Added enums to prevent accidental input on QuickSight Subscription props + minor fixes

Author: enriquh

framework/src/consumption/lib/quicksight/quicksight-subscription-props.ts

@@ -11,7 +11,8 @@ import { Duration, RemovalPolicy } from "aws-cdk-lib";
 export interface QuickSightSubscriptionProps {
 
   /**
-   * The name of your Amazon QuickSight account. This name is unique over all of Amazon Web Services, and it appears only when users sign in. 
+   * The name of your Amazon QuickSight account. 
+   * This name is unique over all of Amazon Web Services, and it appears only when users sign in. 
    * You can't change AccountName value after the Amazon QuickSight account is created.
    */
   readonly accountName: string;
@@ -25,7 +26,7 @@ export interface QuickSightSubscriptionProps {
   * The edition of Amazon QuickSight that you want your account to have. Currently, you can choose from ENTERPRISE or ENTERPRISE_AND_Q .
   *  @default - ENTERPRISE is used as default.
   */
-  readonly edition: string;
+  readonly edition: QuickSightEdition;
 
   /**
    * The Amazon Web Services account ID of the account that you're using to create your Amazon QuickSight account.
@@ -36,8 +37,9 @@ export interface QuickSightSubscriptionProps {
   /**
    * The method that you want to use to authenticate your Amazon QuickSight account.
    * Only IAM_IDENTITY_CENTER, IAM_AND_QUICKSIGHT and IAM_ONLY are supported
+   * @default
    */
-  readonly authenticationMethod: 'IAM_IDENTITY_CENTER'| 'IAM_AND_QUICKSIGHT' | 'IAM_ONLY';
+  readonly authenticationMethod: QuickSightAuthenticationMethod;
 
 
   /**
@@ -76,4 +78,14 @@ export interface QuickSightSubscriptionProps {
    */
     readonly removalPolicy?: RemovalPolicy;
 
+}
+
+export enum QuickSightAuthenticationMethod {
+  IAM_IDENTITY_CENTER = 'IAM_IDENTITY_CENTER',
+  IAM_AND_QUICKSIGHT = 'IAM_AND_QUICKSIGHT',
+  IAM_ONLY = 'IAM_ONLY'
+}
+
+export enum QuickSightEdition {
+    ENTERPRISE = 'ENTERPRISE',
 }

framework/src/consumption/lib/quicksight/quicksight-subscription.ts

@@ -3,10 +3,10 @@
 
 import { Context, TrackedConstruct, TrackedConstructProps } from "../../../utils";
 import { DsfProvider } from '../../../utils/lib/dsf-provider';
-import { QuickSightSubscriptionProps } from './quicksight-subscription-props';
+import { QuickSightSubscriptionProps, QuickSightAuthenticationMethod } from './quicksight-subscription-props';
 import { Construct } from 'constructs';
 import { CustomResource, Duration, RemovalPolicy } from 'aws-cdk-lib';
-import { IRole, ManagedPolicy, PolicyDocument, Role , ServicePrincipal, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam';
+import { IRole,  PolicyDocument, Role , ServicePrincipal, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam';
 import { ILogGroup } from 'aws-cdk-lib/aws-logs';
 import { IFunction } from 'aws-cdk-lib/aws-lambda';
 
@@ -115,7 +115,7 @@ export class QuickSightSubscription extends TrackedConstruct{
     this.adminGroup = props.adminGroup;
     this.authorGroup = props.authorGroup;
     this.readerGroup = props.readerGroup;
-    this.identityRegion = props.identityRegion;
+    this.identityRegion = props.identityRegion;    
 
     this.policyActions = [
       "quicksight:Subscribe",
@@ -138,7 +138,7 @@ export class QuickSightSubscription extends TrackedConstruct{
       "sso:DescribeRegisteredRegions" 
     ]
 
-    if (props.authenticationMethod != 'IAM_IDENTITY_CENTER') {
+    if (props.authenticationMethod != QuickSightAuthenticationMethod.IAM_IDENTITY_CENTER) {
       this.policyActions = this.policyActions.concat(
         [
           "ds:AuthorizeApplication",
@@ -154,10 +154,7 @@ export class QuickSightSubscription extends TrackedConstruct{
     }
 
     this.executionRole = new Role(this, 'Role', {
-      assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
-      managedPolicies: [
-        ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole'),
-      ],
+      assumedBy: new ServicePrincipal('lambda.amazonaws.com'),      
       inlinePolicies: {
         QuickSightSubscription: new PolicyDocument({
           statements : [
@@ -171,7 +168,7 @@ export class QuickSightSubscription extends TrackedConstruct{
       } 
     });
 
-    const timeout = props.executionTimeout || Duration.minutes(5);
+    const timeout = props.executionTimeout ?? Duration.minutes(5);
 
     const provider = new DsfProvider(this, 'CrProvider', {
       providerName: 'QuickSightSubscriptionProvider',
@@ -201,7 +198,7 @@ export class QuickSightSubscription extends TrackedConstruct{
           IDENTITY_REGION: props.identityRegion
         },
       },      
-      queryInterval: Duration.seconds(1),
+      queryInterval: Duration.seconds(10),
       removalPolicy: this.removalPolicy,
     });