. `oci://ghcr.io/grafana-operator/helm-charts/grafana-operator`).

The issue occurs because `subprocess.check_output` is called with `shell=True`, which only invokes the first item of the passed cmnd sequence. So instead of `helm pull $REPO --version $VERSION --untar`, only `helm` is executed, which results in the following output (also observed in the Lambda logs):

<details>
<summary>Output</summary>

```
The Kubernetes package manager

Common actions for Helm:

- helm search:    search for charts
- helm pull:      download a chart to your local directory to view
- helm install:   upload the chart to Kubernetes
- helm list:      list releases of charts

Environment variables:

| Name                               | Description                                                                                       |
|------------------------------------|---------------------------------------------------------------------------------------------------|
| $HELM_CACHE_HOME                   | set an alternative location for storing cached files.                                             |
| $HELM_CONFIG_HOME                  | set an alternative location for storing Helm configuration.                                       |
| $HELM_DATA_HOME                    | set an alternative location for storing Helm data.                                                |
| $HELM_DEBUG                        | indicate whether or not Helm is running in Debug mode                                             |
| $HELM_DRIVER                       | set the backend storage driver. Values are: configmap, secret, memory, sql.                       |
| $HELM_DRIVER_SQL_CONNECTION_STRING | set the connection string the SQL storage driver should use.                                      |
| $HELM_MAX_HISTORY                  | set the maximum number of helm release history.                                                   |
| $HELM_NAMESPACE                    | set the namespace used for the helm operations.                                                   |
| $HELM_NO_PLUGINS                   | disable plugins. Set HELM_NO_PLUGINS=1 to disable plugins.                                        |
| $HELM_PLUGINS                      | set the path to the plugins directory                                                             |
| $HELM_REGISTRY_CONFIG              | set the path to the registry config file.                                                         |
| $HELM_REPOSITORY_CACHE             | set the path to the repository cache directory                                                    |
| $HELM_REPOSITORY_CONFIG            | set the path to the repositories file.                                                            |
| $KUBECONFIG                        | set an alternative Kubernetes configuration file (default "~/.kube/config")                       |
| $HELM_KUBEAPISERVER                | set the Kubernetes API Server Endpoint for authentication                                         |
| $HELM_KUBECAFILE                   | set the Kubernetes certificate authority file.                                                    |
| $HELM_KUBEASGROUPS                 | set the Groups to use for impersonation using a comma-separated list.                             |
| $HELM_KUBEASUSER                   | set the Username to impersonate for the operation.                                                |
| $HELM_KUBECONTEXT                  | set the name of the kubeconfig context.                                                           |
| $HELM_KUBETOKEN                    | set the Bearer KubeToken used for authentication.                                                 |
| $HELM_KUBEINSECURE_SKIP_TLS_VERIFY | indicate if the Kubernetes API server's certificate validation should be skipped (insecure)       |
| $HELM_KUBETLS_SERVER_NAME          | set the server name used to validate the Kubernetes API server certificate                        |
| $HELM_BURST_LIMIT                  | set the default burst limit in the case the server contains many CRDs (default 100, -1 to disable)|

Helm stores cache, configuration, and data based on the following configuration order:

- If a HELM_*_HOME environment variable is set, it will be used
- Otherwise, on systems supporting the XDG base directory specification, the XDG variables will be used
- When no other location is set a default location will be used based on the operating system

By default, the default directories depend on the Operating System. The defaults are listed below:

| Operating System | Cache Path                | Configuration Path             | Data Path               |
|------------------|---------------------------|--------------------------------|-------------------------|
| Linux            | $HOME/.cache/helm         | $HOME/.config/helm             | $HOME/.local/share/helm |
| macOS            | $HOME/Library/Caches/helm | $HOME/Library/Preferences/helm | $HOME/Library/helm      |
| Windows          | %TEMP%\helm               | %APPDATA%\helm                 | %APPDATA%\helm          |

Usage:
  helm [command]

Available Commands:
  completion  generate autocompletion scripts for the specified shell
  create      create a new chart with the given name
  dependency  manage a chart's dependencies
  env         helm client environment information
  get         download extended information of a named release
  help        Help about any command
  history     fetch release history
  install     install a chart
  lint        examine a chart for possible issues
  list        list releases
  package     package a chart directory into a chart archive
  plugin      install, list, or uninstall Helm plugins
  pull        download a chart from a repository and (optionally) unpack it in local directory
  push        push a chart to remote
  registry    login to or logout from a registry
  repo        add, list, remove, update, and index chart repositories
  rollback    roll back a release to a previous revision
  search      search for a keyword in charts
  show        show information of a chart
  status      display the status of the named release
  template    locally render templates
  test        run tests for a release
  uninstall   uninstall a release
  upgrade     upgrade a release
  verify      verify that a chart at the given path has been signed and is valid
  version     print the client version information

Flags:
      --burst-limit int                 client-side default throttling limit (default 100)
      --debug                           enable verbose output
  -h, --help                            help for helm
      --kube-apiserver string           the address and the port for the Kubernetes API server
      --kube-as-group stringArray       group to impersonate for the operation, this flag can be repeated to specify multiple groups.
      --kube-as-user string             username to impersonate for the operation
      --kube-ca-file string             the certificate authority file for the Kubernetes API server connection
      --kube-context string             name of the kubeconfig context to use
      --kube-insecure-skip-tls-verify   if true, the Kubernetes API server's certificate will not be checked for validity. This will make your HTTPS connections insecure
      --kube-tls-server-name string     server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used
      --kube-token string               bearer token used for authentication
      --kubeconfig string               path to the kubeconfig file
  -n, --namespace string                namespace scope for this request
      --registry-config string          path to the registry config file (default "/Users/fabian/Library/Preferences/helm/registry/config.json")
      --repository-cache string         path to the file containing cached repository indexes (default "/Users/fabian/Library/Caches/helm/repository")
      --repository-config string        path to the file containing repository names and URLs (default "/Users/fabian/Library/Preferences/helm/repositories.yaml")

Use "helm [command] --help" for more information about a command.
```

