Update to version v1.0.7

.github/ISSUE_TEMPLATE/bug_report.md

@@ -17,7 +17,7 @@ Steps to reproduce the behavior.
 A clear and concise description of what you expected to happen.
 
 **Please complete the following information about the solution:**
-- [ ] Version: [e.g. v1.0.6]
+- [ ] Version: [e.g. v1.0.7]
 
 To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "_(SO0021) - Video On Demand workflow with AWS Step Functions, MediaConvert, MediaPackage, S3, CloudFront and DynamoDB. Version **v5.0.0**_". If the description does not contain the version information, you can look at the mappings section of the template:
 

CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.7] - 2024-05-22
+
+### Security
+
+- Upgrade Druid to v33.0.0
+- Upgrade Zookeeper to v3.9.3
+- Patched aws-cdk libraries
+- Upgrade user data scripts to use python 3.12
+- Upgrade Druid-Operator version to v1.3.0
+
 ## [1.0.6] - 2024-04-02
 
 ### Security

NOTICE.txt

@@ -840,4 +840,4 @@ PSF-2.0 - https://opensource.org/license/python-2-0
 Python-2.0 - https://opensource.org/license/python-2-0
 Public Domain - None
 Unicode/ICU License - https://raw.githubusercontent.com/unicode-org/icu/main/icu4c/LICENSE
-Unlicense - https://opensource.org/licenses/Unlicense
+Unlicense - https://opensource.org/licenses/Unlicense

README.md

@@ -302,7 +302,7 @@ It is important to note that the redirect URI on the IDP side should be configur
 -   **Druid version**: Apache Druid release version (eg. 27.0.0) that you want to run. It is recommended to use the latest stable [Druid version](#https://druid.apache.org/downloads.html).
 
     ```
-    "druidVersion": "31.0.0",
+    "druidVersion": "33.0.0",
     ```
 
 -   **Druid cluster name**: A sequence of ASCII characters that uniquely identifies each Druid cluster. If there are multiple deployments, please make sure that you have an unique cluster name for each cluster. The cluster name will be appended to the CloudFormation stack name.

deployment/build-s3-dist.sh

@@ -21,7 +21,7 @@
 # Parameters:
 #  - source-bucket-base-name: Name for the S3 bucket location where the template will source the Lambda
 #    code from. The template will append '-[region_name]' to this bucket name.
-#    For example: ./build-s3-dist.sh solutions v1.0.6
+#    For example: ./build-s3-dist.sh solutions v1.0.7
 #    The template will then expect the source code to be located in the solutions-[region_name] bucket
 #  - solution-name: name of the solution for consistency
 #  - version-code: version of the package
@@ -58,7 +58,7 @@ usage()
 {
     echo "Usage: $0 bucket solution-name version"
     echo "Please provide the base source bucket name, trademarked solution name, and version." 
-    echo "For example: ./build-s3-dist.sh mybucket my-solution v1.0.6" 
+    echo "For example: ./build-s3-dist.sh mybucket my-solution v1.0.7" 
     exit 1 
 }
 

source/DruidCloudwatchExtension/pom.xml

@@ -6,10 +6,10 @@
     <groupId>com.amazon.solutions.druid.extensions</groupId>
     <artifactId>druid-cloudwatch</artifactId>
     <description>druid-cloudwatch</description>
-    <version>25.0.0</version>
+    <version>33.0.0</version>
 
     <properties>
-        <druid.version>25.0.0</druid.version>
+        <druid.version>33.0.0</druid.version>
         <maven.compiler.source>17</maven.compiler.source>
         <maven.compiler.target>17</maven.compiler.target>
         <jdk.version>17</jdk.version>
@@ -19,9 +19,23 @@
         <!-- https://mvnrepository.com/artifact/org.apache.druid/druid-core -->
         <dependency>
             <groupId>org.apache.druid</groupId>
-            <artifactId>druid-core</artifactId>
+            <artifactId>druid-processing</artifactId>
             <version>${druid.version}</version>
             <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>commons-beanutils</groupId>
+                    <artifactId>commons-beanutils</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>net.minidev</groupId>
+                    <artifactId>json-smart</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.projectlombok</groupId>
@@ -163,4 +177,4 @@
             </plugin>
         </plugins>
     </build>
-</project>
+</project>

source/DruidCloudwatchExtension/src/main/java/com/amazon/solutions/druid/cloudwatch/CloudwatchEmitterConfig.java

