(codedeploy): Incorrect codedeploy service principal for isolated regions

[mattphan8264]

General Issue

Incorrect CodeDeploy service principal for isolated regions (us-iso-east-1 and us-isob-east-1).

The Question

Code deploy service role is being set to codedeploy.us-isob-east-1.amazonaws.com and codedeploy.us-iso-east-1.amazonaws.com for LCK and DCA regions.

It should be codedeploy.amazonaws.com.

Output we are getting:

    "ApiLambdaCodeDeployDeploymentDeploymentGroupServiceRole45D217E3": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "codedeploy.us-isob-east-1.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "ManagedPolicyArns": [
          {
            "Fn::Join": [
              "",
              [
                "arn:",
                {
                  "Ref": "AWS::Partition"
                },
                ":iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited"
              ]
            ]
          }
        ]
      },
      "Metadata": {
        "aws:cdk:path": "GammaLCK/ApiLambda/CodeDeployDeployment/DeploymentGroup/ServiceRole/Resource"
      }
    },

CDK CLI Version

2.10.0 (build e5b301f)

Framework Version

No response

Node.js Version

No response

OS

No response

Language

Typescript

Language Version

No response

Other information

No response

[peterwoodworth]

The convention for standard regions seems to have the region included - if this isn't true for LCK/DCA regions then you can work around this with escape hatches to override the service property set by CDK

    const ldg = new LambdaDeploymentGroup(this, 'LDG', {
      alias,
    })

    const cfnRole = ldg.role.node.defaultChild as CfnRole;
    cfnRole.addPropertyOverride('AssumeRolePolicyDocument.Statement.0.Principal.Service', 'codedeploy.amazonaws.com')

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[peterwoodworth]

Ping me if you have any more concerns

[skinny85]

I think we should actually handle this correctly in the CodeDeploy library.

@peterwoodworth let me know if you disagree.

[peterwoodworth]

@skinny85 I have nothing against that! I'm curious if there's any precedent for doing something like this - I can't say I've seen any piece of code ever take restricted regions into consideration

[rix0rrr]

This where the magic happens:

aws-cdk/packages/@aws-cdk/region-info/lib/default.ts

Line 37 in 9541de7

function determineConfiguration(service: string): (service: string, region: string, urlSuffix: string) => string {

It's hard though. Too many ifs on the dance floor...

[skinny85]

This where the magic happens:

aws-cdk/packages/@aws-cdk/region-info/lib/default.ts

Line 37 in 9541de7

function determineConfiguration(service: string): (service: string, region: string, urlSuffix: string) => string {

It's hard though. Too many ifs on the dance floor...

Thanks @rix0rrr! Super helpful. I was able to submit #19729 thanks to your tip.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.