fix(eks-v2): remove usage of shell=True in helm commands

[aemada-aws]

Improve subprocess handling in EKS Helm custom resource handler.

Reason for this change

The EKS Helm custom resource handler used shell=True with subprocess calls, which is not aligned with security best practices. Following Python's recommended approach for subprocess execution improves code robustness and follows secure coding guidelines.

Description of changes

Refactor subprocess execution to follow Python best practices
https://docs.python.org/3/library/subprocess.html#replacing-shell-pipeline

• Replaced shell command strings with array-based commands: Refactored get_oci_cmd() to return structured command objects instead of shell strings
• Implemented proper subprocess pipelines: Used Popen with PIPE to chain aws ecr get-login-password and helm registry login commands following Python documentation recommendations
• Removed shell=True: Adopted array-based command execution as recommended by Python subprocess documentation
• Maintained functionality: Preserved all existing behavior for private ECR, public ECR, and fallback scenarios

Files modified:

• packages/@aws-cdk/custom-resource-handlers/lib/aws-eks/kubectl-handler/helm/__init__.py
• packages/@aws-cdk/aws-eks-v2-alpha/lib/kubectl-handler/helm/__init__.py
• packages/@aws-cdk/aws-eks-v2-alpha/test/integ.alb-controller.js.snapshot/asset.*/helm/__init__.py

Technical approach:

• Commands are now built as arrays: ['helm', 'pull', repository, '--version', version, '--untar']
• Pipeline implementation follows Python subprocess best practices using Popen with proper PIPE connections
• User inputs are passed as separate array elements, ensuring proper argument handling

Describe any new or updated permissions being added

No new IAM permissions required. The change maintains the same AWS API calls and functionality.

Description of how you validated changes

• Functionality testing: Confirmed that ECR authentication and Helm chart pulling continues to work correctly for all scenarios
• Code review: Verified implementation follows Python subprocess best practices as documented in the Python documentation
• Compatibility testing: Ensured backward compatibility with existing CDK Helm chart deployments

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

[vishaalmehrishi]

I think it would help reviewers if you can share the relevant Python documentation which is referenced in the description.

[vishaalmehrishi]

Just checking - is the removal of helm pull... intentional?

[aemada-aws]

It is there, not removed. It is built at the top

  # Build helm pull command as array
    helm_cmd = ['helm', 'pull', repository]
    ```

[aemada-aws]

I think it would help reviewers if you can share the relevant Python documentation which is referenced in the description.

Added: https://docs.python.org/3/library/subprocess.html#replacing-shell-pipeline

[Abogical]

Thank you!

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 74a0380
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.