Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(s3): default BlockPublicAccess class properties to true (under feature flag) #33001

Closed
wants to merge 15 commits into from
Closed

fix(s3): default BlockPublicAccess class properties to true (under feature flag) #33001

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
e7776ff
chore(aws-s3): default BlockPublicAccess class properties to true for…
manan-pancholi Jan 17, 2025
ee421d3
Merge branch 'main' into default-block-public-access-properties-to-true
manan-pancholi Jan 17, 2025
d965576
Add integ tests
manan-pancholi Jan 22, 2025
c75abfc
Merge branch 'aws:main' into default-block-public-access-properties-t…
manan-pancholi Jan 22, 2025
41e1cb0
Add feature flag for the bug fix
manan-pancholi Jan 22, 2025
1b61d31
Merge branch 'main' into default-block-public-access-properties-to-true
manan-pancholi Jan 22, 2025
74287fe
Update packages/aws-cdk-lib/cx-api/lib/features.ts
manan-pancholi Jan 22, 2025
c42e87e
Update packages/aws-cdk-lib/cx-api/FEATURE_FLAGS.md
manan-pancholi Jan 22, 2025
b7313a5
Merge branch 'main' into default-block-public-access-properties-to-true
manan-pancholi Jan 22, 2025
33d386f
Update packages/aws-cdk-lib/cx-api/README.md
manan-pancholi Jan 22, 2025
2f735b9
Merge branch 'main' into default-block-public-access-properties-to-true
manan-pancholi Feb 6, 2025
25436a4
Enable feature flagging based on @gracelu0's suggestion
manan-pancholi Feb 6, 2025
f170fd5
Merge branch 'main' into default-block-public-access-properties-to-true
manan-pancholi Feb 9, 2025
7e62563
Merge branch 'main' into default-block-public-access-properties-to-true
QuantumNeuralCoder Feb 18, 2025
c69b118
Merge branch 'main' into default-block-public-access-properties-to-true
manan-pancholi Feb 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions packages/aws-cdk-lib/aws-s3/lib/bucket.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1092,10 +1092,10 @@ export class BlockPublicAccess {
public restrictPublicBuckets: boolean | undefined;

constructor(options: BlockPublicAccessOptions) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These new defaults should be set depending on the feature flag, e.g.:

constructor(options: BlockPublicAccessOptions) {
  const defaultToTrue = FeatureFlags.of(this).isEnabled(cxapi.S3_BUCKET_DEFAULT_BLOCK_PUBLIC_ACCESS_PROPERTIES_TO_TRUE);

  this.blockPublicAcls = defaultToTrue ? options.blockPublicAcls ?? true : options.blockPublicAcls;
  this.blockPublicPolicy = defaultToTrue ? options.blockPublicPolicy ?? true : options.blockPublicPolicy;
  this.ignorePublicAcls = defaultToTrue ? options.ignorePublicAcls ?? true : options.ignorePublicAcls;
  this.restrictPublicBuckets = defaultToTrue ? options.restrictPublicBuckets ?? true : options.restrictPublicBuckets;
}

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, will update in the next commit.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gracelu0 - FeatureFlags.of(this) - I could not use this because the current context, i.e. class BlockPublicAccess doesn't implement IConstruct. In my latest commit, I've used a workaround where in I declare a top level variable to represent the feature flag, modify it inside the Bucket constructor and then use its value inside BlockPublicAccess class constructor. I know it doesn't look neat, but could not think of a better way. Let me know if you have a better suggestion.

this.blockPublicAcls = options.blockPublicAcls;
this.blockPublicPolicy = options.blockPublicPolicy;
this.ignorePublicAcls = options.ignorePublicAcls;
this.restrictPublicBuckets = options.restrictPublicBuckets;
this.blockPublicAcls = options.blockPublicAcls ?? true;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit the docstrings for these don't have a default it looks like

  /**
   * Whether to block public ACLs
   *
   * @default true
   * @see https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html#access-control-block-public-access-options
   */
  readonly blockPublicAcls?: boolean;

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aaythapa - Could you please elaborate on your comment? I'm unable to understand the suggested change.

this.blockPublicPolicy = options.blockPublicPolicy ?? true;
this.ignorePublicAcls = options.ignorePublicAcls ?? true;
this.restrictPublicBuckets = options.restrictPublicBuckets ?? true;
}
}

Expand Down
28 changes: 28 additions & 0 deletions packages/aws-cdk-lib/aws-s3/test/bucket.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -972,6 +972,34 @@ describe('bucket', () => {
});
});

test('unspecified blockPublicAccess properties should default to true', () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test is failing since this does not take into account the feature flag. Please refactor to something like this.
Note that you will need to create a new bucket since re-using an already created bucket in tests above will fail the test and is not a true test of this feature.

test('featureFlag @aws-cdk/aws-s3:blockPublicAccessPropertiesDefaultToTrue unspecified blockPublicAccess properties should default to true', () => {
    // GIVEN
    const app = new cdk.App({
      context: {
        '@aws-cdk/aws-s3:blockPublicAccessPropertiesDefaultToTrue': true,
      },
    });
    // WHEN
    const stack = new cdk.Stack(app);
    new s3.Bucket(stack, 'MyBucketNewDefaults', {
      blockPublicAccess: new s3.BlockPublicAccess({
        blockPublicPolicy: false,
        restrictPublicBuckets: false,
      }),
    });
    // THEN
    Template.fromStack(stack).templateMatches({
      'Resources': {
        'MyBucketNewDefaultsC1A67BCD': {
          'Type': 'AWS::S3::Bucket',
          'Properties': {
            'PublicAccessBlockConfiguration': {
              'BlockPublicAcls': true,
              'BlockPublicPolicy': false,
              'IgnorePublicAcls': true,
              'RestrictPublicBuckets': false,
            },
          },
          'DeletionPolicy': 'Retain',
          'UpdateReplacePolicy': 'Retain',
        },
      },
    });
  });

const stack = new cdk.Stack();
new s3.Bucket(stack, 'MyBucket', {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we create a new bucket please. MyBucket is already being created as a part of other tests and the test might become flaky in future.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also dont see the feature flag being set in the test. does this work?

blockPublicAccess: new s3.BlockPublicAccess({
blockPublicPolicy: false,
restrictPublicBuckets: false,
}),
});

Template.fromStack(stack).templateMatches({
'Resources': {
'MyBucketF68F3FF0': {
'Type': 'AWS::S3::Bucket',
'Properties': {
'PublicAccessBlockConfiguration': {
'BlockPublicAcls': true,
'BlockPublicPolicy': false,
'IgnorePublicAcls': true,
'RestrictPublicBuckets': false,
},
},
'DeletionPolicy': 'Retain',
'UpdateReplacePolicy': 'Retain',
},
},
});
});

test('bucket with default block public access setting to throw error msg', () => {
const stack = new cdk.Stack();

Expand Down
Loading