@@ -13,7 +13,7 @@
 @Data
 public class CloudwatchEmitterConfig {
     static final int CLOUDWATCH_METRICS_MEMORY_LIMIT = 100000000;
-    static final String SOLUTION_VERSION = "v1.0.6";
+    static final String SOLUTION_VERSION = "v1.0.7";
 
     @JsonProperty("batchSize")
     @Nullable
@@ -48,4 +48,4 @@ public String toString() {
 
         return sb.toString();
     }
-}
+}

source/DruidCloudwatchExtension/src/test/java/com/amazon/solutions/druid/cloudwatch/CloudwatchEmitterConfigTest.java

@@ -5,7 +5,6 @@
 package com.amazon.solutions.druid.cloudwatch;
 
 import org.junit.Test;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import static org.junit.Assert.assertEquals;
 import org.junit.Assert;
 
@@ -46,16 +45,16 @@ public void testGetBatchSize_withDefaultBatchSize() {
     @Test
     public void testToString_withValidConfig() {
         // arrange
-        CloudwatchEmitterConfig config = new CloudwatchEmitterConfig("test-cluster", 200, "v1.0.6");
+        CloudwatchEmitterConfig config = new CloudwatchEmitterConfig("test-cluster", 200, "v1.0.7");
 
         // act
         String actual = config.toString();
 
         // assert
         Assert.assertTrue(actual.contains("test-cluster"));
         Assert.assertTrue(actual.contains("200"));
-        Assert.assertTrue(actual.contains("v1.0.6"));
+        Assert.assertTrue(actual.contains("v1.0.7"));
         Assert.assertTrue(actual.contains("CloudwatchEmitterConfig"));
     }
 
-}
+}

source/DruidCloudwatchExtension/src/test/java/com/amazon/solutions/druid/cloudwatch/CloudwatchEmitterTest.java

@@ -188,7 +188,7 @@ public void testEmit_withServiceMetricEvent() throws JsonProcessingException {
         ServiceMetricEvent metricEvent = metricEventBuilder
                 .setDimension("key1", "value1")
                 .setDimension("key2", "value2")
-                .build("task/success/count",  1)
+                .setMetric("task/success/count", 1)
                 .build("some-service", "some-task");
         when(druidMonitoringMetricsFactory.createCloudwatchMetric(any(AlertEvent.class)))
                 .thenReturn(new MetricDatum().withMetricName("Druid-Alert"));

source/DruidCloudwatchExtension/src/test/java/com/amazon/solutions/druid/cloudwatch/DruidMonitoringMetricsFactoryTest.java

@@ -83,7 +83,8 @@ public void testCreateCloudwatchMetric_withServiceMetricEvent() {
         ServiceMetricEvent metricEvent = metricEventBuilder
                 .setDimension("key1", "value1")
                 .setDimension("key2", "value2")
-                .build(metricCreateTime, "task/success/count",  1)
+                .setMetric("task/success/count", 1)
+                .setCreatedTime(metricCreateTime)
                 .build("some-service", "some-task");
 
         // Act

source/DruidOidcExtension/pom.xml

@@ -26,7 +26,7 @@
     <artifactId>druid-oidc</artifactId>
     <name>druid-oidc</name>
     <description>druid-oidc</description>
-    <version>29.0.1</version>
+    <version>33.0.0</version>
 
