Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(rds): default DatabaseCluser and DatabaseInstance storageEncrypted to true (under feature flag) #32695

Open
wants to merge 25 commits into
base: main
Choose a base branch
from
+5,339 −23
Open

feat(rds): default DatabaseCluser and DatabaseInstance storageEncrypted to true (under feature flag) #32695

Show file tree
Hide file tree
Changes from 24 commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
d80befc
chore: add feature flag
blimmer Dec 31, 2024
ff3521d
feat: enable cluster encryption by default under feature flag
blimmer Dec 31, 2024
319e467
fix: add isStorageLegacyUnencrypted to work around false/undefined on…
blimmer Dec 31, 2024
83d402d
fix: existing integration tests
blimmer Dec 31, 2024
9ce2d46
docs: add readme note about encryption
blimmer Dec 31, 2024
221b872
feat: enable encryption by default for db instances
blimmer Dec 31, 2024
75192b0
fix: existing integration tests
blimmer Dec 31, 2024
04fe2b2
fix: add default properties
blimmer Dec 31, 2024
d1c6c06
feat: add cluster integ test
blimmer Dec 31, 2024
576289e
fix: code sample in readme
blimmer Dec 31, 2024
6bd263d
feat: add instance integ test
blimmer Dec 31, 2024
da306c0
chore: add tests for thrown error
blimmer Dec 31, 2024
6077185
fix: sync snapshot
blimmer Dec 31, 2024
4497f62
Merge branch 'main' into enable-rds-encryption-by-default
blimmer Dec 31, 2024
c089ab2
Merge branch 'main' of github.com:blimmer/aws-cdk into enable-rds-enc…
blimmer Jan 4, 2025
dbea499
refactor: isStorageLegacyUnencrypted -> storageEncryptedLegacyDefault…
blimmer Jan 4, 2025
4af1515
fix: merge conflict issue with feature flag markdown
blimmer Jan 4, 2025
3c317b0
refactor: common `getStorageEncryptedProperty` implementation
blimmer Jan 4, 2025
26a9325
fix: again
blimmer Jan 4, 2025
82f8e77
docs: rework docs
blimmer Jan 4, 2025
9130e4e
Merge branch 'main' of github.com:blimmer/aws-cdk into enable-rds-enc…
blimmer Jan 6, 2025
1086ef1
fix: union type
blimmer Jan 6, 2025
a327f10
docs: readme update
blimmer Jan 6, 2025
becf0a7
fix: method signature
blimmer Jan 6, 2025
14795d0
Merge branch 'main' of github.com:blimmer/aws-cdk into enable-rds-enc…
blimmer Jan 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .../@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.graphql-rds-serverlessv2.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,8 @@ class TestStack extends cdk.Stack {
vpc,
Copy link
Contributor Author

@blimmer blimmer Dec 31, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change affected a lot of integration tests. I opted to use the legacy behaviors for these tests because re-running the creation of all these databases would be extremely slow and expensive.

If someone at AWS with a "free"/"expensed" account would like to rerun all these failing tests, we could go that route, too.

I added explicit new tests for this behavior.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think manually adding "StorageEncrypted": true to the templates would make those tests pass without the need to deploy the related resources (we expect the flag to work given that you added the new test).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the past, I've received PR feedback that you should never manually update snapshot files. I just confirmed that I could add this property manually to the snapshots and that would be an alternative solution to updating the stack definitions.

I'd like a +1 from an approver that this would be OK before I spend the time doing it, based on previous feedback that snapshots should never be manually edited.

Copy link
Contributor

@lpizzinidev lpizzinidev Jan 4, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've received PR feedback that you should never manually update snapshot files

👍 Sounds good!

About the isStorageLegacyUnencrypted comment.
Thanks for clarifying, I'm not sure why CFN defaults to unencrypted clusters and instances.
However, I left some comments on the implementation for small adjustments.

credentials: rds.Credentials.fromGeneratedSecret('clusteradmin', credentialsBaseOptions),
defaultDatabaseName: 'integdb',
storageEncrypted: false,
storageEncryptedLegacyDefaultValue: true,
});

const secret = secretmanager.Secret.fromSecretNameV2(this, 'Secret', 'integ-secretName');
Expand Down
2 changes: 2 additions & 0 deletions ...k-testing/framework-integ/test/aws-rds/test/integ.cluster-data-api-to-imported-cluster.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ const cluster = new rds.DatabaseCluster(stack, 'Database', {
writer: rds.ClusterInstance.serverlessV2('writerInstance'),
vpc,
enableDataApi: true,
storageEncrypted: false,
storageEncryptedLegacyDefaultValue: true,
});

const importedCluster = rds.DatabaseCluster.fromDatabaseClusterAttributes(stack, 'ImportedCluster', {
Expand Down
2 changes: 2 additions & 0 deletions packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-data-api.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ const cluster = new rds.DatabaseCluster(stack, 'Database', {
writer: rds.ClusterInstance.serverlessV2('writerInstance'),
vpc,
enableDataApi: true,
storageEncrypted: false,
storageEncryptedLegacyDefaultValue: true,
});

cluster.grantDataApiAccess(fucntion);
Expand Down
19 changes: 19 additions & 0 deletions ...tion.js.snapshot/IntegClusterDefaultEncryptionDefaultTestDeployAssertBA282386.assets.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

36 changes: 36 additions & 0 deletions ...on.js.snapshot/IntegClusterDefaultEncryptionDefaultTestDeployAssertBA282386.template.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

155 changes: 155 additions & 0 deletions .../asset.a1acfc2b5f4f6b183fd2bb9863f486bc5edef6a357b355a070d9a0e502df418c/__entrypoint__.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions ....snapshot/asset.a1acfc2b5f4f6b183fd2bb9863f486bc5edef6a357b355a070d9a0e502df418c/index.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

32 changes: 32 additions & 0 deletions ...cluster-default-encryption.js.snapshot/aws-cdk-rds-cluster-default-encryption.assets.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading