Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
revert unrelated changes
  • Loading branch information
pahud committed Jun 10, 2025
commit fca921e9ca1f67d6daf22dafa3648db82f33f862

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
Expand Up @@ -11,26 +11,7 @@ class TestStack extends Stack {
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, props);

// Create a custom policy document without the account root principal
const customPolicy = new iam.PolicyDocument({
statements: [
new iam.PolicyStatement({
actions: ['kms:*'],
resources: ['*'],
principals: [
// Add only the specific principals you want to have access
// For example, a specific IAM role:
new iam.ArnPrincipal('arn:aws:iam::123456789012:role/YourSpecificRole'),
// Or a service principal:
new iam.ServicePrincipal('lambda.amazonaws.com'),
],
}),
],
});

const key = new kms.Key(this, 'Key', {
policy: customPolicy,
});
const key = new kms.Key(this, 'Key');

const domainProps: opensearch.DomainProps = {
removalPolicy: RemovalPolicy.DESTROY,
Expand All @@ -43,13 +24,7 @@ class TestStack extends Stack {
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: ['es:ESHttp*'],
principals: [
// avoid using account root principal otherwise security guardian will flag this
new iam.ServicePrincipal('lambda.amazonaws.com'), // Example: If Lambda needs access
new iam.Role(this, 'OpenSearchAccessRole', {
assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'), // Example: If EC2 needs access
}),
],
principals: [new iam.AccountRootPrincipal()],
resources: ['*'],
}),
],
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -25,12 +25,7 @@ class TestStack extends Stack {
}
}

const app = new App({
context: {
// deploy will fail if this is not set to false unless zone awareness is enabled
'@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby': false,
},
});
const app = new App();
const stack = new TestStack(app, 'cdk-integ-opensearch-gp3');

new IntegTest(app, 'Integ', { testCases: [stack] });
Loading