(aws-codepipeline): usePipelineRoleForActions: true causes circular dependency error during deployment
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
When setting the `usePipelineRoleForActions: true` property on the AWS CodePipeline L2 construct, deployment fails with a circular dependency error. This issue occurs despite a successful `cdk synth`.
> ValidationError: Circular dependency between resources: [PipelineRoleDefaultPolicyC7A05455, PipelineC660917D]
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
_No response_
### Expected Behavior
The pipeline should deploy successfully and actions should use the pipeline's IAM role.
### Current Behavior
Deployment fails with the following error:
`ValidationError: Circular dependency between resources: [PipelineRoleDefaultPolicyC7A05455, PipelineC660917D]`
### Reproduction Steps
```
const pipeline = new codepipeline.Pipeline(this, 'Pipeline', {
usePipelineRoleForActions: true,
});
const sourceStage = pipeline.addStage({ stageName: 'Source' });
const buildStage = pipeline.addStage({ stageName: 'Build' });
const sourceOutput = new codepipeline.Artifact();
sourceStage.addAction(
new codepipeline_actions.CodeStarConnectionsSourceAction({
owner: `some-owner`,
repo: `some-repo-name`,
triggerOnPush: true,
connectionArn: 'arn:aws:codestar-connections:ap-southeast-2:123456789012:connection/12345678-abcd-12ab-34cdef5678gh',
actionName: `some-repo-name_Source`,
output: sourceOutput,
branch: 'master',
}));
buildStage.addAction(new codepipeline_actions.CommandsAction({
actionName: 'Commands',
input: sourceOutput,
commands: [
'export MY_OUTPUT=my-key',
],
}));
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
2.197.0
### AWS CDK CLI version
2.1016.1
### Node.js Version
v20.12.2
### OS
Ubuntu-22.04
### Language
TypeScript
### Language Version
_No response_
### Other information
It appears that enabling `usePipelineRoleForActions` causes a dependency loop between the pipeline role's policy and the pipeline itself.
Contributor guide
Research direction
Start at the AWS CodePipeline L2 construct and reproduce the supplied TypeScript configuration with usePipelineRoleForActions enabled. Compare the successful synthesized template with the deployment failure involving PipelineRoleDefaultPolicyC7A05455 and PipelineC660917D. Done means the example deploys successfully and actions use the pipeline IAM role without a circular dependency.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100