     <properties>
         <pac4j.version>4.5.7</pac4j.version>
@@ -38,14 +38,41 @@
         <maven.compiler.source>17</maven.compiler.source>
         <maven.compiler.target>17</maven.compiler.target>
         <jdk.version>17</jdk.version>
+        <json.smart.version>2.5.2</json.smart.version>
+        <commons.beanutils.version>1.9.4</commons.beanutils.version>
     </properties>
 
+    <dependencyManagement>
+        <dependencies>
+            <!-- Override json smart version to fix CVE-2023-1370 -->
+            <dependency>
+                <groupId>net.minidev</groupId>
+                <artifactId>json-smart</artifactId>
+                <version>${json.smart.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <dependencies>
         <dependency>
             <groupId>org.apache.druid</groupId>
             <artifactId>druid-server</artifactId>
-            <version>31.0.0</version>
+            <version>33.0.0</version>
             <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.derby</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.eclipse.jetty</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>joda-time</groupId>
@@ -56,7 +83,23 @@
         <dependency>
             <groupId>org.apache.druid</groupId>
             <artifactId>druid-processing</artifactId>
-            <version>31.0.0</version>
+            <version>33.0.0</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>commons-beanutils</groupId>
+                    <artifactId>commons-beanutils</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>commons-beanutils</groupId>
+            <artifactId>commons-beanutils</artifactId>
+            <version>${commons.beanutils.version}</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
@@ -141,17 +184,22 @@
             <scope>test</scope>
             <version>5.4.0</version>
         </dependency>
+        <dependency>
+            <groupId>net.minidev</groupId>
+            <artifactId>json-smart</artifactId>
+            <version>${json.smart.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>
             <artifactId>mockwebserver</artifactId>
             <version>4.12.0</version>
             <scope>test</scope>
-        </dependency>
-        <!-- https://mvnrepository.com/artifact/net.minidev/json-smart -->
-        <dependency>
-            <groupId>net.minidev</groupId>
-            <artifactId>json-smart</artifactId>
-            <version>2.5.2</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>net.minidev</groupId>
+                    <artifactId>json-smart</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
     </dependencies>
 

source/bin/druid-infra.ts

@@ -26,7 +26,7 @@ import { CfnGuardResourcePathRulesSuppressionAspect } from '../lib/constructs/cf
 
 const solutionId = 'SO0262';
 const solutionName = 'Scalable Analytics using Apache Druid on AWS';
-const solutionVersion = 'v1.0.6';
+const solutionVersion = 'v1.0.7';
 
 const fipsEnabledRegions = [
     'us-east-1',

source/build-dependencies.sh

@@ -3,9 +3,9 @@ set -e
 cdk_context="$(npm run -s cdk context -- -j)"
 
 druid_version=$(echo "$cdk_context" | grep "druidVersion" | awk '/druidVersion/{print $NF}' | tr -d '"' | tr -d ',')
-druid_version=${druid_version:-31.0.0}
+druid_version=${druid_version:-33.0.0}
 
-druid_operator_version="v1.2.3"
+druid_operator_version="v1.3.0"
 druid_operator_repo="https://github.com/datainfrahq/druid-operator"
 
 do_cmd() 
@@ -38,7 +38,7 @@ build_druid_cloudwatch()
        mvn clean verify package && \
        rm -rf ../lib/docker/extensions/druid-cloudwatch/ && \
        mkdir -p ../lib/docker/extensions/druid-cloudwatch/ && \
-       cp -f target/druid-cloudwatch-25.0.0-jar-with-dependencies.jar ../lib/docker/extensions/druid-cloudwatch/ && cd ..
+       cp -f target/druid-cloudwatch-33.0.0-jar-with-dependencies.jar ../lib/docker/extensions/druid-cloudwatch/ && cd ..
 }
 
 build_druid_oidc()
@@ -48,7 +48,7 @@ build_druid_oidc()
        mvn clean verify package && \
        rm -rf ../lib/docker/extensions/druid-oidc/ && \
        mkdir -p ../lib/docker/extensions/druid-oidc/ && \
-       cp -f target/druid-oidc-29.0.1-jar-with-dependencies.jar ../lib/docker/extensions/druid-oidc/
+       cp -f target/druid-oidc-33.0.0-jar-with-dependencies.jar ../lib/docker/extensions/druid-oidc/
 }
 
