aws / aws/aws-cdk

(aws_events_targets): ( for SNS target there is no option to mention execution role)

Open
#33,827 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-events-targets effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

If I work from AWS console , In case of SNS as a target , EventBridge service allows me to mention the "execution role" , but the same is not allowed via python CDK .

Image

I researched a lot but could not find any keyword argument which can allow me to mention execution role inside aws_events_targets module ( in case when target is SNS )
In aws doc also no option is mentioned to include execution role

AWS Doc link : https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_events_targets/SnsTopic.html

Image

Well , if there is way to mention it vis python cdk then please let me know else I want a feature as given below

#### Add the SNS topic as the target for the rule
event_rule.add_target(aws_events_targets.SnsTopic(topic=sns_topic), **role = event_rule**)

### Use Case

I need this option because I have created an EventBridge rule to send a message to an SNS topic. This SNS topic uses a KMS key for encryption. The EventBridge rule is failing with the following error:

`
User: events.amazonaws.com is not authorized to perform: kms:GenerateDataKey on this resource because the resource does not exist in this Region, no resource-based policies allow access, or a resource-based policy explicitly denies access (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException;`

Now, I do know the potential solution is to provide the EventBridge service with the necessary permissions on this KMS key.
However, I don't want to do that. Instead, I already have an IAM role with similar permissions, and I want EventBridge to assume that IAM role to perform the KMS-related operations.

### Proposed Solution

Please add a keyword argument as "role" in `aws_events_targets` so that we can provide execution role which further eventbridge can assume.

`event_rule.add_target(aws_events_targets.SnsTopic(topic=sns_topic), role = event_rule)`

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.1004.0

### Environment details (OS name and version, etc.)

NAME="Red Hat Enterprise Linux" VERSION="9.5 (Plow)" ID="rhel" ID_LIKE="fedora" VERSION_ID="9.5" PLATFORM_ID="platform:el9"

Contributor guide

Open the contributing guide

Research direction

Start with the aws_events_targets.SnsTopic API and the AWS EventBridge SNS-target documentation linked in the issue; compare the console's execution-role behavior with the Python CDK surface. Done means the supported role behavior is exposed consistently, documented, and validated by the relevant project tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.