Describe the bug
Hello team,
We encountered an issue when create role that trust ElasticSearch ServicePrincipal in CN regions:
this.serviceRole = new Role(this, 'EMRServiceRole', {
roleName: '...',
assumedBy: (region === 'cn-north-1' || region === 'cn-northwest-1') ?
new ServicePrincipal('elasticmapreduce.amazonaws.com.cn') :
new ServicePrincipal('elasticmapreduce.amazonaws.com'),
managedPolicies: [
ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonElasticMapReduceRole'),
ManagedPolicy.fromAwsManagedPolicyName('AmazonS3FullAccess')
]
})
this.jobFlowRole = new Role(this, 'EMRJobFlowRole', {
roleName: '...',
assumedBy: (region === 'cn-north-1' || region === 'cn-northwest-1') ?
new ServicePrincipal('ec2.amazonaws.com.cn') :
new ServicePrincipal('ec2.amazonaws.com'),
managedPolicies: [
ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonElasticMapReduceforEC2Role'),
ManagedPolicy.fromAwsManagedPolicyName('AmazonS3FullAccess')
]
})
However, CDK building generates templates for CN regions (cn-north-1 and cn-northwest-1) like below:
For the first role:
...
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "elasticmapreduce.amazonaws.com"
}
}
],
"Version": "2012-10-17"
},
...
For the second role:
...
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com.cn"
}
}
],
"Version": "2012-10-17"
},
...
Note in above generated template, the second role has the EC2's service principal with suffix .cn, while in the first role EMR's doesn't.
I guess this is because CDK dynamically resolve the service principal through ServicePrincipal during build time. However, this behavior differs for ECS and EMR and we do need elasticmapreduce.amazonaws.com.cn as the trusted entity of role in the first role.
Could you please help clarify if this is a bug in CDK or we are not using as expected?
Also another observation is that, if we append something random at the end of EMR's service principal in our code (like new ServicePrincipal('elasticmapreduce.amazonaws.com.cnabc123')), the template generated will have exact what we put instead of overriding it to elasticmapreduce.amazonaws.com:
...
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "elasticmapreduce.amazonaws.com.cnabc123" <<<<<<
}
}
...
Expected Behavior
Service principal elasticmapreduce.amazonaws.com.cn should be attached to the role in the generated template for CN regions.
Current Behavior
Service principal elasticmapreduce.amazonaws.com.cn should be attached to the role in the generated template for CN regions but it has been overridden to elasticmapreduce.amazonaws.com
Reproduction Steps
Same as in description above.
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
CDKBuild-2.x
Framework Version
No response
Node.js Version
NodeJS = 12.x
OS
Linux/macOS
Language
Typescript
Language Version
No response
Other information
No response
Describe the bug
Hello team,
We encountered an issue when create role that trust ElasticSearch ServicePrincipal in CN regions:
However, CDK building generates templates for CN regions (cn-north-1 and cn-northwest-1) like below:
For the first role:
For the second role:
Note in above generated template, the second role has the EC2's service principal with suffix .cn, while in the first role EMR's doesn't.
I guess this is because CDK dynamically resolve the service principal through ServicePrincipal during build time. However, this behavior differs for ECS and EMR and we do need elasticmapreduce.amazonaws.com.cn as the trusted entity of role in the first role.
Could you please help clarify if this is a bug in CDK or we are not using as expected?
Also another observation is that, if we append something random at the end of EMR's service principal in our code (like new ServicePrincipal('elasticmapreduce.amazonaws.com.cnabc123')), the template generated will have exact what we put instead of overriding it to
elasticmapreduce.amazonaws.com:Expected Behavior
Service principal
elasticmapreduce.amazonaws.com.cnshould be attached to the role in the generated template for CN regions.Current Behavior
Service principal
elasticmapreduce.amazonaws.com.cnshould be attached to the role in the generated template for CN regions but it has been overridden toelasticmapreduce.amazonaws.comReproduction Steps
Same as in description above.
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
CDKBuild-2.x
Framework Version
No response
Node.js Version
NodeJS = 12.x
OS
Linux/macOS
Language
Typescript
Language Version
No response
Other information
No response