search

aws / aws-cdk

The AWS Cloud Development Kit is a framework for defining cloud infrastructure in code
https://aws.amazon.com/cdk
Apache License 2.0
11.55k stars 3.87k forks source link

fix(cognito): deprecate privateKey and add privateKeyValue as typed SecureValue #31409

Closed pahud closed 2 weeks ago

pahud commented 2 weeks ago

Issue # (if applicable)

Closes https://github.com/aws/aws-cdk/issues/31378

Reason for this change

  1. privateKey was typed string which should be SecureValue just as clientSecretValue in Google IdP. This PR deprecates privateKey and adds privateKeyValue with correct type.
  2. apple.ts was named by mistake and it won't be unit tested. This PR renames it to apple.test.ts so it would be covered. Figured an existing test was failed, just fixed that failed one as well.

Description of changes

Users must now provide either privateKey or privateKeyValue, but not both. This change enhances security by allowing the use of SecretValue for the Apple IDP private key.

Description of how you validated changes

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

pahud commented 2 weeks ago

Exemption Request

GavinZZ commented 2 weeks ago

Exemption Request

Have you tested this by deploying to CFN?

pahud commented 2 weeks ago

@GavinZZ

Unfortunately I don't have a valid private_key for that. And there's no existing integ test for that as well so I am offering unit tests only.

8:07:08 PM | CREATE_FAILED | AWS::Cognito::UserPoolIdentityProvider | AppleIdentityProvider6271AB3B Provided private key cannot be used for Sign in with Apple. (Service: AWSCognitoIdentityProviderService; Status Code: 400; Error Code: InvalidParameterException; Request ID: b28d3b10-14ca-42bc-a288-e1db34e7d6e3; Proxy: null)

mergify[bot] commented 2 weeks ago

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify[bot] commented 2 weeks ago

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation commented 2 weeks ago

AWS CodeBuild CI Report

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify[bot] commented 2 weeks ago

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions[bot] commented 2 weeks ago

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.