aws-amplify / aws-amplify/amplify-cli

authRole policies not overridden in CD

Open
#10,011 4 comments 3 reactions 0 assignees View on GitHub
bug extensibility p2
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### Before opening, please confirm:

- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

14.17.3

### Amplify CLI Version

7.6.24

### What operating system are you using?

Deployment OS

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

This is my project override (in folder awscloudformation):
```typescript
import { AmplifyRootStackTemplate } from "@aws-amplify/cli-extensibility-helper";

export function override(resources: AmplifyRootStackTemplate) {
const authRole = resources.authRole;

const basePolicies = Array.isArray(authRole.policies)
? authRole.policies
: [authRole.policies];

authRole.policies = [
...basePolicies,
{
policyName: "amplify-permissions-custom-resources",
policyDocument: {
Version: "2012-10-17",
Statement: [
//? Route calculator
{
Resource: "arn:aws:geo:eu-central-1:*:*",
Action: ["geo:CalculateRoute*"],
Effect: "Allow",
},
],
},
},
];
}

```

### Amplify Categories

auth, custom

### Amplify Commands

push

### Describe the bug

When pushing the backend env using `amplify push` from my local machine, the override policies are correctly applied. When the CD pushes through `amplifyPush -s`, the policies are not applied. I must note that the override file is still read by the CD, as any console logs in the override file are printed to the screen.

### Expected behavior

CD should apply the policies to authRole, as does the local `amplify push` command.

### Reproduction steps

1. amplify override project
2. Add code that I have written above
3. Push to CD with the following build options:
```yaml
version: 1
backend:
phases:
build:
commands:
- amplifyPush -s
frontend:
phases:
preBuild:
commands:
- npm ci
build:
commands:
- REACT_APP_ENV=$USER_BRANCH npm run build
artifacts:
baseDirectory: build
files:
- '**/*'
cache:
paths:
- node_modules/**/*
```
4. Check if the policies have been applied to the role

### GraphQL schema(s)

_No response_

### Log output

_No response_

### Additional information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by comparing how the awscloudformation override is handled by local amplify push versus the amplifyPush -s command in the provided reproduction. Verify the authRole policies after each push; done means the custom policy is applied consistently in CD as it is locally.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.