The Niche of CDK Grant オブジェクトって何者？/the-niche-of-cdk-what-isgrant-object

AWS CDK Conference Japan 2025 での登壇資料のフルバージョンです。
https://jawsug-cdk.connpass.com/event/356357/

スライド中に登場するコードに関するリンクは以下から参照ください。

(1) aws/aws-cdk pr#34138
https://github.com/aws/aws-cdk/pull/34138

(2) Grant オブジェクトを使った、自作 grant メソッドの実装例
(CDK) 自作 Construct に複合的な
パーミッション付与を行う
独自の grant メソッドを実装してみる
https://gist.github.com/hassaku63/79da57b244b3fddb48b416993376ce6c

Transcript

1. The Niche of CDK Grant ΦϒδΣΫτͬͯԿऀʁ 2025/07/11 @hassaku_63 AWS CDK Conference Japan 2025 presented by JAWS-UG
2. ݁࿦ Grant ΦϒδΣΫτͱ͸ʁ • grantXXX ϝιουʹڞ௨͢Δ໭Γ஋ͷܕʢҰ෦ྫ֎͋ΓʣͰ͋Γɺ಺෦࣮૷Ͱ࢖ΘΕ͍ͯΔܕ • ʮڐՄΛग़͢ओମʯʮڐՄΛड͚औΔ۩৅ʯ͔Βಠཱͨ͠ʮ෇༩͢Δݖݶʯͷ֓೦Λநग़ͨ͠΋ͷ • ݖݶ෇༩ͷ۩৅͕ΞΠσϯςΟςΟϕʔεͰ͋Δ͔ʗϦιʔεϕʔεͰ͋Δ͔ɹ͔Β΋ಠཱͨ֓͠೦ʢର֎తʹ͸ʣ (ex. ಛఆͷ Service Role ΁ͷݖݶ෇༩΍ɺS3 Public Access ͷઃఆ) ։ൃऀ͸ Grant ͷଘࡏΛҙࣝ͢Δඞཁ͕͋Δ͔ʁ • ௨ৗͷ IaC ςϯϓϨʔτ։ൃʹ͓͍ͯ͸ෆཁɻҙࣝతʹѻ͏΂͖ػձ͸ʢଟ෼ʣͳ͍ • ؔ࿈͢ΔΠϯλϑΣʔεͷ IGrantable ͷଘࡏ͚ͩย۱ʹஔ͍͓ͯ͘ͱΑ͍͔΋ • grantXXX ܥϝιουΛࣗ࡞͢Δ༻ࣄ͕͋Δਓ͸ɺ஌͓ͬͯ͘ͱศརʢ͔΋͠Εͳ͍ʣ
3. ࠓ೔஻Δ͜ͱ 1. grantXXX ϝιουͱɺGrant ΦϒδΣΫτ / IGrantable ΠϯλϑΣʔε 2. ͲΜͳ༻ࣄΛ࣋ͭਓ͕ɺGrant Λҙࣝ͢Δͱྑ͍ʁ 3. ࢖༻ྫ 1. aws/aws-cdk ͷ಺෦࣮૷ΑΓ 2.खݩͰಈ͔ͤΔίʔυͷ঺հ ʢ஫ʣͨͿΜɺօ͞Μͷ໌೔͔Βͷ࣮຿ʹ͸໾ཱͪ·ͤΜ
4. GrantXXX ϝιουͱɺ Grant / IGrantable
5. grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options);
6. grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); ϨγʔόΦϒδΣΫτ ʢओޠʣ
7. grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); ϨγʔόΦϒδΣΫτ ʢओޠʣ ϝιουʢಈࢺ + ໨తޠʣ
8. grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); ϨγʔόΦϒδΣΫτ ʢओޠʣ Ҿ਺ʢ໨తޠ2ʣ ϝιουʢಈࢺ + ໨తޠʣ
9. grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); ϨγʔόΦϒδΣΫτ ʢओޠʣ Ҿ਺ʢ໨తޠ2ʣ ϝιουʢಈࢺ + ໨తޠʣ → myConstruct grants XXX permission to target
10. grantXXX ϝιουͷΠϝʔδ myConstruct . grantXXX (target, options); ϨγʔόΦϒδΣΫτ ʢओޠʣ Ҿ਺ʢ໨తޠ2ʣ ϝιουʢಈࢺ + ໨తޠʣ → myConstruct grants XXX permission to target ڐՄ͞ΕΔଆ (grantee) ͷԿ͔͠ΒͰɺiam.IGrantable ΠϯλϑΣʔεͷ࣮૷Ϋϥεܕ ※యܕతͳͷ͸ IAM Role ΍ Service Role ͷඥ͚͕ͮՄೳͳ೚ҙͷϦιʔε
