fix(custom-resources): cross-environment call fails in opt-in region#26917
fix(custom-resources): cross-environment call fails in opt-in region#26917mergify[bot] merged 35 commits intoaws:mainfrom
Conversation
aws-cdk-automation
left a comment
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
…anlonp/aws-cdk into scanlonp/awsCustomResource-sts-region
...ework-integ/test/custom-resources/test/aws-custom-resource/integ.cross-account-assumeRole.ts
Outdated
Show resolved
Hide resolved
|
Moving my personal checklist to comments. TODO:
Future work, not needed to merge
|
…anlonp/aws-cdk into scanlonp/awsCustomResource-sts-region
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
…26917) Currently, the region parameter in `AwsCustomResource` only controls where the action is performed. If a role needs to be assumed, the `assumeRole` call is made from the region the stack is deployed into. This presents a problem if the stack is deployed into an opt-in region, and the role being assumed lives in a separate stack in an account without the opt-in region enabled. This change makes the `assumeRole` call and the sdk call performed in the same region. Therefore, to solve the above problem, pass any region that is enabled for the account that owns the role to be assumed. Closes #26562. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Currently, the region parameter in
AwsCustomResourceonly controls where the action is performed. If a role needs to be assumed, theassumeRolecall is made from the region the stack is deployed into. This presents a problem if the stack is deployed into an opt-in region, and the role being assumed lives in a separate stack in an account without the opt-in region enabled.This change makes the
assumeRolecall and the sdk call performed in the same region. Therefore, to solve the above problem, pass any region that is enabled for the account that owns the role to be assumed.Closes #26562.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license