CodeBuild: Associating an existing IAM role to a CodeBuild project results in exception

[thesurlydev]

Describe the bug
Creating a new CodeBuild project and associating an existing IAM role results in: Policy must be attached to at least one principal: user, group or role during synthesis. My best guess is that the default policy generated by CDK is getting orphaned instead of disregarded in the case where an existing IAM role is specified?

To Reproduce
Using the following code to make the association:

val codeBuildProjectRole = Role.fromRoleArn(
            this,
            "code-build-project-role",
            "arn:aws:iam::1234567890:role/service-role/codebuild-bruiser-service-role"
        )

        val projectProps = ProjectProps.builder()
            .withEnvironment(buildEnvironment)
            .withProjectName(appName)
            .withSource(gitHubEnterpriseSource)
            .withBuildSpec("buildspec.yml")
            .withVpc(props.vpc)
            .withRole(codeBuildProjectRole)
            .withArtifacts(NoBuildArtifacts())
            .withSecondaryArtifacts(
                listOf(
                    s3BucketBuildArtifacts
                )
            )
            .build()

        val project = Project(this, "code-build-project", projectProps)

Expected behavior
Associating a valid existing role to a CodeBuild project should not result in exception.

Version:

• Ubuntu 18.04
• Kotlin using Java CDK artifacts
• 0.32.0

[thesurlydev]

This was an attempt at a workaround for #2652

[skinny85]

Thanks for the report @digitalsanctum. Confirming this is indeed a bug - I was able to reproduce it locally. I'll be working on a fix.

[pcolazurdo]

I'm on 1.19.0 and this is still occurring.

My code looks like:

role=iam.Role.from_role_arn(
            self,
            "codebuild-EmbeddedMetrics",
            "arn:aws:iam::xx:role/service-role/codebuild-EmbeddedMetrics-service-role"
        )

cdk_build = codebuild.PipelineProject(self, "CdkBuild",
                        build_spec  = codebuild.BuildSpec.from_source_filename("buildspec.yml"),
                        description = "EmbeddedMetrics Build",
                        role        = role,
                        environment = dict(build_image=codebuild.LinuxBuildImage.STANDARD_1_0)
                    )

And the error is:

CREATE_FAILED        | AWS::IAM::Policy        | codebuild-EmbeddedMetrics/Policy (codebuildEmbeddedMetricsPolicy11DBAAB4) The specified value for roleName is invalid. It must contain only alphanumeric characters and/or the following: +=,.@_- (Service: AmazonIdentityManagement; Status Code: 400; Error Code: ValidationError; Request ID: d202f525-b8fd-47c8-a02e-5e80dc506120)
        new Policy (/tmp/jsii-kernel-B8Mzpj/node_modules/@aws-cdk/aws-iam/lib/policy.js:29:26)
        \_ MutableImport.addToPolicy (/tmp/jsii-kernel-B8Mzpj/node_modules/@aws-cdk/aws-iam/lib/role.js:115:42)
        \_ PipelineProject.addToRolePolicy (/tmp/jsii-kernel-B8Mzpj/node_modules/@aws-cdk/aws-codebuild/lib/project.js:46:23)
        \_ new Project (/tmp/jsii-kernel-B8Mzpj/node_modules/@aws-cdk/aws-codebuild/lib/project.js:282:14)
        \_ new PipelineProject (/tmp/jsii-kernel-B8Mzpj/node_modules/@aws-cdk/aws-codebuild/lib/pipeline-project.js:11:9)
...

If I change this code to use any IAM Role not in /service-role/ path, it works

The problem seems to be in aws-iam/lib/policy as it is not cleaning the role path as needed for cloudformation to use only the last part of the path as role name

CC @skinny85 to reopen the Issue if needed

[skinny85]

@pcolazurdo I just tried it with 1.19.0, and it works for me:

        role=iam.Role.from_role_arn(
            self,
            "codebuild-EmbeddedMetrics",
            "arn:aws:iam::xx:role/service-role/codebuild-EmbeddedMetrics-service-role"
        )

        cdk_build = codebuild.PipelineProject(self, "CdkBuild",
            build_spec  = codebuild.BuildSpec.from_source_filename("buildspec.yml"),
            description = "EmbeddedMetrics Build",
            role        = role,
            environment = codebuild.BuildEnvironment(build_image=codebuild.LinuxBuildImage.STANDARD_3_0),
        )

And it works:

