feat(cli): new bootstrap supports cross-account lookups (#14874)

Fixes #8905

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/context-queries.ts

@@ -64,6 +64,13 @@ export interface AmiContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Owners to DescribeImages call
    *
@@ -90,6 +97,14 @@ export interface AvailabilityZonesContextQuery {
    * Query region
    */
   readonly region: string;
+
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
 }
 
 /**
@@ -106,6 +121,13 @@ export interface HostedZoneContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * The domain name e.g. example.com to lookup
    */
@@ -143,6 +165,13 @@ export interface SSMParameterContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Parameter name to query
    */
@@ -163,6 +192,13 @@ export interface VpcContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Filters to apply to the VPC
    *
@@ -205,6 +241,13 @@ export interface EndpointServiceAvailabilityZonesContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Query service name
    */
@@ -261,6 +304,13 @@ export interface LoadBalancerContextQuery extends LoadBalancerFilter {
    * Query region
    */
   readonly region: string;
+
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
 }
 
 /**
@@ -312,6 +362,13 @@ export interface LoadBalancerListenerContextQuery extends LoadBalancerFilter {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Find by listener's arn
    * @default - does not find by listener arn
@@ -345,6 +402,13 @@ export interface SecurityGroupContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Security group id
    */

packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.schema.json

@@ -453,6 +453,10 @@
                     "description": "Region to query",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "owners": {
                     "description": "Owners to DescribeImages call (Default - All owners)",
                     "type": "array",
@@ -488,6 +492,10 @@
                 "region": {
                     "description": "Query region",
                     "type": "string"
+                },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
                 }
             },
             "required": [
@@ -507,6 +515,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "domainName": {
                     "description": "The domain name e.g. example.com to lookup",
                     "type": "string"
@@ -539,6 +551,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "parameterName": {
                     "description": "Parameter name to query",
                     "type": "string"
@@ -562,6 +578,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "filter": {
                     "description": "Filters to apply to the VPC\n\nFilter parameters are the same as passed to DescribeVpcs.",
                     "type": "object",
@@ -597,6 +617,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "serviceName": {
                     "description": "Query service name",
                     "type": "string"
@@ -620,6 +644,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "loadBalancerType": {
                     "$ref": "#/definitions/LoadBalancerType",
                     "description": "Filter load balancers by their type"
@@ -662,6 +690,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "listenerArn": {
                     "description": "Find by listener's arn (Default - does not find by listener arn)",
                     "type": "string"
@@ -716,6 +748,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "securityGroupId": {
                     "description": "Security group id",
                     "type": "string"

packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.version.json

@@ -1 +1 @@
-{"version":"11.0.0"}
+{"version":"12.0.0"}

packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.ts

@@ -84,6 +84,13 @@ export interface DefaultStackSynthesizerProps {
    */
   readonly imageAssetPublishingRoleArn?: string;
 
+  /**
+   * The role to use to look up values from the target AWS account during synthesis
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * External ID to use when assuming role for image asset publishing
    *
@@ -195,6 +202,11 @@ export class DefaultStackSynthesizer extends StackSynthesizer {
    */
   public static readonly DEFAULT_IMAGE_ASSET_PUBLISHING_ROLE_ARN = 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-${Qualifier}-image-publishing-role-${AWS::AccountId}-${AWS::Region}';
 
+  /**
+   * Default lookup role ARN for missing values.
+   */
+  public static readonly DEFAULT_LOOKUP_ROLE_ARN = 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-${Qualifier}-lookup-role-${AWS::AccountId}-${AWS::Region}';
+
   /**
    * Default image assets repository name
    */
@@ -222,8 +234,9 @@ export class DefaultStackSynthesizer extends StackSynthesizer {
   private _cloudFormationExecutionRoleArn?: string;
   private fileAssetPublishingRoleArn?: string;
   private imageAssetPublishingRoleArn?: string;
+  private lookupRoleArn?: string;
   private qualifier?: string;
-  private bucketPrefix?: string
+  private bucketPrefix?: string;
 
   private readonly files: NonNullable<cxschema.AssetManifest['files']> = {};
   private readonly dockerImages: NonNullable<cxschema.AssetManifest['dockerImages']> = {};
@@ -282,6 +295,7 @@ export class DefaultStackSynthesizer extends StackSynthesizer {
     this._cloudFormationExecutionRoleArn = specialize(this.props.cloudFormationExecutionRole ?? DefaultStackSynthesizer.DEFAULT_CLOUDFORMATION_ROLE_ARN);
     this.fileAssetPublishingRoleArn = specialize(this.props.fileAssetPublishingRoleArn ?? DefaultStackSynthesizer.DEFAULT_FILE_ASSET_PUBLISHING_ROLE_ARN);
     this.imageAssetPublishingRoleArn = specialize(this.props.imageAssetPublishingRoleArn ?? DefaultStackSynthesizer.DEFAULT_IMAGE_ASSET_PUBLISHING_ROLE_ARN);
+    this.lookupRoleArn = specialize(this.props.lookupRoleArn ?? DefaultStackSynthesizer.DEFAULT_LOOKUP_ROLE_ARN);
     this.bucketPrefix = specialize(this.props.bucketPrefix ?? DefaultStackSynthesizer.DEFAULT_FILE_ASSET_PREFIX);
     /* eslint-enable max-len */
   }
@@ -362,6 +376,10 @@ export class DefaultStackSynthesizer extends StackSynthesizer {
     };
   }
 
