-
Notifications
You must be signed in to change notification settings - Fork 4.5k
CDK CLI: assuming a doubly-chained role fails since 2.167.0 #32195
Description
Describe the bug
This may be related to #32120, but it's different enough I decided to create a separate issue.
2.166.0 works. 2.167.0 and 2.167.2 do not work.
Credentials File
[role0]
aws_access_key_id = XXXXX
aws_secret_access_key = XXXXX
aws_session_token = XXXXX
aws_security_token = XXXXX
x_principal_arn = XXXXX
x_security_token_expires = XXXXX
[role1]
source_profile = role0
role_arn = arn:aws:iam::12345:role/Role1
[role2]
source_profile = role1
role_arn = arn:aws:iam::12345:role/Role2
Not sure if it's relevant, but role0 is for Account A and role1 and role2 are for Account B.
Using version 2.167.0, cdk synth --profile role1 works correctly, the CDK_DEFAULT_ACCOUNT environment variable is populated. The issue happens when running cdk synth --profile role2, CDK_DEFAULT_ACCOUNT is not populated. But CDK_DEFAULT_REGION is still populated correctly.
Please let me know if there is any additional information I can provide.
Regression Issue
- Select this option if this issue appears to be a regression.
Last Known Working CDK Version
2.166.0
Expected Behavior
I would expect cdk synth --profile role2 to populate CDK_DEFAULT_ACCOUNT with the account number.
Current Behavior
cdk synth --profile role2 does not populate CDK_DEFAULT_ACCOUNT with the account number.
Reproduction Steps
Run cdk synth on any stack with a profile that is "double assumed".
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.167.2
Framework Version
No response
Node.js Version
v20.17.0
OS
Windows 10
Language
Python
Language Version
No response
Other information
No response