Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(iam): CDK always detecting a change when there is none #27721

Closed
gaetansnl opened this issue Oct 27, 2023 · 5 comments
Closed

(iam): CDK always detecting a change when there is none #27721

gaetansnl opened this issue Oct 27, 2023 · 5 comments
Labels
@aws-cdk/aws-iam Related to AWS Identity and Access Management bug This issue is a bug. effort/medium Medium work item – several days of effort p2

Comments

@gaetansnl
Copy link

Describe the bug

I have two account with trust.

I have one stack called stackA with a property role of type iam.Role
Then in a second stack in another account i reference stackA.role.roleArn

Everything works fine, but everytime I do cdk diff I have this diff

           [-]     "Resource": "arn:aws:iam::1234:role/test"
            [+]     "Resource": {
            [+]       "Fn::Join": [
            [+]         "",
            [+]         [
            [+]           "arn:",
            [+]           {
            [+]             "Ref": "AWS::Partition"
            [+]           },
            [+]           ":iam::1234:role/test"
            [+]         ]
            [+]       ]
            [+]     }

So it seems that it needs a function to get the string aws

Expected Behavior

No diff

Current Behavior

A diff

Reproduction Steps

export class StackA extends cdk.Stack {
  public role: iam.Role;
  constructor(
    scope: Construct,
    id: string,
    props: SackAProps,
  ) {
    super(scope, id, props);
    this.role= new iam.Role(this, "user-role", {
      roleName: props.exportedResourcesPrefix + props.userRoleName,
      assumedBy: new iam.ArnPrincipal(props.userArn),
    });
  }
}
const isntanceA = new StackA() ....
  new StackA(app, `xxxxx`, {
    allowedRolesArn: [
     isntanceA.role.roleArn
    ],
    env: {
      account: "otherAccount",
      region: "eu-west-1",
    },
  });

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.103.1

Framework Version

No response

Node.js Version

v18.1.0

OS

ubuntu

Language

TypeScript

Language Version

No response

Other information

No response

@gaetansnl gaetansnl added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Oct 27, 2023
@github-actions github-actions bot added the @aws-cdk/aws-iam Related to AWS Identity and Access Management label Oct 27, 2023
@pahud
Copy link
Contributor

pahud commented Oct 31, 2023

Can you share a complete minimal sample code that we can reproduce in our environment?

e.g. SackAProps is not defined in your provided code.

@pahud pahud added response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. p2 effort/medium Medium work item – several days of effort and removed needs-triage This issue or PR still needs to be triaged. labels Oct 31, 2023
Copy link

github-actions bot commented Nov 2, 2023

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

@github-actions github-actions bot added the closing-soon This issue will automatically close in 4 days unless further comments are made. label Nov 2, 2023
@gaetansnl
Copy link
Author

I will post better reproduction soon

@github-actions github-actions bot removed closing-soon This issue will automatically close in 4 days unless further comments are made. response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. labels Nov 3, 2023
@gaetansnl
Copy link
Author

seems to work in latest version

Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
@aws-cdk/aws-iam Related to AWS Identity and Access Management bug This issue is a bug. effort/medium Medium work item – several days of effort p2
Projects
None yet
Development

No branches or pull requests

2 participants