aws / aws/aws-cdk

aws-secretsmanager: add support for blockPublicPolicy in L2 constructs

Open
#33,913 6 comments 2 reactions 0 assignees View on GitHub
@aws-cdk/aws-secretsmanager effort/medium feature-request mixins p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

As of currently, only the L1 Secrets Manager Resource Policy classes (read this as `CfnResourcePolicy`) supports setting the `blockPublicPolicy` boolean attribute:

```typescript
new CfnResourcePolicy(this, 'L1ResourcePolicy', {
secretId: l1ResourcePolicy.secretArn,
blockPublicPolicy: true,
resourcePolicy: {
Version: '2012-10-17',
Statement: [
....
```
It would be excellent to have this property extended to the L2 constructs `ResourcePolicy` and `Secret`

### Use Case

A fairly simple [property extensions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-resourcepolicy.html#aws-resource-secretsmanager-resourcepolicy-properties) that can prevent the user from misconfiguring their Secrets Manager resource policy!

### Proposed Solution

A property that can be extended within the [ResourcePolicy L2 construct here](https://github.com/aws/aws-cdk/blob/e57cc7941b0a02f4912a8dee0365d4512adf151d/packages/aws-cdk-lib/aws-secretsmanager/lib/policy.ts#L43) and then as a property at the [Secrets L2 construct level here](https://github.com/aws/aws-cdk/blob/e57cc7941b0a02f4912a8dee0365d4512adf151d/packages/aws-cdk-lib/aws-secretsmanager/lib/secret.ts#L339).

As an example:
Resource Policy:
```typescript
new ResourcePolicy(this, 'L2ResourcePolicy', {
secret: l2ResourcePolicy,
blockPublicPolicy: true,
policy: {
...
```

Secrets:
```typescript
const l2ResourcePolicy = new Secret(this, 'L2ResourcePolicySecret', {
blockPublicPolicy: true,
});
```

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.1005.0

### Environment details (OS name and version, etc.)

Ubuntu 22.04.5 (WSL)

Contributor guide

Open the contributing guide

Research direction

Start by reading the L2 ResourcePolicy and Secret definitions in packages/aws-cdk-lib/aws-secretsmanager/lib/policy.ts and secret.ts, then compare how they configure the L1 CfnResourcePolicy. Done means both L2 constructs expose blockPublicPolicy and pass it through to the L1 resource policy; check the relevant existing tests for coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.