cli: --profile flag has weird behavior on diff
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
I have a CDK stack that creates an EKS cluster in typescript. It uses a build script to do the cdk synth and a deploy script to do the cdk deployment passing in --profile flag to specify the account and then, for the deploy script, gets the kubeconfig and runs some additional steps after. To adjust for the change that removed the default master role (which was used in the kubeconfig), I am now looking up the current user (using the sdk get-caller-identity) and adding them to the aws-auth config. This all works fine, however, I have noticed that when I run `cdk diff --profile ` after the build script, I do not get the correct user. It instead gets my default profile user. If I set AWS_PROFILE before cdk diff instead of using the profile flag, I get the correct user.
What makes this more confusing is that the diff still seems to be generated against the correct account. I don't understand how part of the script would not use the credentials.
### Expected Behavior
Using the --profile flag with cdk diff, should get the correct user.
### Current Behavior
`Cdk diff --profile ` seems to not set credentials for code run in the script.
### Reproduction Steps
1. Generate a cdk script that uses current user information.
2. Build & deploy it to non default account using ---profile flag
3. Make some change
4. Build
5. Check diff using cdk diff --profile
### Possible Solution
_No response_
### Additional Information/Context
Log Output from build/deploy:
current user: {
'$metadata': {
httpStatusCode: 200,
requestId: 'ba49b24d-e8b0-45fa-ad0a-78a996fd8fe7',
extendedRequestId: undefined,
cfId: undefined,
attempts: 1,
totalRetryDelay: 0
},
UserId: 'AIDAI74##########K',
Account: '2733#######',
Arn: 'arn:aws:iam::2733#######:user/wes'
}
Diff output:
current user: {
'$metadata': {
httpStatusCode: 200,
requestId: '7c8a0cfd-d2ae-4a6b-baa7-5525ac9a4532',
extendedRequestId: undefined,
cfId: undefined,
attempts: 1,
totalRetryDelay: 0
},
UserId: 'AIDAJ#########',
Account: '557#######',
Arn: 'arn:aws:iam::5577#########:user/wes'
}
Stack testDummyInfrastructureStack
Resources
[~] Custom::AWSCDK-EKS-KubernetesResource DummyCluster/Cluster/AwsAuth/manifest/Resource DummyClusterAwsAuthmanifest9215E465
└─ [~] Manifest
└─ [~] .Fn::Join:
└─ @@ -29,6 +29,6 @@
[ ] "Arn"
[ ] ]
[ ] },
[-] "\\\",\\\"username\\\":\\\"system:node:{{EC2PrivateDNSName}}\\\",\\\"groups\\\":[\\\"system:bootstrappers\\\",\\\"system:nodes\\\"]}]\",\"mapUsers\":\"[{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/mike\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/mike\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/michael\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/michael\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::273363790070:user/wes\\\",\\\"username\\\":\\\"arn:aws:iam::273363790070:user/wes\\\",\\\"groups\\\":[\\\"system:masters\\\"]}]\",\"mapAccounts\":\"[\\\"5577#############\\\"]\"}}]"
[+] "\\\",\\\"username\\\":\\\"system:node:{{EC2PrivateDNSName}}\\\",\\\"groups\\\":[\\\"system:bootstrappers\\\",\\\"system:nodes\\\"]}]\",\"mapUsers\":\"[{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/mike\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/mike\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/michael\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/michael\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"userarn\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"username\\\":\\\"arn:aws:iam::5577#############:user/wes\\\",\\\"groups\\\":[\\\"system:masters\\\"]}]\",\"mapAccounts\":\"[\\\"5577#############\\\"]\"}}]"
### CDK CLI Version
2.92.0
### Framework Version
_No response_
### Node.js Version
v18.7.1
### OS
macOS ventura 13.4
### Language
Typescript
### Language Version
4.9.4
### Other information
_No response_
Contributor guide
Research direction
Start by reproducing the reported `cdk diff --profile ` behavior with the TypeScript stack and compare it with the same command using `AWS_PROFILE`. Trace the CLI profile handling and the current-user lookup used by the stack. Done means both the diff target and code run during diff use the selected profile consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cli, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100