aws / aws/aws-cdk

(aws-codepipeline): usePipelineRoleForActions: true causes circular dependency error during deployment

Open
#34,522 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-codepipeline bug p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When setting the `usePipelineRoleForActions: true` property on the AWS CodePipeline L2 construct, deployment fails with a circular dependency error. This issue occurs despite a successful `cdk synth`.
> ValidationError: Circular dependency between resources: [PipelineRoleDefaultPolicyC7A05455, PipelineC660917D]

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

The pipeline should deploy successfully and actions should use the pipeline's IAM role.

### Current Behavior

Deployment fails with the following error:
`ValidationError: Circular dependency between resources: [PipelineRoleDefaultPolicyC7A05455, PipelineC660917D]`

### Reproduction Steps

```
const pipeline = new codepipeline.Pipeline(this, 'Pipeline', {
usePipelineRoleForActions: true,
});

const sourceStage = pipeline.addStage({ stageName: 'Source' });
const buildStage = pipeline.addStage({ stageName: 'Build' });

const sourceOutput = new codepipeline.Artifact();

sourceStage.addAction(
new codepipeline_actions.CodeStarConnectionsSourceAction({
owner: `some-owner`,
repo: `some-repo-name`,
triggerOnPush: true,
connectionArn: 'arn:aws:codestar-connections:ap-southeast-2:123456789012:connection/12345678-abcd-12ab-34cdef5678gh',
actionName: `some-repo-name_Source`,
output: sourceOutput,
branch: 'master',
}));

buildStage.addAction(new codepipeline_actions.CommandsAction({
actionName: 'Commands',
input: sourceOutput,
commands: [
'export MY_OUTPUT=my-key',
],
}));
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.197.0

### AWS CDK CLI version

2.1016.1

### Node.js Version

v20.12.2

### OS

Ubuntu-22.04

### Language

TypeScript

### Language Version

_No response_

### Other information

It appears that enabling `usePipelineRoleForActions` causes a dependency loop between the pipeline role's policy and the pipeline itself.

Contributor guide

Open the contributing guide

Research direction

Start at the AWS CodePipeline L2 construct and reproduce the supplied TypeScript configuration with usePipelineRoleForActions enabled. Compare the successful synthesized template with the deployment failure involving PipelineRoleDefaultPolicyC7A05455 and PipelineC660917D. Done means the example deploys successfully and actions use the pipeline IAM role without a circular dependency.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.