aws / aws/aws-cdk

(cli): Detect when attempting to bootstrap with older bootstrap version

Open
#23,739 2 comments 0 reactions 0 assignees View on GitHub
effort/small feature-request p2 package/tools
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Hi, we're encountering a weird issue ever since upgrading to v.2.60.0. We think that [this change](https://github.com/aws/aws-cdk/pull/22792) in v.2.54.0 started the cause.

Given an account bootstrapped using CDK toolkit v2.54.0+, developers using a CDK toolkit version older than v2.54.0 will create a change set for the toolkit stack and will try to update the toolkit stack (essentially trying to downgrade the toolkit stack)

This creation of change sets leads to change sets conflict when developers / CI are running bootstrap in parallel.

Sample error message when developers/builds run in parallel:
```
sit-toolkit: creating CloudFormation changeset...

[2023-01-18T19:27:49.575Z] ��� Environment aws://REDACTED/eu-north-1 failed bootstrapping: AlreadyExistsException: ChangeSet cdk-deploy-change-set cannot be created due to a mismatch with existing attribute ClientToken
```

### Expected Behavior

Developers running `cdk bootstrap` without a `--force` option and using a CDK toolkit version older than the CDK toolkit version used to bootstrap the account should receive a warning:
```
Not downgrading existing bootstrap stack from version 'X+n' to version 'X'
```
And not proceed to creating a change set and updating the toolkit stack.

### Current Behavior

There is no warning and developers using an older CDK toolkit version are able to create a change set and try to update the deployed toolkit stack.
This leaves the deployed CDK toolkit stack in a constant flux of upgrading and downgrading and creating change sets when some developers are using v.2.54.0+ and some developers are using older versions than v.2.54.0

### Reproduction Steps

1. Install a CDK toolkit newer or equal to v2.54.0: `npm -g aws-cdk@2.54.0`
2. Bootstrap an account: `cdk bootstrap --toolkit-stack-name test-toolkit`
3. Check the deployed toolkit stack in CloudFormation
4. Note the new `UseExamplePermissionsBoundary` Parameter
5. Install a CDK toolkit older than v2.54.0: `npm -g aws-cdk@2.53.0`
6. Bootstrap the same account: `cdk bootstrap --toolkit-stack-name test-toolkit`
7. A changeset is still created without showing any warning:
```
Not downgrading existing bootstrap stack from version 'X+n' to version 'X'
```

The issue shows where there happen to be two developers doing steps 5-8 in parallel

### Possible Solution

- Increment the `CdkBootstrapVersion` SSM Parameter value in the [packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml#L584) (?)
- OR enable developers to provide a change set name during bootstrap

### Additional Information/Context

_No response_

### CDK CLI Version

2.54.0

### Framework Version

_No response_

### Node.js Version

v16.16.0

### OS

macOS Monterey

### Language

Java

### Language Version

Java 11

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml and reproduce the behavior using toolkit versions 2.54.0 and 2.53.0 against the same toolkit stack. Trace how bootstrap handles an existing newer stack, then verify that an older toolkit warns with the requested message and does not create or update a change set without --force.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cli, cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.