Skip to content

Commit 904f727

Browse files
abhirpatabhirpat
authored
Merge pull request #70 from aws-solutions/release/v1.2.1
Release v1.2.1
2 parents 1c604a4 + eb008d2 commit 904f727

16 files changed

Lines changed: 871 additions & 857 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
66
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
77

8+
## [1.2.1] - 2026-06-22
9+
10+
### Security
11+
12+
- Update dependencies to mitigate [CVE-2026-11417](https://nvd.nist.gov/vuln/detail/CVE-2026-11417), [CVE-2026-33750](https://nvd.nist.gov/vuln/detail/CVE-2026-33750), [CVE-2026-34419](https://nvd.nist.gov/vuln/detail/CVE-2026-34419), [CVE-2026-37920](https://nvd.nist.gov/vuln/detail/CVE-2026-37920), [CVE-2026-48863](https://nvd.nist.gov/vuln/detail/CVE-2026-48863), [CVE-2026-48864](https://nvd.nist.gov/vuln/detail/CVE-2026-48864), [CVE-2026-42055](https://nvd.nist.gov/vuln/detail/CVE-2026-42055), [CVE-2026-42530](https://nvd.nist.gov/vuln/detail/CVE-2026-42530), [GHSA-537c-gmf6-5ccf](https://github.com/advisories/GHSA-537c-gmf6-5ccf), [GHSA-96hv-2xvq-fx4p](https://github.com/advisories/GHSA-96hv-2xvq-fx4p), [CVE-2026-49982](https://nvd.nist.gov/vuln/detail/CVE-2026-49982), [CVE-2026-12143](https://nvd.nist.gov/vuln/detail/CVE-2026-12143), [GHSA-x9g3-xrwr-cwfg](https://github.com/advisories/GHSA-x9g3-xrwr-cwfg), [GHSA-f886-m6hf-6m8v](https://github.com/advisories/GHSA-f886-m6hf-6m8v), [GHSA-r4q5-vmmm-2653](https://github.com/advisories/GHSA-r4q5-vmmm-2653), [GHSA-qx2v-qp2m-jg93](https://github.com/advisories/GHSA-qx2v-qp2m-jg93), [GHSA-q8mj-m7cp-5q26](https://github.com/advisories/GHSA-q8mj-m7cp-5q26), [GHSA-48c2-rrv3-qjmp](https://github.com/advisories/GHSA-48c2-rrv3-qjmp), [GHSA-gmq8-994r-jv83](https://github.com/advisories/GHSA-gmq8-994r-jv83), [GHSA-q7cg-457f-vx79](https://github.com/advisories/GHSA-q7cg-457f-vx79), [GHSA-4x5r-pxfx-6jf8](https://github.com/advisories/GHSA-4x5r-pxfx-6jf8), [GHSA-jxxr-4gwj-5jf2](https://github.com/advisories/GHSA-jxxr-4gwj-5jf2).
13+
814
## [1.2.0] - 2026-06-17
915

1016
### Added

‎solution-manifest.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
id: SO0310
22
name: deepracer-on-aws
3-
version: v1.2.0
3+
version: v1.2.1
44
cloudformation_templates:
55
- template: deepracer-on-aws.template
66
main_template: true

‎source/apps/infra/lib/constants/testMocks.ts‎

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,36 @@
22
// SPDX-License-Identifier: Apache-2.0
33

44
import { Duration, Stack, type CfnResource } from 'aws-cdk-lib';
5+
import { Key } from 'aws-cdk-lib/aws-kms';
56
import { Architecture, Code, Function, Runtime, Tracing } from 'aws-cdk-lib/aws-lambda';
6-
import type { LogGroup } from 'aws-cdk-lib/aws-logs';
7+
import { LogGroup } from 'aws-cdk-lib/aws-logs';
78
import type { Construct } from 'constructs';
89

910
import type { NodeLambdaFunctionProps } from '../constructs/common/nodeLambdaFunction.js';
1011

12+
/**
13+
* Creates a mock factory for KmsHelper that returns a proper IKey from CDK.
14+
* CDK 2.246+ validates encryptionKey implements IKey interface via prop-injectable.
15+
*
16+
* Usage in test files:
17+
* ```ts
18+
* vi.mock('../../common/kmsHelper.js', () => createKmsHelperMock());
19+
* ```
20+
*/
21+
export function createKmsHelperMock() {
22+
return {
23+
KmsHelper: {
24+
get: vi.fn((scope: Construct) => {
25+
return Key.fromKeyArn(
26+
Stack.of(scope),
27+
`MockKey-${Math.random().toString(36).slice(2)}`,
28+
'arn:aws:kms:us-east-1:123456789012:key/mock-key-id',
29+
);
30+
}),
31+
},
32+
};
33+
}
34+
1135
/**
1236
* Creates a mock factory for LogGroupsHelper that returns stub log group objects.
1337
* Prevents static log group state from leaking between test stacks.
@@ -26,10 +50,13 @@ export async function createLogGroupsHelperMock() {
2650
LogGroupsHelper: {
2751
...actual.LogGroupsHelper,
2852
getAllLogGroups: () => [],
29-
getOrCreateLogGroup: vi.fn().mockImplementation((_scope: unknown, id: string) => ({
30-
logGroupName: `mocked-log-group-${id}`,
31-
logGroupArn: `arn:aws:logs:us-east-1:123456789012:log-group:mocked-log-group-${id}`,
32-
})),
53+
getOrCreateLogGroup: vi.fn().mockImplementation((scope: Construct, id: string) => {
54+
return LogGroup.fromLogGroupArn(
55+
Stack.of(scope),
56+
`MockLogGroup-${id}-${Math.random().toString(36).slice(2)}`,
57+
`arn:aws:logs:us-east-1:123456789012:log-group:mocked-log-group-${id}`,
58+
);
59+
}),
3360
},
3461
};
3562
}

