aws-glue-alpha: Creating database uses account id at synthesis time
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
I am using CDK (via the aws-cdk.aws-glue-alpha python package) to publish a template that users will run. In that template I'm instantiating a `aws_glue_alpha.Database` instance. When I use CDK to synthesize the template the account id ends up hard-coded in the synthesized template. I'm relatively sure that this comes from the `cdk.Stack.of(this).account` here: https://github.com/aws/aws-cdk/blob/2d1e71823e6e6fda7e05db0b34458ae61b432633/packages/%40aws-cdk/aws-glue-alpha/lib/connection.ts#L206
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Version
none
### Expected Behavior
Instead I expect the catalog to be created under the user that has created the CDK stack (_not_ the user that published the template)
### Current Behavior
Since the catalog is created that references the wrong AWS account I get an error like:
> Resource handler returned message: "User: arn:aws:iam::550533133XYZ:root is not authorized to perform: glue:CreateDatabase on resource: arn:aws:glue:us-west-2:692859912XYZ:catalog because no resource-based policy allows the glue:CreateDatabase action (Service: Glue, Status Code: 400, Request ID: deae901b-79c4-4f19-843e-4a40b30ebed5)" (RequestToken: 08d0eab1-4651-0c55-d8c9-3aa6c38a87cb, HandlerErrorCode: AccessDenied)
I've tested that `Aws.ACCOUNT_ID` should resolve the error by dropping down to the level 1 construct `CfnDatabase`. If instantiate that with `catalog_id=aws_cdk.Stack.of(self).account` then I get the error, but if I instantiate it with `catalog_id=Aws.ACCOUNT_ID` then the when I deploy the published stack I get a new catalog which is what I want.
### Reproduction Steps
Here's the python CDK stack:
```
from aws_cdk import (
aws_glue,
aws_glue_alpha,
)
class FakeStack(aws_cdk.NestedStack):
"""Fake stack to reproduce the error quicker"""
construct_id: str
def __init__(
self,
scope: constructs.Construct,
construct_id: str,
**kwargs,
) -> None:
self.construct_id = construct_id
super().__init__(
scope,
construct_id,
description=f"{construct_id} nested fake pipeline stack",
**kwargs,
)
# This bakes in the publishing accont id
aws_glue_alpha.Database(
self,
f"{self.construct_id}-database",
database_name=f"{self.construct_id}-nested-database".replace("-", "_"),
)
# This uses the deploying account id
# aws_glue.CfnDatabase(
# self,
# f"{self.construct_id}-database2",
# # unless we use this
# # catalog_id=aws_cdk.Stack.of(self).account,
# catalog_id=Aws.ACCOUNT_ID,
# database_input=aws_glue.CfnDatabase.DatabaseInputProperty(
# name=f"{self.construct_id}-nested-database".replace("-", "_")
# ),
# )
if __name__ == "__main__":
app = aws_cdk.App()
FakeStack(app)
app.synth()
```
It can be used with:
```
cdk synth
cdk-assets publish
```
Then, when logged in as a *separate* account, use the generated template to create a new stack via the CloudFormation UI (or with `aws cloudformation create-stack` and passing in the template)
### Possible Solution
I think instead that the account for the catalog should be referenced via `Aws.ACCOUNT_ID`
### Additional Information/Context
_No response_
### CDK CLI Version
2.146.0 (build b368c78) (but I've tested v2.172.0 also)
### Framework Version
_No response_
### Node.js Version
v22.12.0
### OS
GitHub actions ubuntu-latest (but also reproduced on macOS 15.1.1)
### Language
Python
### Language Version
Python (3.1.2)
### Other information
_No response_
Contributor guide
Research direction
Start with packages/@aws-cdk/aws-glue-alpha/lib/connection.ts at the account lookup around line 206, then run the provided Python reproduction with cdk synth. Confirm the synthesized template does not hard-code the publishing account and that a separately deployed template creates the Glue catalog in the deploying account.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python, typescript
- Domain
- cloud, databases, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100