$ npx cdk synth
Resources:
  ServiceCatalogPipelineCdkBuildB88770B6:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:3.0
        PrivilegedMode: false
        Type: LINUX_CONTAINER
      ServiceRole: arn:aws:iam::xx:role/service-role/codebuild-EmbeddedMetrics-service-role
      Source:
        BuildSpec: buildspec.yml
        Type: CODEPIPELINE
      Description: EmbeddedMetrics Build
    Metadata:
      aws:cdk:path: hello-cdk-1/ServiceCatalogPipeline/CdkBuild/Resource
  CDKMetadata:
    Type: AWS::CDK::Metadata
    Properties:
      Modules: aws-cdk=1.19.0,@aws-cdk/assets=1.19.0,@aws-cdk/aws-apigateway=1.19.0,@aws-cdk/aws-applicationautoscaling=1.19.0,@aws-cdk/aws-autoscaling=1.19.0,@aws-cdk/aws-autoscaling-common=1.19.0,@aws-cdk/aws-autoscaling-hooktargets=1.19.0,@aws-cdk/aws-certificatemanager=1.19.0,@aws-cdk/aws-cloudformation=1.19.0,@aws-cdk/aws-cloudfront=1.19.0,@aws-cdk/aws-cloudwatch=1.19.0,@aws-cdk/aws-codebuild=1.19.0,@aws-cdk/aws-codecommit=1.19.0,@aws-cdk/aws-codedeploy=1.19.0,@aws-cdk/aws-codepipeline=1.19.0,@aws-cdk/aws-codepipeline-actions=1.19.0,@aws-cdk/aws-cognito=1.19.0,@aws-cdk/aws-dms=1.19.0,@aws-cdk/aws-ec2=1.19.0,@aws-cdk/aws-ecr=1.19.0,@aws-cdk/aws-ecr-assets=1.19.0,@aws-cdk/aws-ecs=1.19.0,@aws-cdk/aws-elasticloadbalancing=1.19.0,@aws-cdk/aws-elasticloadbalancingv2=1.19.0,@aws-cdk/aws-events=1.19.0,@aws-cdk/aws-events-targets=1.19.0,@aws-cdk/aws-glue=1.19.0,@aws-cdk/aws-iam=1.19.0,@aws-cdk/aws-kinesis=1.19.0,@aws-cdk/aws-kms=1.19.0,@aws-cdk/aws-lambda=1.19.0,@aws-cdk/aws-logs=1.19.0,@aws-cdk/aws-logs-destinations=1.19.0,@aws-cdk/aws-rds=1.19.0,@aws-cdk/aws-route53=1.19.0,@aws-cdk/aws-route53-targets=1.19.0,@aws-cdk/aws-s3=1.19.0,@aws-cdk/aws-s3-assets=1.19.0,@aws-cdk/aws-sam=1.19.0,@aws-cdk/aws-secretsmanager=1.19.0,@aws-cdk/aws-servicediscovery=1.19.0,@aws-cdk/aws-sns=1.19.0,@aws-cdk/aws-sns-subscriptions=1.19.0,@aws-cdk/aws-sqs=1.19.0,@aws-cdk/aws-ssm=1.19.0,@aws-cdk/aws-stepfunctions=1.19.0,@aws-cdk/core=1.19.0,@aws-cdk/cx-api=1.19.0,@aws-cdk/region-info=1.19.0,jsii-runtime=Python/3.6.5

(BTW, you're using the environment property wrong - see my example above)

[pcolazurdo]

Thanks for the reply @skinny85 but when I try to do cdk deploy it fails with the error:

The specified value for roleName is invalid. It must contain only alphanumeric characters and/or the following: +=,.@_- (Service: AmazonIdentityManagement; Status Code: 400; Error Code: ValidationError; Request ID: b58a1d4a-04e9-4878-be9b-f66fb552cf6e)

(exactly as before)

Btw, thanks for the tip about BuildEnvironment - I was struggling to find the right syntax here and was reading through the docs

[skinny85]

I think that means you can't use service roles for CodeBuild projects, no? I mean, that error is the from the CodeBuild API I assume.

[jialechan]

i have same issues,
cdk 1.19.0 (build 5597bbe)
Typescript SDK

const buildProjectRole = iam.Role.fromRoleArn(this, 'CodeBuildRole', 'arn:aws:iam::xxx:role/service-role/codebuild-role')
    
const project = new codebuild.Project(this, 'MyProject', {
      role: buildProjectRole,
      ...
}

error msg

  9/11 | 4:18:47 AM | CREATE_FAILED        | AWS::IAM::Policy             | CodeBuildRole/Policy (CodeBuildRolePolicy0442214A) The specified value for roleName is invalid. It must contain only alphanumeric characters and/or the following: +=,.@_- (Service: AmazonIdentityManagement; Status Code: 400; Error Code: ValidationError; Request ID: c0688767-1078-415a-a062-6bb9061b928d)

[pcolazurdo]

The problem seems to be in the code for IAM:
Service Role are supported in CodeBuild, but IAM Policy is expecting a Role Name and not a /path/RoleName:

"codebuildEmbeddedMetricsPolicy11DBAAB4": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            ...
        "PolicyName": "codebuildEmbeddedMetricsPolicy11DBAAB4",
        "Roles": [
          "service-role/codebuild-EmbeddedMetrics-service-role"
        ]
      },
...

If I manually change this with:

"Roles": [
          "codebuild-EmbeddedMetrics-service-role"
        ]

it works totally fine

[skinny85]

Aaah, I get it now :). Thanks @pcolazurdo , I'll try to get this fixed!