+  protected synthesizeStackTemplate(stack: Stack, session: ISynthesisSession): void {
+    stack._synthesizeTemplate(session, this.lookupRoleArn);
+  }
+
   /**
    * Synthesize the associated stack to the session
    */

packages/@aws-cdk/core/lib/stack.ts

@@ -750,7 +750,7 @@ export class Stack extends CoreConstruct implements ITaggable {
    * Synthesizes the cloudformation template into a cloud assembly.
    * @internal
    */
-  public _synthesizeTemplate(session: ISynthesisSession): void {
+  public _synthesizeTemplate(session: ISynthesisSession, lookupRoleArn?: string): void {
     // In principle, stack synthesis is delegated to the
     // StackSynthesis object.
     //
@@ -777,7 +777,11 @@ export class Stack extends CoreConstruct implements ITaggable {
     fs.writeFileSync(outPath, JSON.stringify(template, undefined, 2));
 
     for (const ctx of this._missingContext) {
-      builder.addMissing(ctx);
+      if (lookupRoleArn != null) {
+        builder.addMissing({ ...ctx, props: { ...ctx.props, lookupRoleArn } });
+      } else {
+        builder.addMissing(ctx);
+      }
     }
   }
 

packages/@aws-cdk/core/test/app.test.ts

@@ -1,7 +1,7 @@
 import { ContextProvider } from '@aws-cdk/cloud-assembly-schema';
 import * as cxapi from '@aws-cdk/cx-api';
 import { nodeunitShim, Test } from 'nodeunit-shim';
-import { CfnResource, Construct, Stack, StackProps } from '../lib';
+import { CfnResource, Construct, DefaultStackSynthesizer, Stack, StackProps } from '../lib';
 import { Annotations } from '../lib/annotations';
 import { App, AppProps } from '../lib/app';
 
@@ -219,14 +219,15 @@ nodeunitShim({
     }
 
     const assembly = withApp({}, app => {
-      new MyStack(app, 'MyStack');
+      new MyStack(app, 'MyStack', { synthesizer: new DefaultStackSynthesizer() });
     });
 
     test.deepEqual(assembly.manifest.missing, [
       {
         key: 'missing-context-key',
         provider: ContextProvider.AVAILABILITY_ZONE_PROVIDER,
         props: {
+          lookupRoleArn: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}',
           account: '12345689012',
           region: 'ab-north-1',
         },
@@ -235,6 +236,7 @@ nodeunitShim({
         key: 'missing-context-key-2',
         provider: ContextProvider.AVAILABILITY_ZONE_PROVIDER,
         props: {
+          lookupRoleArn: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}',
           account: '12345689012',
           region: 'ab-south-1',
         },

packages/@aws-cdk/core/test/stack-synthesis/new-style-synthesis.test.ts

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import * as cxapi from '@aws-cdk/cx-api';
 import { nodeunitShim, Test } from 'nodeunit-shim';
-import { App, Aws, CfnResource, DefaultStackSynthesizer, FileAssetPackaging, Stack } from '../../lib';
+import { App, Aws, CfnResource, ContextProvider, DefaultStackSynthesizer, FileAssetPackaging, Stack } from '../../lib';
 import { evaluateCFN } from '../evaluate-cfn';
 
 const CFN_CONTEXT = {
@@ -101,6 +101,29 @@ nodeunitShim({
     test.done();
   },
 
+  'generates missing context with the lookup role ARN as one of the missing context properties'(test: Test) {
+    // GIVEN
+    stack = new Stack(app, 'Stack2', {
+      synthesizer: new DefaultStackSynthesizer({
+        generateBootstrapVersionRule: false,
+      }),
+      env: {
+        account: '111111111111', region: 'us-east-1',
+      },
+    });
+    ContextProvider.getValue(stack, {
+      provider: cxschema.ContextProvider.VPC_PROVIDER,
+      props: {},
+      dummyValue: undefined,
+    }).value;
+
+    // THEN
+    const assembly = app.synth();
+    test.equal(assembly.manifest.missing![0].props.lookupRoleArn, 'arn:${AWS::Partition}:iam::111111111111:role/cdk-hnb659fds-lookup-role-111111111111-us-east-1');
+
+    test.done();
+  },
+
   'add file asset'(test: Test) {
     // WHEN
     const location = stack.synthesizer.addFileAsset({