cdk-pipelines: pipelines.ConfirmPermissionsBroadening not skipping changes without Permission Broadening #32482
Labels
@aws-cdk/pipelines
CDK Pipelines library
bug
This issue is a bug.
effort/medium
Medium work item – several days of effort
p2
Comments
ChristophrK
added
bug
ashishdhingra
added
p2
investigating
|
@ChristophrK Good afternoon. I'm unsure if it was working for you in CDK version import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as pipelines from 'aws-cdk-lib/pipelines';
import * as codebuild from 'aws-cdk-lib/aws-codebuild';
import * as sns from 'aws-cdk-lib/aws-sns';
import * as snssubscriptions from 'aws-cdk-lib/aws-sns-subscriptions';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
export class CdktestStackNew extends cdk.Stack {
constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
super(scope, id, props);
const pipeline = new pipelines.CodePipeline(this, 'Pipeline', {
codeBuildDefaults: {
buildEnvironment: {
buildImage: codebuild.LinuxBuildImage.AMAZON_LINUX_2_5,
computeType: codebuild.ComputeType.SMALL
}
},
synth: new pipelines.ShellStep('Synth', {
input: pipelines.CodePipelineSource.connection('ashishdhingra/demorepo', 'main', {
connectionArn:
'arn:aws:codestar-connections:us-east-2:<<ACCOUNT-ID>>:connection/<<GUID>>',
}),
commands: ['npm ci', 'npm run build', 'npx cdk synth'],
})
});
const topic = new sns.Topic(this, 'SecurityChangesTopic');
topic.addSubscription(new snssubscriptions.EmailSubscription('<<someemail>>'));
const stage = new MyApplicationStage(this, 'MyApplication');
pipeline.addStage(stage, {
pre: [
new pipelines.ConfirmPermissionsBroadening('Check', {
stage,
notificationTopic: topic,
}),
],
});
}
}
class MyApplicationStage extends cdk.Stage {
constructor(scope: Construct, id: string, props?: cdk.StageProps) {
super(scope, id, props);
const dbStack = new DatabaseStack(this, 'Database');
}
}
class DatabaseStack extends cdk.Stack {
public readonly table: dynamodb.TableV2;
constructor(scope: Construct, id: string) {
super(scope, id);
this.table = new dynamodb.TableV2(this, 'Table', {
partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
});
}
}
const app = new cdk.App();
new CdktestStackNew(app, 'CdktestStackNew', {
env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: process.env.CDK_DEFAULT_REGION },
});also displays below message in log for The most likely reason is that in Pipeline, command Are you able to share which role did you modify to add missing permissions after which I cannot certainly rule out the issue here since Thanks, |
ashishdhingra
added
effort/medium
|
Hi @ashishdhingra, sorry for the late reply. I agree it seems like that its not really dependent on the version and the only common thing in our pipelines across usecases is that they started braking after 4th of November. The way to "make it work" with adjusting the IAM Permissions is the following:
The Logs than look like this: And in the Manual Approval Step ( Due to the self update the fix that changes the Role gets removed with the next Invocation of the Pipeline. |
This was referenced Jan 1, 2025
1 task
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
In the past if the cdk diff didnt show any security changes the ConfirmPermissionsBroadening (CodeBuild Action) would call the CDKPipelinesAutoApprove Lambda Function which automatically would approve the Lambda Function. This is not happening anymore and a manual approval is always required.
We noticed that this feature stopped working for us in multiple indepent Accounts and Repositories without any updates (cdk-Version ,Bootstrapping etc.) on our end. The last time that we saw the step working as expected was November 4th.
Regression Issue
Last Known Working CDK Version
No response
Expected Behavior
I would expect that the CDK diff detects that there are no changes and calls the Lambda Function. This was the behaviour in the past. The Logs of the CodeBuild look like this:
Current Behavior
Currently the CDK diff always fails which causes the Lambda to not be triggered. The Logs of the CodeBuild look like this:
It seems like creating it without the IAM Permissions based on template differences isnt working anymore. I checked via Cloud-Trail that there were no Changes to the IAM Permissions of the Role. Original this was deployed with package version
aws-cdk-lib==2.151.0, later I updatet toaws-cdk-lib==2.163.0andaws-cdk-lib==2.164.0. But there was no changeReproduction Steps
Create a Pipeline with Manual Permission Check. Rough Example of what this looks like:
Possible Solution
If I manually add these Permissions to the Role of CDKSecurityCheck and than it starts working:
But since the Pipeline are self Mutating this manual change just get its overwritten. I found #27605 (comment), but im not able to access
Pipeline/PipelinesSecurityCheck/CDKSecurityCheck/Rolein this way since the Construct doesnt expose the Node.It would be great if somebody could show me how to do the same as done in #27605 (comment) but for the Construct, so I can apply my workarround. Or if the underlying bug (?) gets fixed.
Additional Information/Context
No response
CDK CLI Version
2.163.1 (build c14a1ff)
Framework Version
No response
Node.js Version
20
OS
Amazon Linux 2023
Language
Python
Language Version
3.9.20
Other information
No response
The text was updated successfully, but these errors were encountered: