(core): file asset publishing role is not used while performing cdk diff with larger templates #29936
Description
Describe the bug
cdk diff is not using file asset publish role when uploading larger templates to S3 while creating the change set. It is using the user/role that is configured in the CLI. If the user/role (configured in CLI) lacks permissions then AccessDenied error is thrown and fallback to template differences.
Expected Behavior
File asset publish role to be used to upload templates for cdk diff
Current Behavior
fail: Access Denied
Failed to publish one or more assets. See the error messages above for more information.
Reproduction Steps
-
Create IAM user or role with deny all S3 actions.
-
Configure your CLI with the above role/user.
-
Create a CDK project with one SQS queue
// create a stack with one sqs queue
new sqs.Queue(this, `Queue`, {});
-
Deploy
-
Add more resources that will create a larger template to the stack and execute
cdk diff -v
// add 300 more sqs queue's to the same stack and perform cdk diff -v
for (let i = 0; i < 300; i++) {
new sqs.Queue(this, `Queue${i}`, {
});
}
Stack trace -
Stack CdktsStack
[23:46:13] Retrieved account ID xxxxxxxxxxxx from disk cache
[23:46:13] Assuming role 'arn:aws:iam::xxxxxxxxxxxx:role/cdk-hnb659fds-lookup-role-xxxxxxxxxxxx-us-east-1'.
[23:46:18] Retrieved account ID xxxxxxxxxxxx from disk cache
[23:46:20] Retrieved account ID xxxxxxxxxxxx from disk cache
[23:46:20] Assuming role 'arn:aws:iam::xxxxxxxxxxxx:role/cdk-hnb659fds-deploy-role-xxxxxxxxxxxx-us-east-1'.
[23:46:21] Waiting for stack CDKToolkit to finish creating or updating...
[23:46:22] Storing template in S3 at: https://cdk-hnb659fds-assets-xxxxxxxxxxxx-us-east-1.s3.us-east-1.amazonaws.com/cdk/CdktsStack/e6cbc1ec64bd0bf5f83ee188026e9c010633551b8252f036384f6dddb29932f0.yml
[23:46:22] [0%] start: Publishing e6cbc1ec64bd0bf5f83ee188026e9c010633551b8252f036384f6dddb29932f0:current
[23:46:23] [0%] check: Check s3://cdk-hnb659fds-assets-xxxxxxxxxxxx-us-east-1/cdk/CdktsStack/e6cbc1ec64bd0bf5f83ee188026e9c010633551b8252f036384f6dddb29932f0.yml
[23:46:32] [0%] upload: Upload s3://cdk-hnb659fds-assets-xxxxxxxxxxxx-us-east-1/cdk/CdktsStack/e6cbc1ec64bd0bf5f83ee188026e9c010633551b8252f036384f6dddb29932f0.yml
[100%] fail: Access Denied
[23:46:36] Failed to publish one or more assets. See the error messages above for more information.
Could not create a change set, will base the diff on template differences (run again with -v to see the reason)
The IAM user configured in my CLI does not have S3 permissions.
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.138.0
Framework Version
No response
Node.js Version
20.10
OS
macos
Language
TypeScript
Language Version
No response
Other information
No response