feat(cli): add permissions to the bootstrap action role for cdk deploy#6684
Conversation
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
| "Action": [ | ||
| "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet", | ||
| "cloudformation:DescribeChangeSet", "cloudformation:DescribeStacks", | ||
| "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", |
There was a problem hiding this comment.
Didn't we already add these?
There is a statement called CliPermissions, I'd rather you add them there (I want to start annotating this giant permissions set with why we need them, because it's growing big).
There was a problem hiding this comment.
Didn't we already add these?
No. Searching the current bootstrap-template.json on master does not give any results for GetTemplate.
There is a statement called CliPermissions, I'd rather you add them there (I want to start annotating this giant permissions set with why we need them, because it's growing big).
I don't see a statement called like that anywhere in the current file.
There was a problem hiding this comment.
Doh! Misremembering where we put this:
There was a problem hiding this comment.
Changed in the newest revision to what you have in that branch.
BTW, do we really need DeleteStack on "*"? That seems a little wide...
In the "CI/CD for CDK apps" epic, we use the bootstrap action role to perform `cdk deploy` (in the self-mutating stage). To do that, we need 2 additional read-only CloudFormation permissions that the CLI uses (GetTemplate and DescribeStackEvents) added to that role.
c8c98fa to
9d8a87f
Compare
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Ran into the In the meantime, is there a workaround? |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
In the "CI/CD for CDK apps" epic, we use the bootstrap action role to perform
cdk deploy(in the self-mutating stage). To do that, we need 2 additional read-only CloudFormation permissions that the CLI uses (GetTemplate and DescribeStackEvents) added to that role.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license