fix(core): file asset publishing role not used in cdk diff to upload large templates#31597
Conversation
…e bug Signed-off-by: Sumu <sumughan@amazon.com>
…sets in uploadBodyParameterAndCreateChangeSet in cloudformation.ts to fix bug Signed-off-by: Sumu <sumughan@amazon.com>
…plate is published succesffuly Signed-off-by: Sumu <sumughan@amazon.com>
aws-cdk-automation
left a comment
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts
Show resolved
Hide resolved
cdk diff to upload large diff templatescdk diff to upload large templates
This is not a correct statement. It definitely was uploading things to S3. |
packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts
Outdated
Show resolved
Hide resolved
packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts
Show resolved
Hide resolved
Co-authored-by: Rico Hermans <rix0rrr@gmail.com>
Signed-off-by: Sumu <sumughan@amazon.com>
…ttps://github.com/aws/aws-cdk into sumughan/diff-file-asset-publishing-role-not-used
|
➡️ PR build request submitted to A maintainer must now check the pipeline and add the |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
Comments on closed issues and PRs are hard for our team to see. |
Closes #29936
Reason for this change
When running
cdk diffon larger templates, the CDK needs to upload the diff template to S3 to create the ChangeSet. However, the CLI is currently not using the the file asset publishing role to do so and is instead using the IAM user/role that is configured by the user in the CLI - this means that if the user/role lacks S3 permissions then theAccessDeniederror is thrown and users cannot see a full diff.Description of changes
This PR ensures that the
FileAssetPublishingRoleis used bycdk diffto upload assets to S3 before creating a ChangeSet by:makeBodyParameterAndUploadfunction which was using the deprecatedpublishAssetsfunction from deployments.tsuploadBodyParameterAndCreateChangeSetfunction withincloudformation.tsinsteadDescription of how you validated changes
Integ test that deploys a simple CDK app with a single IAM role, then runs
cdk diffon a large template change adding 200 IAM roles. I asserted that the logs did not contain the S3 access denied permissions errors, and also contained a statement for assuming the file publishing role. Reused the CDK app for the integ test from this PR by @sakurai-ryo which tried fixing this issue by adding another Bootstrap role (which we decided against).Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license