</details>

From the `subprocess` logs:

> On POSIX with shell=True, the shell defaults to /bin/sh. If args is a string, the string specifies the command to execute through the shell. This means that the string must be formatted exactly as it would be when typed at the shell prompt. This includes, for example, quoting or backslash escaping filenames with spaces in them. **If args is a sequence, the first item specifies the command string, and any additional items will be treated as additional arguments to the shell itself.** 

See https://docs.python.org/3/library/subprocess.html#popen-constructor

Merging the `helm` command and its arguments into the first item of the `cmnd` list fixes the issue.

To quickly verify the fix, this code can be added to the file:

```python
logging.basicConfig(level=logging.DEBUG)
tmpdir = tempfile.TemporaryDirectory()
chart_dir = get_chart_from_oci(tmpdir.name, "oci://ghcr.io/grafana-operator/helm-charts/grafana-operator", "v5.0.0-rc0")
```

Without the fix, running the file with Python should then result in the behaviour described above. With the fix the chart should be pulled correctly into the temporary directory.

```sh
python packages/aws-cdk-lib/aws-eks/lib/kubectl-handler/helm/__init__.py
```

Closes aws#24710 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Considering the still volatile nature of the `import` to Cfn and CDK, the default for the required `DeletePolicy` should be to `Retain`. Any mistake that would create new resources can easily be removed with the stack, but we should not jeopardize existing, possible stateful ones.

[CONTRIBUTING GUIDE]: https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md
[DESIGN GUIDELINES]: https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md

Additional typos corrected.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Signed-off-by: Francis <colifran@3c22fbbba690.ant.amazon.com>
Co-authored-by: Francis <colifran@3c22fbbba690.ant.amazon.com>
Co-authored-by: Cory Hall <43035978+corymhall@users.noreply.github.com>
Co-authored-by: Kaizen Conroy <36202692+kaizencc@users.noreply.github.com>
…#25270)

I added colifran to ignore-usernames in github-merit-badges yml file.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Someone complained that the section wasn't accurate since they didn't actually need to put the dependency in `devDependencies` if it was already in `peerDependencies`.

If we have this guidance anyway, clarify it a bit more on how to declare versions.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…n CodePipeline construct (aws#25266)

## Motivation:
Logging is an optional prop as part of the Project construct in the aws-codebuild module. Users can link a codebuild action when as part of their CodePipeline with codebuild options being set via the codeBuildDefaults prop on the CodePipeline construct. Currently, there isn't any ability to enable logging for the codebuild action. This feature allows a user to enable logging as part of a linked codebuild action via S3, CloudWatch, or both.

## Use Case (from issue aws#22045):
At my company we just enabled AWS Config and SecurityHub has generated a rule 'securityhub-codebuild-project-logging-enabled-abcxyz'. This rule states that all CodeBuild projects must have at least one logging option enabled.

