aws / aws/aws-cdk

(CLI): Identify resource names/Arns with hard-coded partition values

Open
#28,474 1 comment 1 reaction 0 assignees View on GitHub
cli effort/medium feature-request p2 package/tools
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

When performing a `cdk synth`, pass a flag such as `--partition-awareness=require|warn` to ensure all resource names in synthesized templates utilize the [AWS::Partition pseudo parameter](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html#cfn-pseudo-param-partition) rather than a value such as `arn:aws:...` or `arn:aws-us-gov:...`.

This is mainly a risk when non-Construct generated values are used within a [Resource Element](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html) for an IAM Policy Statement, or a user manually generates an Arn using a `.name` instead of referring to the `.arn` property

When the flag value is `require`, the synth command would fail and throw an error if a resource or resource policy element or !Ref has a hard coded AWS partition. When the value is `warn`, it would simply log a warning, but proceed (with synthesis/deployment).

### Use Case

It's frustrating when taking a CDK application built in one partition (e.g. aws with us-east-1) and refactoring it to be deployable it in a region in another partition. Some errors (service/feature availability) are only identifiable during deploy-time. Because non-partition aware resource names may result in errors and this can be identified during synthesis, I don't want to have to wait until a CloudFormation Prepare or a CloudFormation [IAM Resource] Create Event fails to identify where invalid resource names are used.

Consistently using the partition pseudo parameter is a good standard that should be an option to enforce during synthesis.

### Proposed Solution

I would imagine the feature could be implemented an Aspect, but that would require a user to be familiar with that module.

I think the presence of this flag should result in a scan of all `cdk.out/**/*.template` files to identify violations, and the `require|warn` value determines which exit code is returned from the synth command.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.110.1

### Environment details (OS name and version, etc.)

Mac M1 Ventura | AWS GovCloud West 1 Region

Contributor guide

Open the contributing guide

Research direction

Start at the cdk synth command and the generated cdk.out/**/*.template files mentioned in the issue; review how synth flags are parsed and how template output is scanned. Done means a partition-awareness=require|warn option identifies hard-coded AWS partition values, fails synthesis for require, and logs warnings while continuing for warn.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cli, cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.