‎source/apps/infra/lib/constructs/auth/__tests__/__snapshots__/userRolePolicies.spec.ts.snap‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2144,6 +2144,9 @@ exports[`UserRolePolicies > should match snapshot 1`] = `
21442144
"UpdateReplacePolicy": "Retain",
21452145
},
21462146
"TestApiDeployment8541C0A042dbeed27fbe0b08f86e6a9f3a07881f": {
2147+
"Metadata": {
2148+
"aws:cdk:do-not-refactor": true,
2149+
},
21472150
"Properties": {
21482151
"Description": "Automatically created by the RestApi construct",
21492152
"RestApiId": {

‎source/apps/infra/lib/constructs/auth/__tests__/userIdentity.spec.ts‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -227,8 +227,6 @@ describe('UserIdentity', () => {
227227
Match.objectLike({
228228
Action: Match.arrayWith([
229229
'dynamodb:BatchGetItem',
230-
'dynamodb:GetRecords',
231-
'dynamodb:GetShardIterator',
232230
'dynamodb:Query',
233231
'dynamodb:GetItem',
234232
'dynamodb:Scan',
@@ -242,6 +240,11 @@ describe('UserIdentity', () => {
242240
Effect: 'Allow',
243241
Resource: Match.anyValue(),
244242
}),
243+
Match.objectLike({
244+
Action: Match.arrayWith(['dynamodb:GetRecords', 'dynamodb:GetShardIterator']),
245+
Effect: 'Allow',
246+
Resource: Match.anyValue(),
247+
}),
245248
]),
246249
},
247250
}),

‎source/apps/infra/lib/constructs/ecr-image-downloader/__tests__/ecrImageDownloaderWithTrigger.spec.ts‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,18 @@ import { ComputeType } from 'aws-cdk-lib/aws-codebuild';
77
import { Repository } from 'aws-cdk-lib/aws-ecr';
88

99
import { TEST_NAMESPACE } from '../../../constants/testConstants.js';
10-
import { createNodeLambdaFunctionMock, createLogGroupsHelperMock } from '../../../constants/testMocks.js';
10+
import {
11+
createNodeLambdaFunctionMock,
12+
createLogGroupsHelperMock,
13+
createKmsHelperMock,
14+
} from '../../../constants/testMocks.js';
1115
import { EcrImageDownloaderWithTrigger, ImageRepositoryMapping } from '../ecrImageDownloaderWithTrigger.js';
1216

1317
// Mock NodeLambdaFunction to use inline code instead of esbuild bundling.
1418
vi.mock('../../common/nodeLambdaFunction.js', () => createNodeLambdaFunctionMock());
1519

1620
// Mock the KmsHelper to avoid having the single key shared between stacks
17-
vi.mock('../../common/kmsHelper.js', () => {
18-
return {
19-
KmsHelper: {
20-
get: vi.fn(() => {
21-
return {
22-
grantEncryptDecrypt: vi.fn(),
23-
keyId: 'mock-key-id',
24-
keyArn: 'arn:aws:kms:us-east-1:123456789012:key/mock-key-id',
25-
};
26-
}),
27-
},
28-
};
29-
});
21+
vi.mock('../../common/kmsHelper.js', () => createKmsHelperMock());
3022

3123
// Mock the LogGroupsHelper to avoid having the static log groups shared between stacks
3224
vi.mock('#constructs/common/logGroupsHelper.js', () => createLogGroupsHelperMock());

‎source/apps/infra/lib/constructs/ecr-image-downloader/ecrImageDownloaderWithTrigger.ts‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import { ManagedPolicy, Policy, PolicyDocument, PolicyStatement, Role, ServicePr
1010
import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
1111
import { Asset } from 'aws-cdk-lib/aws-s3-assets';
1212
import { Provider } from 'aws-cdk-lib/custom-resources';
13-
import { Construct, IConstruct } from 'constructs';
13+
import { Construct } from 'constructs';
1414

1515
import { extractEcrLoginMap, generateEcrLoginCommands } from './helpers.js';
1616
import { addCfnGuardSuppression, addCfnGuardSuppressionForAutoCreatedLambdas } from '../common/cfnGuardHelper.js';
@@ -343,11 +343,5 @@ export class EcrImageDownloaderWithTrigger extends Construct {
343343