However the Build and Synth steps from the pipeline are always failing this check since the pipelines module doesn't allow specifying logging options on the nested CodeBuild projects.

## Testing:
Unit testing was implemented to verify that the CloudFormation template would be synthesized correctly when logging selected as an option on the codeBuildDefaults prop for S3, CloudWatch, or both.

Integration testing was implemented to verify that all resources would be successfully provisioned when a new CodePipeline is created with logging enabled for the codebuild action.

Closes aws#22045

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Fix the final mistakes in the examples, and turn **strict** mode back on.

Depends on aws/jsii-rosetta#68

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…ws#25005)

…ng targets need weights specified

The [ELB docs](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#forward-actions) on this aren't explicit, but the examples do _not_ show a configuration with multiple targets, but no weighting. This change assigns a weight to the action, if one wasn't specified.

If specifying stickiness, but no weight, the template will change.

Fixes aws#24805.

Results in CFN like
  LBListener49E825B4:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - ForwardConfig: TargetGroups: - TargetGroupArn: Ref: TargetGroupOne7810CAFB Weight: 1 - TargetGroupArn: Ref: TargetGroupTwo593946E1 Weight: 1 Type: forward

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Don't pass the argument if the javadoc file doesn't exist.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Adds Windows amiTypes in aws-eks. These are supported via Cloudformation but missing in cdk since the Enum is manually defined.

Closes aws#24803

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Adds a regional fact for the default custom resource NodeJS runtime version. Currently for 'aws' and 'aws-cn' partitions uses NodeJS 16.x and NodeJS 14.x for all other partitions. This should allow continued usage of our custom resources in gov cloud and other non-commercial regions while avoiding usage of Node14 which is EOL for others.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
We hard `aws` partitions hardcoded in certain strings.

Adds an eslint rule to prevent the same from happening again in the future.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
As the module has renamed in aws#25056 the doc should reflect the change accordingly.

Closes #<issue number here>.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
With aws#25224 , gitpod now prebuilds the `aws-cdk-lib` for us and is potentially saving 7-9 minutes with that. This PR makes gitpod continue to build `@aws-cdk-testing/framework-integ` so developers don't have to spend their time waiting for the all integ building. 

Closes #<issue number here>.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Starting from April 2023, all newly created S3 buckets by default have [S3 Block Public Access](https://aws.amazon.com/blogs/aws/amazon-s3-block-public-access-another-layer-of-protection-for-your-accounts-and-buckets/) enabled and [access control lists](https://aws.amazon.com/blogs/aws/new-simplify-access-management-for-data-stored-in-amazon-s3/) (ACLs) disabled, and this prevents the default logBucket for cloudfront to be created. This PR adds the `ObjectOwnership` property to `ObjectWriter` that allows the default log bucket to be successfully created.


Reference
- https://aws.amazon.com/blogs/aws/heads-up-amazon-s3-security-changes-are-coming-in-april-of-2023/
- https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html#access-logs-choosing-s3-bucket

Closes aws#25288 aws#25291 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
MrArnoldPalmer and others added 26 commits April 26, 2023 15:56
Set ObjectOwnership: ObjectWriter automatically if and only if:

   - It is not provided by the user
   - AccessControl ACLs are configured (only if AccessControl != PRIVATE)

If the user does supply ObjectOwnership != ObjectWriter AND they try to set ACLs, we should error.

`ObjectWriter` was essentially the default behavior before the change to disable ACLs by default for new buckets so though this will update existing buckets it should not cause any breakage or replacement.

Closes aws#25288

---------

Co-authored-by: corymhall <43035978+corymhall@users.noreply.github.com>
…tities (aws#25316)

CDK Pipelines creates a single Role which has permissions to start all
CodeBuild jobs. The AssumeRolePolicy for this Role contained a mistake,
which allowed all roles in the same account with appropriate
`sts:AssumeRole` permissions to assume the Role.

Fix this by limiting the AssumeRolePolicy to the actual pipeline's
execution role, which we have so we can reference directly.
We've already been publishing with a stable version for a long time. A
recent change to the repo structure caused us to publish with alpha
versions, but let's just mark it as stable instead.

fixes aws#25143
Even if the old template has paths in it, they are not displayed because all paths are loaded from the assembly metadata.

Include the logicalID paths from the old template, if present, but give preference to the new template.

This will show paths for removed resources, if there are any. Useful to debug replacements.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
The cfnspec job currently doesn't create a PR anymore, because the validation is wrong, and fails the job that creates the PR.

