@gradientedge/cdk-utils-azure 2.48.0 → 2.49.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -24,7 +24,7 @@ import { AzureEventHandlerProps, EventHandlerEventGridSubscription, EventHandler
|
|
|
24
24
|
* ## Authorization and the `EVENT_INGEST_SERVICE_BUS` connection string
|
|
25
25
|
*
|
|
26
26
|
* When the construct owns the queue (`queue.useExisting=false`), it provisions a per-queue
|
|
27
|
-
* authorization rule named
|
|
27
|
+
* authorization rule named `listen-send` (scoped to the queue) with `Listen + Send` rights, and the function app's
|
|
28
28
|
* `EVENT_INGEST_SERVICE_BUS` connection string is sourced from that rule. This avoids granting the
|
|
29
29
|
* function app access to sibling queues when the namespace is shared.
|
|
30
30
|
*
|
|
@@ -25,7 +25,7 @@ import { AzureFunctionApp } from '../function-app/index.js';
|
|
|
25
25
|
* ## Authorization and the `EVENT_INGEST_SERVICE_BUS` connection string
|
|
26
26
|
*
|
|
27
27
|
* When the construct owns the queue (`queue.useExisting=false`), it provisions a per-queue
|
|
28
|
-
* authorization rule named
|
|
28
|
+
* authorization rule named `listen-send` (scoped to the queue) with `Listen + Send` rights, and the function app's
|
|
29
29
|
* `EVENT_INGEST_SERVICE_BUS` connection string is sourced from that rule. This avoids granting the
|
|
30
30
|
* function app access to sibling queues when the namespace is shared.
|
|
31
31
|
*
|
|
@@ -231,8 +231,11 @@ export class AzureEventHandler extends AzureFunctionApp {
|
|
|
231
231
|
const namespaceResourceGroupName = useExistingFlags.namespace
|
|
232
232
|
? (this.props.serviceBus?.namespace?.resourceGroupName ?? this.resourceGroup.name)
|
|
233
233
|
: this.resourceGroup.name;
|
|
234
|
+
// Azure caps `authorizationRuleName` at 50 chars. The rule's scope is the queue itself
|
|
235
|
+
// (`…/namespaces/<ns>/queues/<queue>/authorizationRules/<rule>`), so a literal name is
|
|
236
|
+
// unambiguous and avoids hitting the cap on long stack ids.
|
|
234
237
|
this.serviceBus.queueAuthorizationRule = this.serviceBusManager.createServiceBusQueueAuthorizationRule(this.id, this, {
|
|
235
|
-
authorizationRuleName:
|
|
238
|
+
authorizationRuleName: 'listen-send',
|
|
236
239
|
namespaceName: this.serviceBus.namespace.name,
|
|
237
240
|
queueName: this.serviceBus.queue.name,
|
|
238
241
|
resourceGroupName: namespaceResourceGroupName,
|