feat(cli): new bootstrap supports cross-account lookups

packages/@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/context-queries.ts

@@ -64,6 +64,13 @@ export interface AmiContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Owners to DescribeImages call
    *
@@ -90,6 +97,14 @@ export interface AvailabilityZonesContextQuery {
    * Query region
    */
   readonly region: string;
+
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
 }
 
 /**
@@ -106,6 +121,13 @@ export interface HostedZoneContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * The domain name e.g. example.com to lookup
    */
@@ -143,6 +165,13 @@ export interface SSMParameterContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Parameter name to query
    */
@@ -163,6 +192,13 @@ export interface VpcContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Filters to apply to the VPC
    *
@@ -205,6 +241,13 @@ export interface EndpointServiceAvailabilityZonesContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Query service name
    */
@@ -261,6 +304,13 @@ export interface LoadBalancerContextQuery extends LoadBalancerFilter {
    * Query region
    */
   readonly region: string;
+
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
 }
 
 /**
@@ -312,6 +362,13 @@ export interface LoadBalancerListenerContextQuery extends LoadBalancerFilter {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Find by listener's arn
    * @default - does not find by listener arn
@@ -345,6 +402,13 @@ export interface SecurityGroupContextQuery {
    */
   readonly region: string;
 
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * Security group id
    */

packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.schema.json

@@ -453,6 +453,10 @@
                     "description": "Region to query",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "owners": {
                     "description": "Owners to DescribeImages call (Default - All owners)",
                     "type": "array",
@@ -488,6 +492,10 @@
                 "region": {
                     "description": "Query region",
                     "type": "string"
+                },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
                 }
             },
             "required": [
@@ -507,6 +515,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "domainName": {
                     "description": "The domain name e.g. example.com to lookup",
                     "type": "string"
@@ -539,6 +551,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "parameterName": {
                     "description": "Parameter name to query",
                     "type": "string"
@@ -562,6 +578,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "filter": {
                     "description": "Filters to apply to the VPC\n\nFilter parameters are the same as passed to DescribeVpcs.",
                     "type": "object",
@@ -597,6 +617,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "serviceName": {
                     "description": "Query service name",
                     "type": "string"
@@ -620,6 +644,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "loadBalancerType": {
                     "$ref": "#/definitions/LoadBalancerType",
                     "description": "Filter load balancers by their type"
@@ -662,6 +690,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "listenerArn": {
                     "description": "Find by listener's arn (Default - does not find by listener arn)",
                     "type": "string"
@@ -716,6 +748,10 @@
                     "description": "Query region",
                     "type": "string"
                 },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
                 "securityGroupId": {
                     "description": "Security group id",
                     "type": "string"

packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.version.json

@@ -1 +1 @@
-{"version":"11.0.0"}
+{"version":"12.0.0"}

packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.ts

@@ -84,6 +84,13 @@ export interface DefaultStackSynthesizerProps {
    */
   readonly imageAssetPublishingRoleArn?: string;
 
+  /**
+   * The role to use to look up values from the target AWS account during synthesis
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * External ID to use when assuming role for image asset publishing
    *
@@ -195,6 +202,11 @@ export class DefaultStackSynthesizer extends StackSynthesizer {
    */
   public static readonly DEFAULT_IMAGE_ASSET_PUBLISHING_ROLE_ARN = 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-${Qualifier}-image-publishing-role-${AWS::AccountId}-${AWS::Region}';
 
+  /**
+   * Default lookup role ARN for missing values.
+   */
+  public static readonly DEFAULT_LOOKUP_ROLE_ARN = 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-${Qualifier}-lookup-role-${AWS::AccountId}-${AWS::Region}';
+
   /**
    * Default image assets repository name
    */
@@ -222,8 +234,9 @@ export class DefaultStackSynthesizer extends StackSynthesizer {
   private _cloudFormationExecutionRoleArn?: string;
   private fileAssetPublishingRoleArn?: string;
   private imageAssetPublishingRoleArn?: string;
+  private lookupRoleArn?: string;
   private qualifier?: string;
-  private bucketPrefix?: string
+  private bucketPrefix?: string;
 
   private readonly files: NonNullable<cxschema.AssetManifest['files']> = {};
   private readonly dockerImages: NonNullable<cxschema.AssetManifest['dockerImages']> = {};
@@ -282,6 +295,7 @@ export class DefaultStackSynthesizer extends StackSynthesizer {
     this._cloudFormationExecutionRoleArn = specialize(this.props.cloudFormationExecutionRole ?? DefaultStackSynthesizer.DEFAULT_CLOUDFORMATION_ROLE_ARN);
     this.fileAssetPublishingRoleArn = specialize(this.props.fileAssetPublishingRoleArn ?? DefaultStackSynthesizer.DEFAULT_FILE_ASSET_PUBLISHING_ROLE_ARN);
     this.imageAssetPublishingRoleArn = specialize(this.props.imageAssetPublishingRoleArn ?? DefaultStackSynthesizer.DEFAULT_IMAGE_ASSET_PUBLISHING_ROLE_ARN);
+    this.lookupRoleArn = specialize(this.props.lookupRoleArn ?? DefaultStackSynthesizer.DEFAULT_LOOKUP_ROLE_ARN);
     this.bucketPrefix = specialize(this.props.bucketPrefix ?? DefaultStackSynthesizer.DEFAULT_FILE_ASSET_PREFIX);
     /* eslint-enable max-len */
   }
@@ -362,6 +376,10 @@ export class DefaultStackSynthesizer extends StackSynthesizer {
     };
   }
 
+  public enrichContext(ctx: cxschema.MissingContext): cxschema.MissingContext {
+    return { ...ctx, props: { ...ctx.props, lookupRoleArn: this.lookupRoleArn } };
+  }
+
   /**
    * Synthesize the associated stack to the session
    */

packages/@aws-cdk/core/lib/stack-synthesizers/nested.ts

@@ -4,6 +4,7 @@ import { Stack } from '../stack';
 import { assertBound } from './_shared';
 import { StackSynthesizer } from './stack-synthesizer';
 import { IStackSynthesizer } from './types';
+import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 
 /**
  * Deployment environment for a nested stack
@@ -42,4 +43,8 @@ export class NestedStackSynthesizer extends StackSynthesizer {
     // It will be registered as an S3 asset of its parent instead.
     this.synthesizeStackTemplate(this.stack, session);
   }
+
+  enrichContext(ctx: cxschema.MissingContext): cxschema.MissingContext {
+    return this.parentDeployment.enrichContext(ctx);
+  }
 }

packages/@aws-cdk/core/lib/stack-synthesizers/stack-synthesizer.ts

@@ -3,6 +3,7 @@ import { ISynthesisSession } from '../construct-compat';
 import { Stack } from '../stack';
 import { addStackArtifactToAssembly } from './_shared';
 import { IStackSynthesizer } from './types';
+import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 
 /**
  * Base class for implementing an IStackSynthesizer
@@ -56,6 +57,10 @@ export abstract class StackSynthesizer implements IStackSynthesizer {
   protected emitStackArtifact(stack: Stack, session: ISynthesisSession, options: SynthesizeStackArtifactOptions = {}) {
     addStackArtifactToAssembly(session, stack, options ?? {}, options.additionalDependencies ?? []);
   }
+
+  public enrichContext(ctx: cxschema.MissingContext): cxschema.MissingContext {
+    return ctx;
+  }
 }
 
 /**
@@ -86,6 +91,13 @@ export interface SynthesizeStackArtifactOptions {
    */
   readonly assumeRoleArn?: string;
 
+  /**
+   * The role that needs to be assumed to lookup missing values
+   *
+   * @default - No role is assumed (current credentials are used)
+   */
+  readonly lookupRoleArn?: string;
+
   /**
    * The role that is passed to CloudFormation to execute the change set
    *

packages/@aws-cdk/core/lib/stack-synthesizers/types.ts

@@ -1,6 +1,7 @@
 import { DockerImageAssetLocation, DockerImageAssetSource, FileAssetLocation, FileAssetSource } from '../assets';
 import { ISynthesisSession } from '../construct-compat';
 import { Stack } from '../stack';
+import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 
 /**
  * Encodes information how a certain Stack should be deployed
@@ -31,4 +32,9 @@ export interface IStackSynthesizer {
    * Synthesize the associated stack to the session
    */
   synthesize(session: ISynthesisSession): void;
+
+  /**
+   * Returns another context with additional information, known by the synthesizer
+   */
+  enrichContext(ctx: cxschema.MissingContext): cxschema.MissingContext;
 }

packages/@aws-cdk/core/lib/stack.ts

@@ -777,7 +777,8 @@ export class Stack extends CoreConstruct implements ITaggable {
     fs.writeFileSync(outPath, JSON.stringify(template, undefined, 2));
 
     for (const ctx of this._missingContext) {
-      builder.addMissing(ctx);
+      const enrichedContext = this.synthesizer.enrichContext(ctx);
+      builder.addMissing(enrichedContext);
     }
   }
 

packages/@aws-cdk/core/test/app.test.ts

@@ -1,7 +1,7 @@
 import { ContextProvider } from '@aws-cdk/cloud-assembly-schema';
 import * as cxapi from '@aws-cdk/cx-api';
 import { nodeunitShim, Test } from 'nodeunit-shim';
-import { CfnResource, Construct, Stack, StackProps } from '../lib';
+import { CfnResource, Construct, DefaultStackSynthesizer, Stack, StackProps } from '../lib';
 import { Annotations } from '../lib/annotations';
 import { App, AppProps } from '../lib/app';
 
@@ -219,14 +219,15 @@ nodeunitShim({
     }
 
     const assembly = withApp({}, app => {
-      new MyStack(app, 'MyStack');
+      new MyStack(app, 'MyStack', { synthesizer: new DefaultStackSynthesizer() });
     });
 
     test.deepEqual(assembly.manifest.missing, [
       {
         key: 'missing-context-key',
         provider: ContextProvider.AVAILABILITY_ZONE_PROVIDER,
         props: {
+          lookupRoleArn: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}',
           account: '12345689012',
           region: 'ab-north-1',
         },
@@ -235,6 +236,7 @@ nodeunitShim({
         key: 'missing-context-key-2',
         provider: ContextProvider.AVAILABILITY_ZONE_PROVIDER,
         props: {
+          lookupRoleArn: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}',
           account: '12345689012',
           region: 'ab-south-1',
         },