feat(appsync): add L2 constructs for AWS AppSync Events

[kwwendt]

Issue # (if applicable)

Closes #32004

Reason for this change

This is in support of AWS AppSync Events.

Description of changes

• New constructs for EventApi and ChannelNamespace to support AWS AppSync Events.
• Create common file for authorization config across EventApi and GraphqlApi constructs.
• Create common file for common resources across EventApi and GraphqlApi constructs.

Description of how you validated changes

Added both unit and integration tests for AWS AppSync Event API changes.

Contributors

@mazyu36 @onlybakam @kwwendt

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Pull request has been modified.

[godwingrs22]

Thanks @kwwendt for addressing the comments. Your effort on this L2 construct is greatly appreciated, and I'm looking forward to seeing it in action. I've left a few additional comments related to the grant methods, particularly regarding their implementation and testing.

[godwingrs22]

I appreciate the unit tests we have for the grantConnect(), grantPublish(), and grantSubscribe() methods on the channel namespace level. However, to ensure these methods work as expected in a real-world scenario, it would be beneficial to update this integration tests.

Specifically, I recommend updating this integ test that tests the whole event api. The test could include:

1. Using api.grantConnect() to allow connection to the API
2. Using namespace.grantPublish() to permit publishing events to specific channel namespace
3. Using namespace.grantSubscribe() to allow subscribing to events in a specific channel namespace
4. Using namespace.grantPublishAndSubscribe() to allow publishing and subscribing to events

After granting these permissions, the test could attempt to connect to the API, publish test events, and subscribe to receive events. This would provide a more comprehensive validation of the constructs in a practical context.

Let me know if it doesn't makes sense.

[godwingrs22]

Does grantPublish and grantSubscribe applicable to both channel namespace and event api? I noticed that the test cases only demonstrate granting publish and subscribe access at the channel namespace level, and I couldn't find test cases for granting these permissions to the whole event API.

Additionally, the IAM console descriptions state as follows

EventPublish - Grants permission to publish events to a channel namespace
EventSubscribe - Grants permission to subscribe to a channel namespace

This makes me wonder about the necessity and functionality of the following methods in eventapi.ts, given that we have similar methods in channel-namespace.ts

public grantPublish(grantee: IGrantable)
public grantSubscribe(grantee: IGrantable)
public grantPublishAndSubscribe(grantee: IGrantable)

If these grant methods are indeed applicable to the event API as a whole, it would be beneficial to have unit tests and integration tests that cover these methods, similar to how we test the grant methods for channel namespaces.

[kwwendt]

The methods for defined in eventapi.ts would grant either publish, subscribe, or both for all channel namespaces associated with the API. This is called out in the doc strings for each method. Example below for grantPublish:

  /**
   * Adds an IAM policy statement for EventPublish access to this EventApi to an IAM
   * principal's policy. This grants publish permission for all channels within the API.
   *
   * @param grantee The principal
   */

That's a good catch on missing unit tests there. I will add those in. Thanks!

[godwingrs22]

Noted. Thanks for the clarification.

[godwingrs22]

Can we have unit test and integ test similar that tests namespace1.grantPublishAndSubscribe() grant method?

[kwwendt]

Implemented in this new unit test: Appsync Event API channel namespace - grant publish and subscribe from channel in appsync-channel-namespace.test.ts.

Pull request has been modified.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 91172b4
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository