aws / aws/aws-cdk

aws-glue-alpha: Creating database uses account id at synthesis time

Open
#32,720 4 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-glue bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

I am using CDK (via the aws-cdk.aws-glue-alpha python package) to publish a template that users will run. In that template I'm instantiating a `aws_glue_alpha.Database` instance. When I use CDK to synthesize the template the account id ends up hard-coded in the synthesized template. I'm relatively sure that this comes from the `cdk.Stack.of(this).account` here: https://github.com/aws/aws-cdk/blob/2d1e71823e6e6fda7e05db0b34458ae61b432633/packages/%40aws-cdk/aws-glue-alpha/lib/connection.ts#L206

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

none

### Expected Behavior

Instead I expect the catalog to be created under the user that has created the CDK stack (_not_ the user that published the template)

### Current Behavior

Since the catalog is created that references the wrong AWS account I get an error like:
> Resource handler returned message: "User: arn:aws:iam::550533133XYZ:root is not authorized to perform: glue:CreateDatabase on resource: arn:aws:glue:us-west-2:692859912XYZ:catalog because no resource-based policy allows the glue:CreateDatabase action (Service: Glue, Status Code: 400, Request ID: deae901b-79c4-4f19-843e-4a40b30ebed5)" (RequestToken: 08d0eab1-4651-0c55-d8c9-3aa6c38a87cb, HandlerErrorCode: AccessDenied)

I've tested that `Aws.ACCOUNT_ID` should resolve the error by dropping down to the level 1 construct `CfnDatabase`. If instantiate that with `catalog_id=aws_cdk.Stack.of(self).account` then I get the error, but if I instantiate it with `catalog_id=Aws.ACCOUNT_ID` then the when I deploy the published stack I get a new catalog which is what I want.

### Reproduction Steps

Here's the python CDK stack:

```
from aws_cdk import (
aws_glue,
aws_glue_alpha,
)

class FakeStack(aws_cdk.NestedStack):
"""Fake stack to reproduce the error quicker"""

construct_id: str

def __init__(
self,
scope: constructs.Construct,
construct_id: str,
**kwargs,
) -> None:
self.construct_id = construct_id

super().__init__(
scope,
construct_id,
description=f"{construct_id} nested fake pipeline stack",
**kwargs,
)

# This bakes in the publishing accont id
aws_glue_alpha.Database(
self,
f"{self.construct_id}-database",
database_name=f"{self.construct_id}-nested-database".replace("-", "_"),
)

# This uses the deploying account id
# aws_glue.CfnDatabase(
# self,
# f"{self.construct_id}-database2",
# # unless we use this
# # catalog_id=aws_cdk.Stack.of(self).account,
# catalog_id=Aws.ACCOUNT_ID,
# database_input=aws_glue.CfnDatabase.DatabaseInputProperty(
# name=f"{self.construct_id}-nested-database".replace("-", "_")
# ),
# )

if __name__ == "__main__":
app = aws_cdk.App()

FakeStack(app)

app.synth()
```

It can be used with:
```
cdk synth
cdk-assets publish
```
Then, when logged in as a *separate* account, use the generated template to create a new stack via the CloudFormation UI (or with `aws cloudformation create-stack` and passing in the template)

### Possible Solution

I think instead that the account for the catalog should be referenced via `Aws.ACCOUNT_ID`

### Additional Information/Context

_No response_

### CDK CLI Version

2.146.0 (build b368c78) (but I've tested v2.172.0 also)

### Framework Version

_No response_

### Node.js Version

v22.12.0

### OS

GitHub actions ubuntu-latest (but also reproduced on macOS 15.1.1)

### Language

Python

### Language Version

Python (3.1.2)

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with packages/@aws-cdk/aws-glue-alpha/lib/connection.ts at the account lookup around line 206, then run the provided Python reproduction with cdk synth. Confirm the synthesized template does not hard-code the publishing account and that a separately deployed template creates the Glue catalog in the deploying account.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, typescript
Domain
cloud, databases, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.