aws-amplify / aws-amplify/amplify-cli
authRole policies not overridden in CD
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
### Before opening, please confirm:
- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.
### How did you install the Amplify CLI?
npm
### If applicable, what version of Node.js are you using?
14.17.3
### Amplify CLI Version
7.6.24
### What operating system are you using?
Deployment OS
### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
This is my project override (in folder awscloudformation):
```typescript
import { AmplifyRootStackTemplate } from "@aws-amplify/cli-extensibility-helper";
export function override(resources: AmplifyRootStackTemplate) {
const authRole = resources.authRole;
const basePolicies = Array.isArray(authRole.policies)
? authRole.policies
: [authRole.policies];
authRole.policies = [
...basePolicies,
{
policyName: "amplify-permissions-custom-resources",
policyDocument: {
Version: "2012-10-17",
Statement: [
//? Route calculator
{
Resource: "arn:aws:geo:eu-central-1:*:*",
Action: ["geo:CalculateRoute*"],
Effect: "Allow",
},
],
},
},
];
}
```
### Amplify Categories
auth, custom
### Amplify Commands
push
### Describe the bug
When pushing the backend env using `amplify push` from my local machine, the override policies are correctly applied. When the CD pushes through `amplifyPush -s`, the policies are not applied. I must note that the override file is still read by the CD, as any console logs in the override file are printed to the screen.
### Expected behavior
CD should apply the policies to authRole, as does the local `amplify push` command.
### Reproduction steps
1. amplify override project
2. Add code that I have written above
3. Push to CD with the following build options:
```yaml
version: 1
backend:
phases:
build:
commands:
- amplifyPush -s
frontend:
phases:
preBuild:
commands:
- npm ci
build:
commands:
- REACT_APP_ENV=$USER_BRANCH npm run build
artifacts:
baseDirectory: build
files:
- '**/*'
cache:
paths:
- node_modules/**/*
```
4. Check if the policies have been applied to the role
### GraphQL schema(s)
_No response_
### Log output
_No response_
### Additional information
_No response_
Contributor guide
Research direction
Start by comparing how the awscloudformation override is handled by local amplify push versus the amplifyPush -s command in the provided reproduction. Verify the authRole policies after each push; done means the custom policy is applied consistently in CD as it is locally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- authentication, cli, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100