11. (ex.) S3 όέοτʹର͢Δ Read ݖݶͷ෇༩ class Bucket - public grantRead(identity: IGrantable, objectsKeyPattern?: any): Grant myBucket myFunction ͓લ (IGrantable) ʹ ࢲΛ Read ͢Δ ڐՄΛ΍Ζ͏ ʮڐՄ͞ΕΔʯଆͷԿ͔͠Β = IGrantable ͷ࣮૷Ϋϥε ※಺෦తʹ͸ɺFunction ʹඥͮ͘ϓϦϯγύϧͰ͋Δ IAM Role (policy) ΁ͷ permission ௥Ճ͕ߦΘΕΔ
12. grantXXX ϝιουͷ࣮૷Πϝʔδ ΞΠσϯςΟςΟϕʔεͳ ݖݶ෇༩ͷ৔߹
13. grantXXX ϝιουͷ࣮૷Πϝʔδ ΞΠσϯςΟςΟϕʔεͳ ݖݶ෇༩ͷ৔߹
14. Grant ΦϒδΣΫτͬͯʁ grantXXX ͷ໋໊نଇΛ࣋ͭϝιουͷ໭Γ஋
15. Grant ΦϒδΣΫτͬͯʁ grantXXX ͷ໋໊نଇΛ࣋ͭϝιουͷ໭Γ஋ Α͘ݟΔ΍ͭ ୈҰҾ਺ʢ෇༩͢Δ૬खʣ͸ IGrantable Λ࣮૷͢Δ೚ҙͷܕ
16. Grant ΦϒδΣΫτͬͯʁ grantXXX ͷ໋໊نଇΛ࣋ͭϝιουͷ໭Γ஋ Grant ΦϒδΣΫτ (???)
17. ͲΜͳ༻ࣄΛ࣋ͭਓ͕ɺ Grant Λҙࣝ͢Δͱྑ͍ʁ
18. Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε • CDK ίϯτϦϏϡʔλʔ • ෆಛఆ޲͚ͷڞ௨ϥΠϒϥϦ΍ Custom Construct Λ։ൃ͢Δਓ͕ɺ grantXXX ܥϝιουΛࣗ࡞͢Δ৔߹ʹҙࣝ͢Δ • ͋Δڞ༗Ϧιʔεʹର͢ΔݫີͳڐՄΛ෇༩͢Δํ๏Λఏڙ͍ͨ͠ • ڐՄΛ༩͑ΒΕΔଆ (grantee) ͷ۩৅ΛࣄલʹಛఆͰ͖ͳ͍
19. Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε User Workload (1) User Workload (2) User Workload (n) ɾ ɾ ɾ Shared Service (ex. Πϕϯτϩάج൫) write log ೚ҙͷϫʔΫϩʔυ ෆಛఆͷΞϓϦ։ൃऀ͕ɺෆಛఆͷΞϓϦΛ ߏங͠ɺShared Service ʹॻ͖ࠐΈ ෆಛఆͷΞϓϦ͔Βͷ ॻ͖ࠐΈΛड͚෇͚Δڞ༗αʔϏε ʢྫ͑͹ɺOrg ؀ڥԼʹ͓͚Δ Log Archive ΞΧ΢ϯτͷϩάόέοτʣ
20. Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε User Workload (1) User Workload (2) User Workload (n) ɾ ɾ ɾ Shared Service (ex. Πϕϯτϩάج൫) write log ೚ҙͷϫʔΫϩʔυ ෆಛఆͷΞϓϦ։ൃऀ͕ɺෆಛఆͷΞϓϦΛ ߏங͠ɺShared Service ʹॻ͖ࠐΈ ෆಛఆͷΞϓϦ͔Βͷ ॻ͖ࠐΈΛड͚෇͚Δڞ༗αʔϏε ʢྫ͑͹ɺOrg ؀ڥԼʹ͓͚Δ Log Archive ΞΧ΢ϯτͷϩάόέοτʣ Shared Service ଆͷ Construct ʹ grant ϝιουΛੜ΍ͯ͠ɺ ͦͷ಺෦࣮૷Ͱ Grant Λ࢖༻͢Δ
21. Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε User Workload (1) User Workload (2) User Workload (n) ɾ ɾ ɾ Shared Service (ex. Πϕϯτϩάج൫) write log ຖ౓ಉ͡ permission ෇༩ͷ࣮૷Λ࠶ੜ࢈ ΋ͬͱγϯϓϧʹɺڞ௨Խͯ͠ɺ ؒҧ͍͕ൃੜ͠ͳ͍Α͏ʹ͍ͨ͠
22. Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε User Workload (1) User Workload (2) User Workload (n) ɾ ɾ ɾ Shared Service (ex. Πϕϯτϩάج൫) write log ؀ڥ͝ͱͰΤϯυϙΠϯτ or ARN ͸ҟͳΔ͕ɺ ࣗ෼ࣗ਎ʹର͢Δ༻ࣄΛ࣋ͭΞϓϦ͕࣋ͭ΂͖ݖݶͷ ཁ݅͸ಉ͡ ϫʔΫϩʔυଆ͕ݖݶ෇༩ϩδοΫΛ౎౓࣮૷͢Δͷ͸ ඇޮ཰ͩ͠ɺ࣮૷ϛε͕ೖΓ͜Ή “Shared Service” Construct ʹର͢Δ “grant write” Λ ந৅Խͯ͠ɺϫʔΫϩʔυଆͰ࢖ͬͯ΋Β͏
23. Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε Workload Stack ʢ஫ʣࡶ࣮૷ͳͷͰ ͋͘·ͰΞΠσΞͷ঺հఔ౓Ͱ
24. Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε Workload Stack σϓϩΠ؀ڥʹԠͨ͡ ISharedService Λऔಘ ݱࡏͷ؀ڥʹରԠͨ͠ ॻ͖ࠐΈύʔϛογϣϯΛ෇༩
25. Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε Shared Service
26. Grant Λҙࣝͨ͠Βخ͍͠ʢ͔΋͠Εͳ͍ʣ έʔε Shared Service ͜͜Ͱ௥Ճ͢΂͖ Policy Statement ͕ ෳࡶʹͳΔ৔߹͸ɺ Grant ͷѻ͍ํΛ஌͍ͬͯΔͱศར ʢಛʹɺ͜ͷػೳͷςετ༰қੑ؍఺ʣ
27. ࢖༻ྫ
28. aws/aws-cdk-lib Bucket ͷجఈͰ͋Δ BucketBase Ϋϥεͷ “grantReplicationPermission” ϝιου S3 ͷϨϓϦέʔγϣϯߏ੒ʹ͓͍ͯɺϨϓϦέʔγϣϯͷ࣮ߦ࣌ʹ S3 ͕࢖༻͢Δ Service Role ʹରͯ͠ɺ ϨϓϦέʔγϣϯͷ࣮ߦʹඞཁͳݖݶΛ෇༩͢Δ΋ͷʢ࣮ଶͱͯ͠ඞཁͳݖݶ͕৭ʑ͋Δʣ ref: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html#grantwbrreplicationwbrpermissionidentity-props class BucketBase { public grantReplicationPermission( identity: IGrantable, props: GrantReplicationPermissionProps ): Grant { … } }
29. aws/aws-cdk-lib PR #34138 (closes: #34119) Bucket ͷجఈͰ͋Δ BucketBase Ϋϥεͷ “grantReplicationPermission” ϝιου S3 ͷϨϓϦέʔγϣϯߏ੒ʹ͓͍ͯɺϨϓϦέʔγϣϯͷ࣮ߦ࣌ʹ S3 ͕࢖༻͢Δ Service Role ʹରͯ͠ɺ ϨϓϦέʔγϣϯͷ࣮ߦʹඞཁͳݖݶΛ෇༩͢Δ΋ͷʢ࣮ଶͱͯ͠ඞཁͳݖݶ͕৭ʑ͋Δʣ
30. aws/aws-cdk-lib packages/aws-cdk-lib/aws-s3/test/bucket.test.ts ςετέʔε “grant permissions to custom replication role” ΑΓ
32. ϓϦϯγύϧ “replicationRole” ʹର͢Δ ݖݶ෇༩ϩδοΫ͕ɺ ҙਤ௨Γͷ݁Ռʹͳͬͨ͜ͱͷݕূ
33. Example code (Gist) https://gist.github.com/hassaku63/79da57b244b3fddb48b416993376ce6c (CDK) ࣗ࡞ Construct ʹෳ߹తͳ ύʔϛογϣϯ෇༩Λߦ͏ ಠࣗͷ grant ϝιουΛ࣮૷ͯ͠ΈΔ
34. Example code (Gist) https://gist.github.com/hassaku63/79da57b244b3fddb48b416993376ce6c (CDK) ࣗ࡞ Construct ʹෳ߹తͳ ύʔϛογϣϯ෇༩Λߦ͏ ಠࣗͷ grant ϝιουΛ࣮૷ͯ͠ΈΔ
35. Point • ෳ߹తͳɺ͋Δ͍͸ݫີͳݖݶ෇༩Λ͍ͨ͠৔߹ʹ͸ grantXXX ܥϝιουΛࣗ࡞͢Δཧ༝͕͋Δ • ࣗ࡞ grantXXX ϝιουͷ಺෦Ͱ Grant.combine Λར༻ͯ͠ɺ ʮgrantXXX ʹΑΔݖݶͷ෇༩݁ՌʯΛ1ݸͷ Grant ΦϒδΣΫτʹ·ͱΊͯฦ͢ • grantXXX ϝιουͷ୯ମςετ͸ɺ໭Γ஋ͷ Grant Λௐ΂Ε͹ OK ʢ௨ৗͷ Stack/Construct ੜ੒͔Βͷ Template ϚονͰ΋OKʣ
36. Speaker hassaku63 (Takuya Hashimoto) repeat-contributor of aws/aws-cdk hassaku_63 hassaku63