codepipeline: x-account AND x-region deployments are missing stack dependencies
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
A cross-region AND cross-account deployment where CodePipeline generates the support stacks for replication buckets and the support stacks for cross-account roles (which is the ideal situation), fails to deploy out of the box.
The cross-account and cross-region resources are created in separate stacks that don't have a dependency between them, but the resources on those stacks have bidirectional dependencies on each other:
* The Bucket and Key policies reference the Action Role
* The Role policy references the Bucket and Key (and deployment resources like CodeDeploy Deployment Groups)
Normally this wouldn't deploy, but we generate hard-coded resource names for the resources involved so that we can formulate policies anyway without having to have bidirectional cross-stack references.
-------------
The only order in which this deployment works is if we deploy the account stack (with the Role) *before* the replication stack (with the Bucket and Key), but there is no dependency between these stacks, so a naive `cdk deploy` may pick the wrong order and fail to deploy properly.
---------
This is a tricky area to work in, as people may have built all kinds of elaborate constructions of stacks and resources and referenced resources, and anything that adds more dependencies is at risk of producing a cyclic dependency.
We are piloting a patchy fix right now for ECS CodeDeploy, which should be copied to all deployment actions if successful.
### Expected Behavior
A `cdk deploy` should deploy in the right order.
### Current Behavior
The replication bucket stack deploys before the role stack, causing a deployment failure.
### Related issues
* Pilot PR: https://github.com/aws/aws-cdk/pull/24053
* Suggesting a thorough revamp of this mess: https://github.com/aws/aws-cdk/issues/24051
Contributor guide
Research direction
Start by reviewing the ECS CodeDeploy pilot in PR #24053 and the related redesign discussion in issue #24051, then trace how CodePipeline creates the replication and cross-account role stacks. Done means a cross-account, cross-region cdk deploy consistently deploys the role stack before the replication stack without introducing cyclic dependencies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100