‼️ (aws-appsync): invalid service role creation #23035

mtliendo · 2022-11-22T15:23:09Z

PATCHED - Upgrade aws-cdk-lib/aws-appsync to version 2.52.1-alpha.0 or later.

Describe the bug

When attaching a DynamoDB datasource to an API, the generated service role does not include the correct servicerole name

(it's missing the .amazonaws part)

Expected Behavior

I would expect the correct service role to be created.

Current Behavior

On version 2.51.1 I created the following stack and deployed the application but it failed on the deploying the API. After inspecting the output, I found that the datasource was not given the correct datasource.

Reverting back to v2.50.0 had the correct service role

Reproduction Steps

clone the repo
update to the latest version
deploy
view error
remove node_modules directory and package-lock.json file
revert to v2.50.0
deploy
view successful deploy

Possible Solution

Appending the correct principal

Additional Information/Context

No response

CDK CLI Version

2.51.1

Framework Version

CDK

Node.js Version

16

OS

mac

Language

Typescript

Language Version

No response

Other information

No response

The text was updated successfully, but these errors were encountered:

jpignata · 2022-11-22T16:00:30Z

Is this related to 65d8e3d? Do the references to the service principal need to be updated? The commit indicates this change was behind a feature flag.

jpignata · 2022-11-22T16:06:52Z

It appears this reference (https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-appsync/lib/data-source.ts#L116) needs to be updated.

peterwoodworth · 2022-11-22T21:01:58Z

I'm finding this new incorrect behavior is only being applied with the feature flag enabled. You should be able to disable the feature flag for now while we get this fixed up. Thanks for reporting!

mtliendo · 2022-11-22T22:39:31Z

Ah yea, that seems to be the issue. On new CDK projects, the default state of the flag is set to true.

In aws#22819, a feature flag was added to use standardized service principal names instead of using a database lookup. This reference wasn't updated which causes failures in new CDK applications that try to create AppSync resources. This change passes the fully qualified service principal when creating a service role for a new data source. fixes aws#23035

@jpignata

Builds on top of @jpignata 's PR #23050. Updated integration tests. Closes #23050 Fixes #23035 ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

github-actions · 2022-11-23T08:17:13Z

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

ryparker · 2022-11-23T22:07:35Z

Thanks to @robertd for the fix, it has been merged and will be included in the next release shortly after re:invent.

Here’s a workaround for the interim:

Disable the @aws-cdk/aws-iam:standardizedServicePrincipals feature flag in your cdk.json.

cdk.json:

{
  "context": {
    "@aws-cdk/aws-iam:standardizedServicePrincipals": false
  }
}

Feature flag docs

@jpignata

Builds on top of @jpignata 's PR #23050. Updated integration tests. Closes #23050 Fixes #23035 ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

ryparker · 2022-12-02T21:08:26Z

Patched in aws-cdk-lib/aws-appsync version 2.52.1-alpha.0.

mtliendo added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Nov 22, 2022

github-actions bot added the @aws-cdk/aws-appsync Related to AWS AppSync label Nov 22, 2022

github-actions bot assigned otaviomacedo Nov 22, 2022

mtliendo added a commit to mtliendo/aws-cdk that referenced this issue Nov 22, 2022

fix: update service role name aws#23035

1ef02b8

peterwoodworth added p1 effort/small Small work item – less than a day of effort and removed needs-triage This issue or PR still needs to be triaged. labels Nov 22, 2022

jpignata mentioned this issue Nov 23, 2022

fix(appsync): fully qualify service principal #23050

Closed

robertd mentioned this issue Nov 23, 2022

fix(appsync): fully qualify service principal #23054

Merged

4 tasks

mergify bot closed this as completed in #23054 Nov 23, 2022

ryparker pinned this issue Nov 23, 2022

ryparker changed the title ~~aws-appsync: invalid service role creation~~ !! aws-appsync: invalid service role creation Nov 23, 2022

ryparker changed the title ~~!! aws-appsync: invalid service role creation~~ ‼️ aws-appsync: invalid service role creation Nov 23, 2022

peterwoodworth mentioned this issue Nov 24, 2022

@aws-cdk/aws-iam:standardizedServicePrincipals: produces invalid templates when using some L2 constructs #23066

Closed

ryparker added the pending-release This issue will be fixed by an approved PR that hasn't been released yet. label Nov 25, 2022

ryparker removed the pending-release This issue will be fixed by an approved PR that hasn't been released yet. label Dec 2, 2022

ryparker changed the title ~~‼️ aws-appsync: invalid service role creation~~ ‼️ (aws-appsync): invalid service role creation Dec 2, 2022

iliapolo unpinned this issue Jan 2, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

‼️ (aws-appsync): invalid service role creation #23035

‼️ (aws-appsync): invalid service role creation #23035

mtliendo commented Nov 22, 2022 •

edited by ryparker

Loading

jpignata commented Nov 22, 2022

jpignata commented Nov 22, 2022

peterwoodworth commented Nov 22, 2022

mtliendo commented Nov 22, 2022

github-actions bot commented Nov 23, 2022

ryparker commented Nov 23, 2022

ryparker commented Dec 2, 2022 •

edited

Loading

‼️ (aws-appsync): invalid service role creation #23035

‼️ (aws-appsync): invalid service role creation #23035

Comments

mtliendo commented Nov 22, 2022 • edited by ryparker Loading

Describe the bug

Expected Behavior

Current Behavior

Reproduction Steps

Possible Solution

Additional Information/Context

CDK CLI Version

Framework Version

Node.js Version

OS

Language

Language Version

Other information

jpignata commented Nov 22, 2022

jpignata commented Nov 22, 2022

peterwoodworth commented Nov 22, 2022

mtliendo commented Nov 22, 2022

github-actions bot commented Nov 23, 2022

⚠️COMMENT VISIBILITY WARNING⚠️

ryparker commented Nov 23, 2022

ryparker commented Dec 2, 2022 • edited Loading

mtliendo commented Nov 22, 2022 •

edited by ryparker

Loading

ryparker commented Dec 2, 2022 •

edited

Loading