feat(glue-alpha): model SecurityConfiguration encryption as factory subtypes - #38586
Conversation
…ubtypes
The three encryption blocks were co-optional `{ mode, kmsKey? }` structs. For
S3, this let an illegal combination be expressed — `{ mode: S3_MANAGED, kmsKey }`
— and the key was then silently dropped (SSE-S3 was applied with no error), a
security-relevant silent failure. The `mode` field on the CloudWatch and Job
Bookmarks blocks was also a mandatory single-value enum carrying no information.
Replace the structs with factory classes that pair the mode with its key
correct-by-construction:
- S3Encryption.s3Managed() / S3Encryption.kms(key?)
- CloudWatchEncryption.kms(key?)
- JobBookmarksEncryption.clientSideKms(key?)
`s3Managed()` takes no key, so a key can never be paired with S3-managed
encryption — the silent-drop is now unrepresentable. The single-value `mode`
field is gone (the factory name encodes it), which removes the now-dead
`CloudWatchEncryptionMode` and `JobBookmarksEncryptionMode` enums. `kms()` still
auto-creates a key when one is omitted, and the existing shared-key behavior is
unchanged, so synthesized output for all valid inputs is identical.
Addresses the SecurityConfiguration encryption-blocks finding from the
aws-glue-alpha pre-GA API review.
BREAKING CHANGE: `s3Encryption`, `cloudWatchEncryption`, and
`jobBookmarksEncryption` are no longer object literals. Use
`S3Encryption.s3Managed()` / `S3Encryption.kms(key?)`,
`CloudWatchEncryption.kms(key?)`, and `JobBookmarksEncryption.clientSideKms(key?)`.
The `CloudWatchEncryptionMode` and `JobBookmarksEncryptionMode` enums are removed
(their mode is now implicit); `S3EncryptionMode` is retained.
GitHub Actions
Failure
|
PRs without a linked issue will receive lower priority for review and merging. Please update the description to follow the PR template and include a line like |
otaviomacedo
added
the
pr-linter/exempt-integ-test
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
aws-cdk-automation
added
the
pr/needs-further-review
aws-cdk-automation
added
the
pr/needs-maintainer-review
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Merge Queue Status
This pull request spent 1 hour 28 minutes 54 seconds in the queue, including 1 hour 58 seconds running CI. Required conditions to merge
|
aws-cdk-automation
removed
the
pr/needs-maintainer-review
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
Comments on closed issues and PRs are hard for our team to see. |
3 participants
The three encryption blocks were co-optional
{ mode, kmsKey? }structs. For S3, this let an illegal combination be expressed —{ mode: S3_MANAGED, kmsKey }— and the key was then silently dropped (SSE-S3 was applied with no error), a security-relevant silent failure. Themodefield on the CloudWatch and Job Bookmarks blocks was also a mandatory single-value enum carrying no information.Replace the structs with factory classes that pair the mode with its key correct-by-construction:
s3Managed()takes no key, so a key can never be paired with S3-managed encryption — the silent-drop is now unrepresentable. The single-valuemodefield is gone (the factory name encodes it), which removes the now-deadCloudWatchEncryptionModeandJobBookmarksEncryptionModeenums.kms()still auto-creates a key when one is omitted, and the existing shared-key behavior is unchanged, so synthesized output for all valid inputs is identical.Addresses the SecurityConfiguration encryption-blocks finding from the aws-glue-alpha pre-GA API review.
BREAKING CHANGE:
s3Encryption,cloudWatchEncryption, andjobBookmarksEncryptionare no longer object literals. UseS3Encryption.s3Managed()/S3Encryption.kms(key?),CloudWatchEncryption.kms(key?), andJobBookmarksEncryption.clientSideKms(key?). TheCloudWatchEncryptionModeandJobBookmarksEncryptionModeenums are removed (their mode is now implicit);S3EncryptionModeis retained.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license