C[omp]ute

From: andrew cooke <andrew@...>

Date: Tue, 22 Aug 2023 11:02:26 -0400

In theory go (golang) has first class support in AWS CDK.  In practice
there are often missing examples.  Support for Aspects was particularly
poor, so here's a simple example.

This adds a permission boundary to all roles, so you don't have to do
it explicitly (and includes implicit roles).  The ARN for the boundary
includes the account name which is read from the environment.

In examples for other languages there's an issue with "instanceof"
operators (or similar) and multiple javascript packages.  The same
problem may exist here, so treat with care.

The code is very simple, once it's there...

Andrew


package main

import (
    "os"

    "github.com/aws/aws-cdk-go/awscdk/v2"
    iam "github.com/aws/aws-cdk-go/awscdk/v2/awsiam"
    "github.com/aws/aws-sdk-go-v2/aws"
    "github.com/aws/constructs-go/constructs/v10"
)

func main() {
    app = ...
    env = ...
    ...
    awscdk.Aspects_Of(app).Add(&AddPermissionsBoundary{Account: env.Account})
    ...
    app.Synth(nil)
}

type AddPermissionsBoundary struct {
    Account *string
}

func (this AddPermissionsBoundary) Visit(node constructs.IConstruct) {
    role, ok := node.(iam.CfnRole)
    if ok {
  	role.SetPermissionsBoundary(aws.String("arn:aws:iam::" + *this.Account + ":policy/my-boundary"))
    } else {
	// not a role - the aspect is applied to all nodes in the tree (visitor pattern)
    }
}