 download_druid_operator()
@@ -108,7 +108,7 @@ download_druid()
 download_zookeeper() 
 {
     local zookeeper_version=$(echo "$cdk_context"  | grep "zookeeperVersion" | awk '/zookeeperVersion/{print $NF}' | tr -d '"' | tr -d ',')
-    zookeeper_version=${zookeeper_version:-3.8.4}
+    zookeeper_version=${zookeeper_version:-3.9.3}
     download_url="https://archive.apache.org/dist/zookeeper/zookeeper-${zookeeper_version}/apache-zookeeper-${zookeeper_version}-bin.tar.gz"
     alt_url="https://dlcdn.apache.org/zookeeper/zookeeper-${zookeeper_version}/apache-zookeeper-${zookeeper_version}-bin.tar.gz"
     download_and_verify_file "$zookeeper_version" "$download_url" "$alt_url" "./zookeeper-bin" "apache-zookeeper"

source/lib/config/user_data/common_user_data

@@ -31,12 +31,12 @@ if [[ ! -z $YUM_CMD ]]; then
     RETRIES=0
     while [ "$STEP_SUCCESS" == false ] && [ $RETRIES -lt 5 ]; do
         RETRIES=$((RETRIES+1))
-        sudo yum install -y python3.11 python3.11-pip
+        sudo yum install -y python3.12 python3.12-pip
         if [ $? -eq 0 ]; then
             STEP_SUCCESS=true
         fi
     done
-    PYTHON=python3.11
+    PYTHON=python3.12
 elif [[ ! -z $APT_CMD ]]; then
     echo " >>druid>> installing apt-get dependencies $(date)"
     apt-get update

source/lib/config/user_data/zookeeper_user_data

@@ -29,12 +29,12 @@ if [[ ! -z $YUM_CMD ]]; then
     RETRIES=0
     while [ "$STEP_SUCCESS" == false ] && [ $RETRIES -lt 5 ]; do
         RETRIES=$((RETRIES+1))
-        sudo yum install -y python3.11 python3.11-pip
+        sudo yum install -y python3.12 python3.12-pip
         if [ $? -eq 0 ]; then
             STEP_SUCCESS=true
         fi
     done
-    PYTHON=python3.11
+    PYTHON=python3.12
 
 elif [[ ! -z $APT_CMD ]]; then
     echo " >>zookeeper>> installing apt-get dependencies $(date)"

source/lib/constructs/configScheme.ts

@@ -94,7 +94,7 @@ export const configScheme = {
             title: 'Druid Version',
             $id: '#/properties/druidVersion',
             description: 'Version of Druid to use.',
-            examples: ['30.0.0', '31.0.0'],
+            examples: ['30.0.0', '33.0.0'],
         },
         druidExtensions: {
             type: 'array',

source/lib/docker/Dockerfile

@@ -1,4 +1,4 @@
-ARG imageTag=24.0.0
+ARG imageTag=33.0.0
 FROM apache/druid:${imageTag}
 COPY extensions/ /opt/druid/extensions/
 COPY ca-certs/ /opt/druid/ca-certs/

source/lib/utils/constants.ts

@@ -57,9 +57,9 @@ export const DEEP_STORAGE_PREFIX = 'druid/segments';
 
 export const DEFAULT_TIER = '_default_tier';
 
-export const ZOOKEEPER_DEFAULT_VERSION = '3.8.4';
+export const ZOOKEEPER_DEFAULT_VERSION = '3.9.3';
 
-export const DRUID_DEFAULT_VERSION = '31.0.0';
+export const DRUID_DEFAULT_VERSION = '33.0.0';
 
 export const DEFAULT_POSTGRES_PORT = 5432;