Skip to content

CDK CLI: assuming a doubly-chained role fails since 2.167.0 #32195

@Joe-Zer0

Description

@Joe-Zer0

Describe the bug

This may be related to #32120, but it's different enough I decided to create a separate issue.
2.166.0 works. 2.167.0 and 2.167.2 do not work.
Credentials File

[role0]
aws_access_key_id        = XXXXX
aws_secret_access_key    = XXXXX
aws_session_token        = XXXXX
aws_security_token       = XXXXX
x_principal_arn          = XXXXX
x_security_token_expires = XXXXX

[role1]
source_profile = role0
role_arn       = arn:aws:iam::12345:role/Role1

[role2]
source_profile = role1
role_arn       = arn:aws:iam::12345:role/Role2

Not sure if it's relevant, but role0 is for Account A and role1 and role2 are for Account B.
Using version 2.167.0, cdk synth --profile role1 works correctly, the CDK_DEFAULT_ACCOUNT environment variable is populated. The issue happens when running cdk synth --profile role2, CDK_DEFAULT_ACCOUNT is not populated. But CDK_DEFAULT_REGION is still populated correctly.

Please let me know if there is any additional information I can provide.

Regression Issue

  • Select this option if this issue appears to be a regression.

Last Known Working CDK Version

2.166.0

Expected Behavior

I would expect cdk synth --profile role2 to populate CDK_DEFAULT_ACCOUNT with the account number.

Current Behavior

cdk synth --profile role2 does not populate CDK_DEFAULT_ACCOUNT with the account number.

Reproduction Steps

Run cdk synth on any stack with a profile that is "double assumed".

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.167.2

Framework Version

No response

Node.js Version

v20.17.0

OS

Windows 10

Language

Python

Language Version

No response

Other information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugThis issue is a bug.p0package/toolsRelated to AWS CDK Tools or CLI

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions