‼️ (cli): import fails with with 'S3 error: Access Denied #31716
Description
Please add your +1 👍 to let us know you have encountered this
Status: IN-PROGRESS
Overview:
Versions 2.161.0, 2.161.1 and 2.162.0 of the CDK CLI will fail with an S3 error when performing an interactive cdk import.
In #31597 we changed cdk diff to always use the file asset publishing role, instead of direct CLI credentials. This included a refactor that impacted cdk import, which was now not uploading the stack template at all anymore. The operation that is now broken only happens in a case with interactive input, which is why this wasn't caught by integ tests.
Complete Error Message:
S3 error: Access Denied
For more information check http://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html
Workaround:
We are rolling out a fix now. If you are blocked by this, you can temporarily try using an older version of the CDK CLI to perform the import npx cdk@2.160.0 import ...
Related Issues:
None yet.
Original report
Describe the bug
When using cdk import, the command tries to read a template that doesn't exist from the assets bucket.
It also returns an uninformative S3 error.
Regression Issue
- Select this option if this issue appears to be a regression.
Last Known Working CDK Version
No response
Expected Behavior
I can import without any manual intervention (especially error-prone tinkering with the assets bucket).
Current Behavior
Output of import --force -v command:
[....]
[14:51:24] Reading existing template for stack Prod/Companies.
[14:51:24] Retrieved account ID XXXXXXXXX from disk cache
[14:51:24] Assuming role 'arn:aws:iam::XXXXXXXXX:role/cdk-hnb659fds-lookup-role-XXXXXXXXX-eu-west-2'.
Ignoring updated/deleted resources (--force): LAMBDAS APPARENTLY WITH UPDATES EVEN THOUGH THEY ARE NOT IN THE DIFF
[14:51:25] Retrieving template summary for stack Prod/Companies.
[14:51:25] Retrieved account ID XXXXXXXXX from disk cache
[14:51:25] Assuming role 'arn:aws:iam::XXXXXXXXX:role/cdk-hnb659fds-deploy-role-XXXXXXXXX-eu-west-2'.
[14:51:25] Call failed: getTemplateSummary({"TemplateURL":"https://s3.eu-west-2.amazonaws.com/cdk-XXXX-assets-XXXXXXXXX-eu-west-2/52852392599fc7aa03a114e1052f31dc18d35712e91b343b2038748dfa86a257.json"}) => S3 error: Access Denied
For more information check http://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html (code=ValidationError)
[14:51:25] Reading cached notices from /Users/.../.cdk/cache/notices.json
S3 error: Access Denied
For more information check http://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html
[14:51:25] ValidationError: S3 error: Access Denied
For more information check http://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html
at Request.extractError (/Users/.../node_modules/aws-cdk/lib/index.js:439:46717)
at Request.callListeners (/Users/.../node_modules/aws-cdk/lib/index.js:439:91820)
at Request.emit (/Users/.../node_modules/aws-cdk/lib/index.js:439:91268)
at Request.emit (/Users/.../node_modules/aws-cdk/lib/index.js:439:200231)
at Request.transition (/Users/.../node_modules/aws-cdk/lib/index.js:439:193784)
at AcceptorStateMachine.runTo (/Users/.../node_modules/aws-cdk/lib/index.js:439:158656)
at /Users/.../node_modules/aws-cdk/lib/index.js:439:158986
at Request.<anonymous> (/Users/.../node_modules/aws-cdk/lib/index.js:439:194076)
at Request.<anonymous> (/Users/.../node_modules/aws-cdk/lib/index.js:439:200306)
at Request.callListeners (/Users/.../node_modules/aws-cdk/lib/index.js:439:91988)
Diff output
Stack Prod/Companies
Resources
[+] AWS::DynamoDB::Table Companies/Lists/CompaniesListsTable/CompaniesListsTable ListsCompaniesListsTableAFA73CC8
✨ Number of stacks with differences: 1
If I take the result of synth and put it in the bucket with exactly the expected key (52852392599fc7aa03a114e1052f31dc18d35712e91b343b2038748dfa86a257.json in this case) it works.
Reproduction Steps
Just trying to import a table should do it.
export class MyStack extends Stack {
constructor(scope: Construct, id: string, props: StackProps) {
super(scope, id, props);
this.table = new Table(this, 'Table', {
...props,
removalPolicy: RemovalPolicy.RETAIN,
});
}
}Possible Solution
Either don't read the template from S3 as it won't contain the latest version. We can't have a template for importing that's identical to the one deployed, otherwise the resources to import will have been created already.
Or here
aws-cdk/packages/aws-cdk/lib/api/deployments.ts
Lines 429 to 435 in c1b240e
This function is called here
aws-cdk/packages/aws-cdk/lib/import.ts
Line 250 in c1b240e
Additional Information/Context
I know it's not an Access Denied error per se as I have full admin access and can diff/deploy/etc. It should be a 404 instead of a 403.
Also, my lambdas prevent importing because of metadata changes even though they don't appear in the diff. Probably related to #31677
CDK CLI Version
2.161.1 (build 0a606c9)
Framework Version
No response
Node.js Version
20.17.0
OS
Mac OS
Language
TypeScript
Language Version
5.6.2
Other information
No response