aws / aws/aws-cdk

Minify and Merge Resource Policies

Open
#7,732 10 comments 7 reactions 0 assignees View on GitHub
@aws-cdk/aws-iam @aws-cdk/aws-sqs effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

## :question: General Issue

### The Question

I'm using CDK to create a stack with:
- one SQS `Queue`
- numerous CloudWatch `Rule`s with cron schedules that send a message to that one queue

The `AWS::SQS::QueuePolicy` ends up having one policy `Statement` per rule, each having an `ArnEquals` condition allowing the given rule to access/send to the queue.

This results in an `OverLimit` error when trying to deploy the stack, due to `Submitted policy is over max allowed size.` Which makes complete sense, given how many statements there end up being.

I've been trying to find a way to "collapse" all of the policy statements into a single one. I did manage to add a policy statement that would cover it, but CDK still adds all the individual statements as well. I can't figure out how to prevent the addition of those policy statements.

Any advice? Thanks in advance!

### Environment

- **CDK CLI Version:** 1.36.1 (build 4df7dac)
- **Module Version:** 1.36.1
- **OS:** OSX Catalina
- **Language:** Java

### Other information

A couple of extra notes:

1. I noticed in the doc that `Queue` supposedly has `autoCreatePolicy`. First of all, this appears to be read-only in Java, since there's only a documented getter, no setter. Secondly, this method isn't even public, it's protected. It looked tantalizingly promising, but inaccessible. I'm temped to subclass `Queue` and override it, but that feels like a rabbit hole down which I shouldn't be going.

2. I also noticed `IPostProcessor` and got excited, thinking I might be able to post-process the stack & strip out the unwanted policy statements. But I don't see anywhere in the Java API where I could tap into this. I assume this is a core CDK concept.

Anyway, the ability to post-process during the synth would be amazing, if there's no other way to achieve what I'm after.

Thanks!

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the stack with one SQS Queue and multiple CloudWatch Rules on CDK 1.36.1, then inspect the generated AWS::SQS::QueuePolicy statements. Done means the generated policy stays within the SQS size limit while preserving permission for every rule, including a usable path for Java users.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java, typescript
Domain
cloud, infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.