aws / aws/aws-cdk-cli

(drift): cdk drift doesn't work with multi-account applications

Open
#734 1 comment 8 reactions 0 assignees View on GitHub
effort/medium feature-request p2
Dominant language
TypeScript
Stars
105
Forks
122
Avg merge
1d 17h
Merged PRs (30d)
71

Description

### Describe the bug

Hello 👋🏼

The `cdk drift` command can't be run against applications that deploy stacks across multiple AWS accounts.

We have a single CDK application where we define hundreds of stacks and deploy them across different AWS accounts from a centralised place. When we run `cdk deploy` or `cdk diff`, we use a single set of credentials, and the CDK automatically assumes `cdk-{qualifier}-*` roles within target accounts.

We want to use `cdk drift` the same way, without needing to manually assume roles ourselves.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

`cdk drift` first assumes a role in the target account, and only then runs drift detection

### Current Behavior

We receive the following error: `Need to perform AWS calls for account 111111111111, but the current credentials are for 222222222222`

### Reproduction Steps

1. Create an application that deploys stacks across multiple AWS accounts
2. Run `cdk drift`

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.186.0

### AWS CDK CLI version

2.1020.2

### Node.js Version

v22.14.0

### OS

MacOS 18

### Language

Python

### Language Version

3.12

### Other information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.