Skip to content

Commit 68bfc63

Browse files
enriquhlmouhib
enriquh
authored and
lmouhib
committed
Initial version of QuickSightSubscription construct
1 parent 72f2ad6 commit 68bfc63

File tree

9 files changed

+978
-0
lines changed

9 files changed

+978
-0
lines changed

‎framework/.projen/tasks.json

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎framework/API.md

Lines changed: 546 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎framework/src/consumption/lib/index.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,4 @@
44
export * from './redshift';
55
export * from './athena';
66
export * from './opensearch';
7+
export * from './quicksight';

‎framework/src/consumption/lib/quicksight/index.ts

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
export * from './quicksight-subscription'
5+
export * from './quicksight-subscription-props'

‎framework/src/consumption/lib/quicksight/quicksight-subscription-props.ts

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
import { Duration, RemovalPolicy } from "aws-cdk-lib";
5+
6+
7+
/**
8+
* The properties for the `QuickSightSubscription` construct
9+
*/
10+
11+
export interface QuickSightSubscriptionProps {
12+
13+
/**
14+
* The name of your Amazon QuickSight account. This name is unique over all of Amazon Web Services, and it appears only when users sign in.
15+
* You can't change AccountName value after the Amazon QuickSight account is created.
16+
*/
17+
readonly accountName: string;
18+
19+
/**
20+
* The email address that you want Amazon QuickSight to send notifications to regarding your Amazon QuickSight account or Amazon QuickSight subscription.
21+
*/
22+
readonly notificationEmail: string;
23+
24+
/**
25+
* The edition of Amazon QuickSight that you want your account to have. Currently, you can choose from ENTERPRISE or ENTERPRISE_AND_Q .
26+
* @default - ENTERPRISE is used as default.
27+
*/
28+
readonly edition: string;
29+
30+
/**
31+
* The Amazon Web Services account ID of the account that you're using to create your Amazon QuickSight account.
32+
*/
33+
readonly awsAccountId: string;
34+
35+
36+
/**
37+
* The method that you want to use to authenticate your Amazon QuickSight account.
38+
* Only IAM_IDENTITY_CENTER, IAM_AND_QUICKSIGHT and IAM_ONLY are supported
39+
*/
40+
readonly authenticationMethod: 'IAM_IDENTITY_CENTER'| 'IAM_AND_QUICKSIGHT' | 'IAM_ONLY';
41+
42+
43+
/**
44+
* The admin group associated with your Active Directory or IAM Identity Center account. This field is required as IAM_IDENTITY_CENTER is
45+
* the only supported authentication method of the new Amazon QuickSight account
46+
*/
47+
readonly adminGroup: string[];
48+
49+
50+
/**
51+
* The author group associated with your IAM Identity Center account.
52+
*/
53+
readonly authorGroup: string[];
54+
55+
/**
56+
* The reader group associated with your IAM Identity Center account.
57+
*/
58+
readonly readerGroup: string[];
59+
60+
/**
61+
* The region to use as main QuickSight region (used to store configuration and identities info)
62+
*/
63+
readonly identityRegion: string;
64+
65+
/**
66+
* The timeout for the QuickSight account subscription.
67+
* @default - 5mins
68+
*/
69+
readonly executionTimeout?: Duration;
70+
71+
/**
72+
* The removal policy when deleting the CDK resource.
73+
* If DESTROY is selected, context value `@data-solutions-framework-on-aws/removeDataOnDestroy` needs to be set to true.
74+
* Otherwise, the removalPolicy is reverted to RETAIN.
75+
* @default - The resources are not deleted (`RemovalPolicy.RETAIN`).
76+
*/
77+
readonly removalPolicy?: RemovalPolicy;
78+
79+
}

