fix(sns-subscriptions): cross opt-in region support

[nmussy]

Issue # (if applicable)

Closes #32526.

Reason for this change

Although SNS supports cross-region message delivery to SQS Queues and Lambda Functions, it requires replacing the service principal for opt-in regions, see Sending Amazon SNS messages to an Amazon SQS queue or AWS Lambda function in a different Region. Additionally, some cross-region configurations are also not supported, such as opt-in to opt-in cross region delivery.

Description of changes

• Add generateGrantPrincipal method to replace the previously static sns.amazonaws.com principal with a potentially opt-in region-dependent sns.<region>.amazonaws.com. Invalid cross region setups result in an exception.
  • Add abstract Subscription construct class to provide the method to both LambdaSubscription and SqsSubscription
• Add missing static type check methods for the affected subscriber resources:
  • lambda.Function.isFunction to determine whether or not the given resource is a generated or imported Function
  • sqs.Queue.isQueue to determine whether or not the given resource is a generated or imported Queue

Description of how you validated changes

Added unit and integ tests. The integ tests assertions had to be ran manually to allow for running AWS API calls across multiple regions.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.85%. Comparing base (bf026bd) to head (73c54af).
Report is 14 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #32542      +/-   ##
==========================================
+ Coverage   78.77%   78.85%   +0.07%     
==========================================
  Files         108      108              
  Lines        7163     7165       +2     
  Branches     1320     1319       -1     
==========================================
+ Hits         5643     5650       +7     
+ Misses       1335     1330       -5     
  Partials      185      185              

Flag	Coverage Δ
suite.unit	78.85% <ø> (+0.07%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	78.85% <ø> (+0.07%)	⬆️

[nmussy]

Subscription.subscriber ends up having the same value as the existing SqsSubscription.queue and LambdaSubscription.fn members, but with a broader typing.

I would have preferred to have a common protected property between all 3, and have the class implementations overload the abstract class's IResource, but jsii wouldn't allow it. The alternatives would be to convert generateGrantPrincipal into a static method, and pass both the topic and the subscriber as parameters. Neither feel particularly great, but I slightly prefer my current implementation

[nmussy]

Although all the SNS supported opt-in Regions are IS_OPT_IN_REGION, not all IS_OPT_IN_REGION are supported:

aws-cdk/packages/aws-cdk-lib/region-info/lib/aws-entities.ts

Lines 52 to 69 in bf026bd

	RULE_CLASSIC_PARTITION_BECOMES_OPT_IN,
	'ap-east-1', // Asia Pacific (Hong Kong)
	'me-south-1', // Middle East (Bahrain)
	'af-south-1', // Africa (Cape Town)
	'eu-south-1', // Europe (Milan)
	'us-iso-west-1', // US ISO West
	'ap-southeast-3', // Asia Pacific (Jakarta)
	'me-central-1', // Middle East (UAE)
	'eu-central-2', // Europe (Zurich)
	'eu-south-2', // Europe (Spain)
	'ap-south-2', // Asia Pacific (Hyderabad)
	'ap-southeast-4', // Asia Pacific (Melbourne)
	'il-central-1', // Israel (Tel Aviv)
	'ca-west-1', // Canada West (Calgary)
	'ap-southeast-5', // Asia Pacific (Malaysia)
	'ap-southeast-7', // Asia Pacific (Thailand)
	'mx-central-1', // Mexico (Central)
	'eu-isoe-west-1', // EU ISO-E West

I'm not sure if this is something the CDK should maintain or let users "just figure it out" when their SNS messages don't show up. A happy medium could be to store the list of regions known to be supported, and only warn the user that the opt-in region they are using might be unsupported, and to open an issue if that's incorrect

[nmussy]

Turns out the region list in SNS supported opt-in Regions is inaccurate, or at least not up to date. I was able to successfully run the integ tests in ca-west-1, which is an opt-in region not listed in the documentation table.

I'm going to assume that all opt-in regions are supported and this is just a case of stale documentation, but confirmation from the SNS team would be appreciated

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 73c54af
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository