[pipelines] UpdatePipeline stage of new empty pipeline fails due to missing permissions (ref. #9227) #9606
Comments
MamishIo
added
bug
MamishIo
changed the title
|
Edit: Turns out this was my fault: For posterity, fixed by changing: {
"app": "mvn -e -q exec:java",
"output": "target/cloud-assembly",
"@aws-cdk/core:newStyleStackSynthesis": "true"
}to: {
"app": "mvn -e -q exec:java",
"output": "target/cloud-assembly",
"context": {
"@aws-cdk/core:newStyleStackSynthesis": true
}
} |
|
@MamishIo thanks for posting your solution, just ran into the exact same problem <3 |
|
Nice finding, @MamishIo! |
|
You saved me with this fix |
|
Even after changing |
|
@matwerber1 any updates? I just ran into the same problem. |
|
@cbrgm yes, actually found my problem. The issue was that I was correctly updating Being new to CDK pipelines, I didn't realize this was the mistake. With the way the pipeline runs, its actually going to pull the latest changes from your source code repository when it gets to the relevant build scripts - and since I had not committed and pushed the change to Lesson learned for me is that, with CDK pipelines, after your very first local Hopefully this helps you? |
|
@matwerber1 Unbelievable! You just made my day! Thank you very much, that's what it was ... |
Based on [this issue](aws/aws-cdk#9606), a older versions of CDK don't correctly grant permissions for updates, which is an error I'm seeing now. I don't see `"@aws-cdk/core:newStyleStackSynthesis": true` in `cdk.json` here, but... I'm trying! I'll manually add it if this fails too.
I'm attempting to set up an initial blank pipeline via Java11, and have the same permissions issue noted in issue #9227, where the UpdatePipeline stage fails to due missing CloudFormation permissions needed for
cdk deploy.Reproduction Steps
Deploy empty (no application stages) pipeline from https://github.com/HtyCorp/cdk-repro-1
Requires: Java 11 (tested: Corretto-11.0.8.10.1), Maven (tested: 3.6.0), must have a Secrets Manager secret "GitHubRepoAccessToken" in account containing GitHub OAuth token for CodePipeline.
git clone https://github.com/HtyCorp/cdk-repro-1.git && cd cdk-repro-1 && mvn clean install && cdk synth && cdk deploy --require-approval=neverWhat did you expect to happen?
Default pipeline stages (Source -> Build -> UpdatePipeline) of deployed pipeline all execute successfully since no deployments or changes are required.
Role generated by CdkPipeline construct has permission to invoke CloudFormation, or is used by UpdatePipeline to assume account's 'cdk--deploy-role-' role for CloudFormation permissions.
What actually happened?
Pipeline is successfully created but UpdatePipeline stage is unable to execute
cdk deploydue to missing cloudformation:GetTemplate permission:User: arn:aws:sts::111122223333:assumed-role/CdkPipeline-DeploymentPipelineUpdatePipelineSelfMu-DC3BOF9ZJLNE/AWSCodeBuild-d8a8414e-ce0f-40bf-bb9c-8b4526bf6ed6 is not authorized to perform: cloudformation:GetTemplate on resource: arn:aws:cloudformation:ap-southeast-2:111122223333:stack/CdkPipeline/81fa2090-dbdd-11ea-9fba-0266790261eeDetailed CodeBuild logs:
Policy of generated IAM role
CdkPipeline-DeploymentPipelineUpdatePipelineSelfMu-DC3BOF9ZJLNE(not modified in CDK app):{ "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:ap-southeast-2:111122223333:log-group:/aws/codebuild/CDKDeploymentPipeline-selfupdate", "arn:aws:logs:ap-southeast-2:111122223333:log-group:/aws/codebuild/CDKDeploymentPipeline-selfupdate:*" ], "Effect": "Allow" }, { "Action": [ "codebuild:CreateReportGroup", "codebuild:CreateReport", "codebuild:UpdateReport", "codebuild:BatchPutTestCases" ], "Resource": "arn:aws:codebuild:ap-southeast-2:111122223333:report-group/CDKDeploymentPipeline-selfupdate-*", "Effect": "Allow" }, { "Action": "sts:AssumeRole", "Resource": [ "arn:*:iam::*:role/*-deploy-role-*", "arn:*:iam::*:role/*-publishing-role-*" ], "Effect": "Allow" }, { "Action": "cloudformation:DescribeStacks", "Resource": "*", "Effect": "Allow" }, { "Action": "s3:ListBucket", "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*" ], "Resource": [ "arn:aws:s3:::cdkpipeline-deploymentpipelineartifactsbucketf7fe-abcd12341a7n9", "arn:aws:s3:::cdkpipeline-deploymentpipelineartifactsbucketf7fe-abcd12341a7n9/*" ], "Effect": "Allow" }, { "Action": [ "kms:Decrypt", "kms:DescribeKey" ], "Resource": "arn:aws:kms:ap-southeast-2:111122223333:key/abcd1234-e992-436c-b98d-4dbdea13b3df", "Effect": "Allow" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Resource": "arn:aws:kms:ap-southeast-2:111122223333:key/abcd1234-e992-436c-b98d-4dbdea13b3df", "Effect": "Allow" } ] }Environment
Other
This is 🐛 Bug Report
The text was updated successfully, but these errors were encountered: