aws / aws/aws-cdk

cli: --profile flag has weird behavior on diff

Open
#26,812 9 comments 0 reactions 0 assignees View on GitHub
bug cli effort/medium p2 package/tools
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

I have a CDK stack that creates an EKS cluster in typescript. It uses a build script to do the cdk synth and a deploy script to do the cdk deployment passing in --profile flag to specify the account and then, for the deploy script, gets the kubeconfig and runs some additional steps after. To adjust for the change that removed the default master role (which was used in the kubeconfig), I am now looking up the current user (using the sdk get-caller-identity) and adding them to the aws-auth config. This all works fine, however, I have noticed that when I run `cdk diff --profile ` after the build script, I do not get the correct user. It instead gets my default profile user. If I set AWS_PROFILE before cdk diff instead of using the profile flag, I get the correct user.

What makes this more confusing is that the diff still seems to be generated against the correct account. I don't understand how part of the script would not use the credentials.

### Expected Behavior

Using the --profile flag with cdk diff, should get the correct user.

### Current Behavior

`Cdk diff --profile ` seems to not set credentials for code run in the script.

### Reproduction Steps

1. Generate a cdk script that uses current user information.
2. Build & deploy it to non default account using ---profile flag
3. Make some change
4. Build
5. Check diff using cdk diff --profile

### Possible Solution

_No response_

### Additional Information/Context

Log Output from build/deploy:

current user: {
'$metadata': {
httpStatusCode: 200,
requestId: 'ba49b24d-e8b0-45fa-ad0a-78a996fd8fe7',
extendedRequestId: undefined,
cfId: undefined,
attempts: 1,
totalRetryDelay: 0
},
UserId: 'AIDAI74##########K',
Account: '2733#######',
Arn: 'arn:aws:iam::2733#######:user/wes'
}

Diff output:

current user: {
'$metadata': {
httpStatusCode: 200,
requestId: '7c8a0cfd-d2ae-4a6b-baa7-5525ac9a4532',
extendedRequestId: undefined,
cfId: undefined,
attempts: 1,
totalRetryDelay: 0
},
UserId: 'AIDAJ#########',
Account: '557#######',
Arn: 'arn:aws:iam::5577#########:user/wes'
}

Stack testDummyInfrastructureStack
Resources
[~] Custom::AWSCDK-EKS-KubernetesResource DummyCluster/Cluster/AwsAuth/manifest/Resource DummyClusterAwsAuthmanifest9215E465
└─ [~] Manifest
└─ [~] .Fn::Join:
└─ @@ -29,6 +29,6 @@
[ ] "Arn"
[ ] ]
[ ] },
[-] "\\\",\\\"username\\\":\\\"system:node:{{EC2PrivateDNSName}}\\\",\\\"groups\\\":[\\\"system:bootstrappers\\\",\\\"system:nodes\\\"]}]\",\"mapUsers\":\"[{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/mike\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/mike\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/michael\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/michael\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::273363790070:user/wes\\\",\\\"username\\\":\\\"arn:aws:iam::273363790070:user/wes\\\",\\\"groups\\\":[\\\"system:masters\\\"]}]\",\"mapAccounts\":\"[\\\"5577#############\\\"]\"}}]"
[+] "\\\",\\\"username\\\":\\\"system:node:{{EC2PrivateDNSName}}\\\",\\\"groups\\\":[\\\"system:bootstrappers\\\",\\\"system:nodes\\\"]}]\",\"mapUsers\":\"[{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/mike\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/mike\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/michael\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/michael\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"groups\\\":[\\\"system:masters\\\"]}]\",\"mapAccounts\":\"[\\\"5577#############\\\"]\"}}]"

### CDK CLI Version

2.92.0

### Framework Version

_No response_

### Node.js Version

v18.7.1

### OS

macOS ventura 13.4

### Language

Typescript

### Language Version

4.9.4

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported `cdk diff --profile ` behavior with the TypeScript stack and compare it with the same command using `AWS_PROFILE`. Trace the CLI profile handling and the current-user lookup used by the stack. Done means both the diff target and code run during diff use the selected profile consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.