‎framework/src/consumption/lib/quicksight/quicksight-subscription.ts

Lines changed: 235 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
import { Context, TrackedConstruct, TrackedConstructProps } from "../../../utils";
5+
import { DsfProvider } from '../../../utils/lib/dsf-provider';
6+
import { QuickSightSubscriptionProps } from './quicksight-subscription-props';
7+
import { Construct } from 'constructs';
8+
import { CustomResource, Duration, RemovalPolicy } from 'aws-cdk-lib';
9+
import { IRole, ManagedPolicy, PolicyDocument, Role , ServicePrincipal, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam';
10+
import { ILogGroup } from 'aws-cdk-lib/aws-logs';
11+
import { IFunction } from 'aws-cdk-lib/aws-lambda';
12+
13+
14+
15+
16+
/**
17+
* Creates an asynchronous custom resource that handles the creation of a QuickSight subscription
18+
*
19+
* @example
20+
* const subscription = new dsf.consumption.QuickSightSubscription(this, 'RedshiftNamespace', {
21+
* name: "default",
22+
* dbName: 'defaultdb',
23+
* });
24+
*
25+
*/
26+
27+
export class QuickSightSubscription extends TrackedConstruct{
28+
29+
/**
30+
*
31+
*/
32+
public static readonly RESOURCE_TYPE = "Custom::QuickSightSubscription";
33+
34+
/**
35+
* The CloudWatch Log Group for the QuickSight account subscription submission
36+
*/
37+
public readonly submitLogGroup: ILogGroup;
38+
/**
39+
* The Lambda Function for the the Redshift Data submission
40+
*/
41+
public readonly submitFunction: IFunction;
42+
/**
43+
* The IAM Role for the QuickSight account subscription execution
44+
*/
45+
public readonly executionRole: IRole;
46+
47+
/**
48+
* The CloudWatch Log Group for the QuickSight account subscription status checks
49+
*/
50+
public readonly statusLogGroup: ILogGroup;
51+
/**
52+
* The Lambda Function for the QuickSight account subscription status checks
53+
*/
54+
public readonly statusFunction: IFunction;
55+
56+
/**
57+
* The CloudWatch Log Group for the QuickSight account subscription cleaning up lambda
58+
*/
59+
public readonly cleanUpLogGroup?: ILogGroup;
60+
/**
61+
* The Lambda function for the QuickSight account subscription cleaning up lambda
62+
*/
63+
public readonly cleanUpFunction?: IFunction;
64+
/**
65+
* The IAM Role for the the QuickSight account subscription cleaning up lambda
66+
*/
67+
public readonly cleanUpRole?: IRole;
68+
69+
/**
70+
* The name of your Amazon QuickSight account. This name is unique over all of Amazon Web Services, and it appears only when users sign in.
71+
* You can't change AccountName value after the Amazon QuickSight account is created.
72+
*/
73+
public readonly accountName: string;
74+
75+
/**
76+
* The email address that you want Amazon QuickSight to send notifications to regarding your Amazon QuickSight account or Amazon QuickSight subscription.
77+
*/
78+
readonly notificationEmail: string;
79+
80+
/**
81+
* The admin group associated with your Active Directory or IAM Identity Center account. This field is required as IAM_IDENTITY_CENTER is
82+
* the only supported authentication method of the new Amazon QuickSight account
83+
*/
84+
readonly adminGroup: string[];
85+
86+
/**
87+
* The author group associated with your IAM Identity Center account.
88+
*/
89+
readonly authorGroup: string[];
90+
91+
/**
92+
* The reader group associated with your IAM Identity Center account.
93+
*/
94+
readonly readerGroup: string[];
95+
96+
/**
97+
* The region to use as main QuickSight region (used to store configuration and identities info)
98+
*/
99+
readonly identityRegion: string;
100+
101+
private readonly removalPolicy: RemovalPolicy;
102+
103+
private readonly serviceToken: string;
104+
private readonly policyActions: string[];
105+
106+
constructor (scope: Construct, id: string, props: QuickSightSubscriptionProps) {
107+
const trackedConstructProps: TrackedConstructProps = {
108+
trackingTag: QuickSightSubscription.name,
109+
};
110+
super(scope, id, trackedConstructProps);
111+
112+
this.removalPolicy = Context.revertRemovalPolicy(scope, props.removalPolicy);
