(aws-cdk-lib): BootstraplessSynthesizer causing failed stack deployment out of the box
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
I'm aware that the behavior of this synthesizer [was discussed multiple times](https://github.com/aws/aws-cdk/search?q=BootstraplessSynthesizer&type=issues) in the past, but none of them mentioned that this synthesizer actually does not work: a stack won't be deployed out-of-the-box if it uses this synthesizer.
### Expected Behavior
A stack, that does not require a bootstrap stack, should be able to use `BootstraplessSynthesizer` synthesizer and be deployed successfully without an existence of a bootstrap stack.
### Current Behavior
A stack, that does not require a bootstrap stack, can't be deployed if it uses the `BootstraplessSynthesizer` synthesizer. It would fail with the error message as below:
```
❌ failed: Error [ValidationError]: Role arn:aws:iam:::role/cdk-hnb659fds-cfn-exec-role-- is invalid or cannot be assumed
```
### Reproduction Steps
The app endpoint:
```
#!/usr/bin/env node
import * as cdk from 'aws-cdk-lib';
import { CdkBootstraplessStack } from '../lib/cdk-bootstrapless-stack';
const app = new cdk.App();
new CdkBootstraplessStack(app, 'CdkBootstraplessStack', {
env: {
region: '',
account: ''
}
});
```
The stack:
```
❯ cat lib/cdk-bootstrapless-stack.ts
import { BootstraplessSynthesizer, Duration, Stack, StackProps } from 'aws-cdk-lib';
import * as sqs from 'aws-cdk-lib/aws-sqs';
import { Construct } from 'constructs';
export class CdkBootstraplessStack extends Stack {
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, {
...props,
synthesizer: new BootstraplessSynthesizer({}),
});
const queue = new sqs.Queue(this, 'CdkBootstraplessQueue', {
visibilityTimeout: Duration.seconds(300)
});
}
}
```
When running `cdk deploy CdkBootstraplessStack --debug -vvv`, I could see that the CLI passed the role ARN -- that's usually part of the CDKToolkit stack -- to the `createChangeSet` API. Of course this is going to fail because we never wanted to create the CDKToolkit stack with this synthesizer. Output snippet:
```
Call failed: createChangeSet({"StackName":"CdkBootstraplessStack","ChangeSetName":"cdk-deploy-change-set","ChangeSetType":"CREATE","Description":"CDK Changeset for execution eb39a5f8-20f1-4b65-bb40-94e61e6a38e4","TemplateBody":"Resources:\n CdkBootstraplessQueue6BB3DC8E:\n Type: AWS::SQS::Queue\n Properties:\n VisibilityTimeout: 300\n UpdateReplacePolicy: Delete\n DeletionPolicy: Delete\n Metadata:\n aws:cdk:path: CdkBootstraplessStack/CdkBootstraplessQueue/Resource\n CDKMetadata:\n Type: AWS::CDK::Metadata\n Properties:\n Analytics: v2:deflate64:H4sIAAAAAAAA/zPSMzLVM1BMLC/WTU7J1s3JTNKrDi5JTM7WAQrFFxcW61UHlqaWpuo4p+WBGbUgVlBqcX5pUTKQk5efkqqXVaxfZmimZ2iiZ6SYVZyZqVtUmleSmZuqFwShAeDNBIVlAAAA\n Metadata:\n aws:cdk:path: CdkBootstraplessStack/CDKMetadata/Default\n","Parameters":[],"RoleARN":"arn:aws:iam:::role/cdk-hnb659fds-cfn-exec-role--","Capabilities":["CAPABILITY_IAM","CAPABILITY_NAMED_IAM","CAPABILITY_AUTO_EXPAND"],"Tags":[]}) => Role arn:aws:iam:::role/cdk-hnb659fds-cfn-exec-role-- is invalid or cannot be assumed (code=ValidationError)
❌ CdkBootstraplessStack failed: Error [ValidationError]: Role arn:aws:iam:::role/cdk-hnb659fds-cfn-exec-role-- is invalid or cannot be assumed
...
code: 'ValidationError',
time: 2022-06-07T07:03:24.446Z,
requestId: '2efe5035-3c46-4222-9ca6-f04bc3f713a8',
statusCode: 400,
retryable: false,
retryDelay: 331.41807829813575
}
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.27.0 (build 8e89048)
### Framework Version
2.27.0
### Node.js Version
v16.14.2
### OS
Mac
### Language
Typescript
### Language Version
3.9.7
### Other information
_No response_
Contributor guide
Research direction
Start with the reproduction in lib/cdk-bootstrapless-stack.ts and the BootstraplessSynthesizer configuration, then run cdk deploy CdkBootstraplessStack --debug -vvv. Inspect the createChangeSet call and its RoleARN, as shown in the report. Done means a stack that does not require a bootstrap stack deploys successfully without an invalid CDKToolkit execution role.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100