344344
// Ensure the custom resource depends on the CodeBuild project
345345
this.autoTriggerResource.node.addDependency(this.codeBuildProject);
346-
347-
// Suppress CFN Guard rule for internal waiter state machine log group - created by CDK Provider construct
348-
// We need to find the log group in the Provider's child constructs
349-
const waiterStateMachine = this.customResourceProvider.node.findChild('waiter-state-machine');
350-
const waiterLogGroup = waiterStateMachine.node.tryFindChild('LogGroup');
351-
addCfnGuardSuppression(waiterLogGroup as IConstruct, ['CLOUDWATCH_LOG_GROUP_ENCRYPTED']);
352346
}
353347
}

‎source/apps/infra/lib/constructs/live-race-workflow/__tests__/liveRaceWorkflow.spec.ts‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,22 +8,18 @@ import { Bucket } from 'aws-cdk-lib/aws-s3';
88
import { describe, expect, it } from 'vitest';
99

1010
import { TEST_NAMESPACE } from '../../../constants/testConstants.js';
11-
import { createNodeLambdaFunctionMock, createLogGroupsHelperMock } from '../../../constants/testMocks.js';
11+
import {
12+
createNodeLambdaFunctionMock,
13+
createLogGroupsHelperMock,
14+
createKmsHelperMock,
15+
} from '../../../constants/testMocks.js';
1216
import { NodeLambdaFunction } from '../../common/nodeLambdaFunction.js';
1317
import { LiveRaceWorkflow } from '../liveRaceWorkflow.js';
1418

1519
// Mock NodeLambdaFunction to use inline code instead of esbuild bundling.
1620
vi.mock('../../common/nodeLambdaFunction.js', () => createNodeLambdaFunctionMock());
1721

18-
vi.mock('#constructs/common/kmsHelper.js', () => ({
19-
KmsHelper: {
20-
get: vi.fn(() => ({
21-
grantEncryptDecrypt: vi.fn(),
22-
keyId: 'mock-key-id',
23-
keyArn: 'arn:aws:kms:us-east-1:123456789012:key/mock-key-id',
24-
})),
25-
},
26-
}));
22+
vi.mock('#constructs/common/kmsHelper.js', () => createKmsHelperMock());
2723

2824
// Mock the LogGroupsHelper to avoid having the static log groups shared between stacks
2925
vi.mock('#constructs/common/logGroupsHelper.js', () => createLogGroupsHelperMock());

‎source/apps/infra/lib/constructs/live-race/liveRaceEvents.ts‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ import { EventSourceMapping, FilterCriteria, FilterRule, StartingPosition } from
1212
import { SqsDlq } from 'aws-cdk-lib/aws-lambda-event-sources';
1313
import { Queue, QueueEncryption } from 'aws-cdk-lib/aws-sqs';
1414
import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId, Provider } from 'aws-cdk-lib/custom-resources';
15-
import { Construct, IConstruct } from 'constructs';
15+
import { Construct } from 'constructs';
1616

1717
import { iotTopicPrefix } from '../../constants/iotTopics.js';
18-
import { addCfnGuardSuppression, addCfnGuardSuppressionForAutoCreatedLambdas } from '../common/cfnGuardHelper.js';
18+
import { addCfnGuardSuppressionForAutoCreatedLambdas } from '../common/cfnGuardHelper.js';
1919
import { LogGroupCategory } from '../common/logGroupsHelper.js';
2020
import { NodeLambdaFunction } from '../common/nodeLambdaFunction.js';
2121

@@ -120,10 +120,6 @@ export class LiveRaceEvents extends Construct {
120120
properties: { policyName },
121121
});
122122
addCfnGuardSuppressionForAutoCreatedLambdas(this, deleteIoTPolicyProviderName);
123-
const waiterStateMachine = deletePolicyProvider.node.findChild('waiter-state-machine');
124-
addCfnGuardSuppression(waiterStateMachine.node.tryFindChild('LogGroup') as IConstruct, [
125-
'CLOUDWATCH_LOG_GROUP_ENCRYPTED',
126-
]);
127123

128124
// AwsCustomResource to retrieve the IoT ATS endpoint at deploy time.
129125
// IoT ATS endpoints are account-scoped and never change, so no onUpdate needed.

‎source/apps/infra/lib/constructs/scheduled/__tests__/monthlyQuotaReset.spec.ts‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,6 @@ describe('MonthlyQuotaReset', () => {
109109
Match.objectLike({
110110
Action: Match.arrayWith([
111111
'dynamodb:BatchGetItem',
112-
'dynamodb:GetRecords',
113-
'dynamodb:GetShardIterator',
114112
'dynamodb:Query',
115113
'dynamodb:GetItem',
116114
'dynamodb:Scan',
@@ -124,6 +122,11 @@ describe('MonthlyQuotaReset', () => {
124122
Effect: 'Allow',
125123
Resource: Match.anyValue(),
126124
}),
125+
Match.objectLike({
126+
Action: Match.arrayWith(['dynamodb:GetRecords', 'dynamodb:GetShardIterator']),
127+
Effect: 'Allow',
128+
Resource: Match.anyValue(),
129+
}),
127130
]),
128131
Version: '2012-10-17',
129132
},

0 commit comments

Comments
 (0)