(CLI): Identify resource names/Arns with hard-coded partition values
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
When performing a `cdk synth`, pass a flag such as `--partition-awareness=require|warn` to ensure all resource names in synthesized templates utilize the [AWS::Partition pseudo parameter](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html#cfn-pseudo-param-partition) rather than a value such as `arn:aws:...` or `arn:aws-us-gov:...`.
This is mainly a risk when non-Construct generated values are used within a [Resource Element](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html) for an IAM Policy Statement, or a user manually generates an Arn using a `.name` instead of referring to the `.arn` property
When the flag value is `require`, the synth command would fail and throw an error if a resource or resource policy element or !Ref has a hard coded AWS partition. When the value is `warn`, it would simply log a warning, but proceed (with synthesis/deployment).
### Use Case
It's frustrating when taking a CDK application built in one partition (e.g. aws with us-east-1) and refactoring it to be deployable it in a region in another partition. Some errors (service/feature availability) are only identifiable during deploy-time. Because non-partition aware resource names may result in errors and this can be identified during synthesis, I don't want to have to wait until a CloudFormation Prepare or a CloudFormation [IAM Resource] Create Event fails to identify where invalid resource names are used.
Consistently using the partition pseudo parameter is a good standard that should be an option to enforce during synthesis.
### Proposed Solution
I would imagine the feature could be implemented an Aspect, but that would require a user to be familiar with that module.
I think the presence of this flag should result in a scan of all `cdk.out/**/*.template` files to identify violations, and the `require|warn` value determines which exit code is returned from the synth command.
### Other Information
_No response_
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.110.1
### Environment details (OS name and version, etc.)
Mac M1 Ventura | AWS GovCloud West 1 Region
Contributor guide
Research direction
Start at the cdk synth command and the generated cdk.out/**/*.template files mentioned in the issue; review how synth flags are parsed and how template output is scanned. Done means a partition-awareness=require|warn option identifies hard-coded AWS partition values, fails synthesis for require, and logs warnings while continuing for warn.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cli, cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100