Do the additional "did types get renamed" validation only at build time in a PR, not in the job that creates the PR, so we get more visibility on the changes and it's easier to pick up the work to fix it.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
The patch file that's in here is unnecessary, and in fact harmful: because the rename it applies is not necessary, it copies `undefined` values into perfectly fine types.

Remove patch and add guard rails agains this.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
This PR explains how to `Verify your fix by deployment` before you submit a pull request.

When contributors complete their hack on any modules under `aws-cdk-lib`, it's unclear to them how to verify and ensure their fix can successfully synthesize and deploy in a real AWS environment. This PR explains how to do that with more details including:

1. How to write a minimal cdk App with your fix to verify it in your AWS account
2. How to run all unit tests against your hack
3. How to run a single unit test against your hack
4. How to run all integ tests against your hack
5. How to run a single integ test against your hack

With the additional content, contributors will be able to iterate their development easily and ensure their hack can successfully deploy in their own AWS accounts as expected before they submit their PRs.

Closes aws#25196

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
)

Closes aws#25325.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…nder feature flag) (aws#25324)

When using `addMethod` with `requestValidatorOptions` it is not possible to do this multiple times on the same RestApi. The same node id is used for all `RequestValidators` added using this method.

This PR adds a new feature flag which when enabled will generate a unique id for the RequestValidators added in this way.

fixes aws#7613

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
I accidentally broke the branch while trying to resolve conflicts aws#24714 . I have addressed all of the comments made by @WinterYukky who reviewed my code.

---
I created this Construct so that I can use AWS::EC2::PrefixList quickly.

The differences from L1 are as follows:

- If AddressFamily is not specified, ipv4 is used by default.
- If maxEntries is not specified, the number of entries is automatically calculated from the entries array and set as maxEntries.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
This PR updates all available VPC endpoints in China regions(cn-north-1 and cn-northwest-1).

The list is retrieved from AWS CLI commands [here](aws#25329 (comment)).

Closes aws#25329

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…om pack.sh (aws#25239)

Until this PR, the pre and post package steps defined in `aws-cdk-lib`'s `package.json` were not actually executed during the pack step of the pipeline. The ultimate purpose of this change is to make sure that the `.js` source files are minified in the release pipeline, resulting in a smaller overall package size. 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
)

Closes aws#25248.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
the following runtime support

- Node.js 14
    - 30 Apr 2023
----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Changes the custom resource runtime to use the default based on the region it is deployed in. This will be Node16 in most cases except in isolated regions where it is Node14.

Fix: aws#25335

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…standard:3.0` (aws#25351)

This fix adds support for `aws/codebuild/amazonlinux2-aarch64-standard:3.0` as added [here](https://github.com/aws/aws-codebuild-docker-images/releases/tag/23.04.25).

Closes aws#25334.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
We have a requirement to set PerformanceInsights retention to 2 months. Cfn supports it. Cdk should, too.

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
… is too permissive (aws#25345)

Currently when we enable ELB (both ALB and NLB) access logging (`logAccessLogs` method), it sets bucket policy as below:

```js
          {
            Action: [
              's3:PutObject',
              's3:PutObjectLegalHold',
              's3:PutObjectRetention',
              's3:PutObjectTagging',
              's3:PutObjectVersionTagging',
              's3:Abort*',
            ],
            Action: 's3:PutObject',
            Effect: 'Allow',
            Principal: { AWS: { 'Fn::Join': ['', ['arn:', { Ref: 'AWS::Partition' }, ':iam::127311923021:root']] } },
            Resource: {
              'Fn::Join': ['', [{ 'Fn::GetAtt': ['AccessLoggingBucketA6D88F29', 'Arn'] }, '/AWSLogs/',
                { Ref: 'AWS::AccountId' }, '/*']],
            },
          },
```

However, [the doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/enable-access-logging.html#attach-bucket-policy) says they only need `PutObject` action. Because this policy is too permissive, it also contradicts the Security Hub policy [`[S3.6] S3 permissions granted to other AWS accounts in bucket policies should be restricted`](https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-6).

By this fix, we will allow only `PutObject` action to be more compliant with the policy.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…wrapper` (aws#25357)

The name `cdk-cli-wrapper` has been squatted publicly (and has been removed for malware from NPMJS)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@guiyom-e guiyom-e closed this Jul 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

(integ-tests): awsApiCall() cannot be used with same service and action