113+
this.accountName = props.accountName;
114+
this.notificationEmail = props.notificationEmail;
115+
this.adminGroup = props.adminGroup;
116+
this.authorGroup = props.authorGroup;
117+
this.readerGroup = props.readerGroup;
118+
this.identityRegion = props.identityRegion;
119+
120+
this.policyActions = [
121+
"quicksight:Subscribe",
122+
"quicksight:UpdateAccountSettings",
123+
"quicksight:Create*",
124+
"quicksight:Unsubscribe",
125+
"quicksight:DescribeAccountSubscription",
126+
"sso:GetManagedApplicationInstance" ,
127+
"sso:CreateManagedApplicationInstance",
128+
"sso:GetManagedApplicationInstance",
129+
"sso:DeleteManagedApplicationInstance",
130+
"sso:GetManagedApplicationInstance",
131+
"sso:DescribeGroup",
132+
"sso:SearchGroups",
133+
"sso:GetProfile",
134+
"sso:AssociateProfile",
135+
"sso:DisassociateProfile",
136+
"sso:ListProfiles",
137+
"sso:ListDirectoryAssociations",
138+
"sso:DescribeRegisteredRegions"
139+
]
140+
141+
if (props.authenticationMethod != 'IAM_IDENTITY_CENTER') {
142+
this.policyActions = this.policyActions.concat(
143+
[
144+
"ds:AuthorizeApplication",
145+
"ds:UnauthorizeApplication",
146+
"ds:CheckAlias",
147+
"ds:CreateAlias",
148+
"ds:DescribeDirectories",
149+
"ds:DescribeTrusts",
150+
"ds:DeleteDirectory",
151+
"ds:CreateIdentityPoolDirectory"
152+
]
153+
)
154+
}
155+
156+
this.executionRole = new Role(this, 'Role', {
157+
assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
158+
managedPolicies: [
159+
ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole'),
160+
],
161+
inlinePolicies: {
162+
QuickSightSubscription: new PolicyDocument({
163+
statements : [
164+
new PolicyStatement({
165+
effect: Effect.ALLOW,
166+
actions: this.policyActions,
167+
resources: ['*']
168+
})
169+
]
170+
})
171+
}
172+
});
173+
174+
const timeout = props.executionTimeout || Duration.minutes(5);
175+
176+
const provider = new DsfProvider(this, 'CrProvider', {
177+
providerName: 'QuickSightSubscriptionProvider',
178+
onEventHandlerDefinition: {
179+
depsLockFilePath: __dirname+'/resources/QuickSightSubscription/package-lock.json',
180+
entryFile: __dirname+'/resources/QuickSightSubscription/index.mjs',
181+
handler: 'index.onEventHandler',
182+
environment: {
183+
AUTHENTICATION_METHOD: props.authenticationMethod,
184+
AWS_ACCOUNT_ID: props.awsAccountId,
185+
EDITION: props.edition,
186+
IDENTITY_REGION: props.identityRegion
187+
},
188+
iamRole: this.executionRole,
189+
timeout,
190+
},
191+
isCompleteHandlerDefinition: {
192+
iamRole: this.executionRole,
193+
handler: 'index.isCompleteHandler',
194+
depsLockFilePath: __dirname+'/resources/QuickSightSubscription/package-lock.json',
195+
entryFile: __dirname+'/resources/QuickSightSubscription/index.mjs',
196+
timeout,
197+
environment: {
198+
AUTHENTICATION_METHOD: props.authenticationMethod,
199+
AWS_ACCOUNT_ID: props.awsAccountId,
200+
EDITION: props.edition,
201+
IDENTITY_REGION: props.identityRegion
202+
},
203+
},
204+
queryInterval: Duration.seconds(1),
205+
removalPolicy: this.removalPolicy,
206+
});
207+
208+
this.serviceToken = provider.serviceToken;
209+
this.submitLogGroup = provider.onEventHandlerLogGroup;
210+
this.statusLogGroup = provider.isCompleteHandlerLog!;
211+
this.cleanUpLogGroup = provider.cleanUpLogGroup;
212+
this.submitFunction = provider.onEventHandlerFunction;
213+
this.statusFunction = provider.isCompleteHandlerFunction!;
214+
this.cleanUpFunction = provider.cleanUpFunction;
215+
this.cleanUpRole = provider.cleanUpRole;
216+
217+
}
218+
219+
220+
221+
public createQuickSightSubscription(){
222+
return new CustomResource(this, 'QuickSightSubscription', {
223+
resourceType: QuickSightSubscription.RESOURCE_TYPE,
224+
serviceToken: this.serviceToken,
225+
properties: {
226+
accountName: this.accountName,
227+
notificationEmail: this.notificationEmail,
228+
readerGroup: this.readerGroup,
229+
authorGroup: this.authorGroup,
230+
adminGroup: this.adminGroup
231+
},
232+
removalPolicy: this.removalPolicy
233+
});
234+
}
235+
}

0 commit comments

Comments
 (0)