aws-secretsmanager: add support for blockPublicPolicy in L2 constructs
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
As of currently, only the L1 Secrets Manager Resource Policy classes (read this as `CfnResourcePolicy`) supports setting the `blockPublicPolicy` boolean attribute:
```typescript
new CfnResourcePolicy(this, 'L1ResourcePolicy', {
secretId: l1ResourcePolicy.secretArn,
blockPublicPolicy: true,
resourcePolicy: {
Version: '2012-10-17',
Statement: [
....
```
It would be excellent to have this property extended to the L2 constructs `ResourcePolicy` and `Secret`
### Use Case
A fairly simple [property extensions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-resourcepolicy.html#aws-resource-secretsmanager-resourcepolicy-properties) that can prevent the user from misconfiguring their Secrets Manager resource policy!
### Proposed Solution
A property that can be extended within the [ResourcePolicy L2 construct here](https://github.com/aws/aws-cdk/blob/e57cc7941b0a02f4912a8dee0365d4512adf151d/packages/aws-cdk-lib/aws-secretsmanager/lib/policy.ts#L43) and then as a property at the [Secrets L2 construct level here](https://github.com/aws/aws-cdk/blob/e57cc7941b0a02f4912a8dee0365d4512adf151d/packages/aws-cdk-lib/aws-secretsmanager/lib/secret.ts#L339).
As an example:
Resource Policy:
```typescript
new ResourcePolicy(this, 'L2ResourcePolicy', {
secret: l2ResourcePolicy,
blockPublicPolicy: true,
policy: {
...
```
Secrets:
```typescript
const l2ResourcePolicy = new Secret(this, 'L2ResourcePolicySecret', {
blockPublicPolicy: true,
});
```
### Other Information
_No response_
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.1005.0
### Environment details (OS name and version, etc.)
Ubuntu 22.04.5 (WSL)
Contributor guide
Research direction
Start by reading the L2 ResourcePolicy and Secret definitions in packages/aws-cdk-lib/aws-secretsmanager/lib/policy.ts and secret.ts, then compare how they configure the L1 CfnResourcePolicy. Done means both L2 constructs expose blockPublicPolicy and pass it through to the L1 resource policy; check the relevant existing tests for coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100