Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(cli): diff with changeset fails if deploy role cannot be assumed #29718

Merged
merged 9 commits into from
Apr 5, 2024

Conversation

scanlonp
Copy link
Contributor

@scanlonp scanlonp commented Apr 4, 2024

Closes #29650

Description of changes

This addresses the issue in two ways:

  1. If the describeStacks call errors out, we now catch it and default to classic diff behavior.
  2. The describeStacks call now tries to use the lookup role rather than the deploy role.

Description of how you validated changes

Manual testing with a user that could only assume lookup roles.

Checklist


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@github-actions github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p1 labels Apr 4, 2024
@aws-cdk-automation aws-cdk-automation requested a review from a team April 4, 2024 03:16
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Apr 4, 2024
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@aws-cdk-automation aws-cdk-automation added the pr/needs-cli-test-run This PR needs CLI tests run against it. label Apr 4, 2024
@scanlonp
Copy link
Contributor Author

scanlonp commented Apr 4, 2024

@Mergifyio update

Copy link
Contributor

mergify bot commented Apr 4, 2024

update

✅ Branch has been successfully updated

@mergify mergify bot temporarily deployed to test-pipeline April 4, 2024 03:37 Inactive
@aws-cdk-automation
Copy link
Collaborator

➡️ PR build request submitted to test-main-pipeline ⬅️

A maintainer must now check the pipeline and add the pr-linter/cli-integ-tested label once the pipeline succeeds.

Copy link
Contributor

@TheRealAmazonKendra TheRealAmazonKendra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We've already messed this up a few times so I'd like to see significantly more tests here.

@scanlonp
Copy link
Contributor Author

scanlonp commented Apr 4, 2024

@TheRealAmazonKendra, these tests should cover the cases for the stack exists call. I did not find a good way to test which permissions we grab for the stack exists call, but I did not find too much prior art around which role is assumed. Additionally, the new functionality in stackExists() is exclusive to the call made in our diff logic.

@scanlonp
Copy link
Contributor Author

scanlonp commented Apr 4, 2024

@Mergifyio update

Copy link
Contributor

mergify bot commented Apr 4, 2024

update

✅ Branch has been successfully updated

Comment on lines +435 to +439
if (options.tryLookupRole) {
stackSdk = (await this.prepareSdkWithLookupOrDeployRole(options.stack)).stackSdk;
} else {
stackSdk = (await this.prepareSdkFor(options.stack, undefined, Mode.ForReading)).stackSdk;
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

prepareSdkWithLookupOrDeployRole defaults to ForReading. If we can't assume the lookup role, it will fall back to the deploy role.

Don't use prepareSdkFor directly, use the wrappers like prepareSdkWithLookupRole or whichever one you want to use; those methods have names that make it clear which role is being assumed.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should still try to fallback to the deploy role, in case somebody doesn't have permissions to the lookup role. Why don't we catch any errors we get when trying to assume the deploy role? If we can't assume it then we stop changeset creation.

Inside of prepareSdkFor, cachedSdkForEnvironment returns an object with didAssumeRole on it. didAssumeRole is not returned to the caller, but you could add it as a property to the returned object. Then you have a way of checking if the fallback was successful.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

discussed off(on?)line, we can investigate this in a follow up next week

packages/aws-cdk/lib/cdk-toolkit.ts Outdated Show resolved Hide resolved
@@ -430,7 +431,12 @@ export class Deployments {
}

public async stackExists(options: StackExistsOptions): Promise<boolean> {
const { stackSdk } = await this.prepareSdkFor(options.stack, undefined, Mode.ForReading);
let stackSdk;
if (options.tryLookupRole) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This option is confusing...if it's on, then try to assume the lookup role or the deploy role, but if it's off, we assume the lookup role only?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can follow this one up in another PR

@comcalvi
Copy link
Contributor

comcalvi commented Apr 5, 2024

LGTM; let's test out removing the option and only using lookupOrDeployRole in a follow up PR

@scanlonp scanlonp added pr-linter/cli-integ-tested Assert that any CLI changes have been integ tested and removed pr/needs-cli-test-run This PR needs CLI tests run against it. labels Apr 5, 2024
@scanlonp scanlonp dismissed TheRealAmazonKendra’s stale review April 5, 2024 21:40

Addressed review comment.

@scanlonp scanlonp added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Apr 5, 2024
@aws-cdk-automation aws-cdk-automation dismissed their stale review April 5, 2024 23:28

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Copy link
Contributor

mergify bot commented Apr 5, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 3559d44
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit 21dba21 into main Apr 5, 2024
11 of 12 checks passed
@mergify mergify bot deleted the diff-handle-error branch April 5, 2024 23:56
Copy link
Contributor

mergify bot commented Apr 5, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.

@aws aws locked as resolved and limited conversation to collaborators Jul 25, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug This issue is a bug. contribution/core This is a PR that came from AWS. effort/medium Medium work item – several days of effort p1 pr-linter/cli-integ-tested Assert that any CLI changes have been integ tested pr-linter/exempt-integ-test The PR linter will not require integ test changes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

cdk diff: in 2.134.0 diff fails if deploy cannot be assumed
4 participants