(amplify): Amplify SSR compute role is never set during deploy
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Hi,
The Amplify SDK allows setting a `computeRole` on a new Amplify `App` thanks to https://github.com/aws/aws-cdk/pull/33962.
While the CloudFormation output includes `ComputeRoleArn`, running `cdk deploy` has no effect on the underlying compute role in Amplify
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
_No response_
### Expected Behavior
The default compute role should be set:
### Current Behavior
The default compute role is not set:
### Reproduction Steps
Create a new stack with an Amplify app and a DynamoDB:
```typescript
import { AttributeType, TableClass, TableV2 } from "aws-cdk-lib/aws-dynamodb";
import { RemovalPolicy, SecretValue } from "aws-cdk-lib";
import {
Effect,
PolicyStatement,
Role,
ServicePrincipal,
ManagedPolicy,
} from "aws-cdk-lib/aws-iam";
import { App, Platform, GitHubSourceCodeProvider } from "@aws-cdk/aws-amplify-alpha";
const table = new TableV2(this, "DynamoDBTable", {
tableName: "MyTable",
partitionKey: { name: "PK", type: AttributeType.STRING },
tableClass: TableClass.STANDARD,
removalPolicy: RemovalPolicy.RETAIN,
});
const ddbRole = new Role(this, "DynamoDbRole", {
assumedBy: new ServicePrincipal("amplify.amazonaws.com"),
description: "IAM role to access a DynamoDB table",
});
ddbRole.addToPolicy(
new PolicyStatement({
effect: Effect.ALLOW,
actions: ["dynamodb:GetItem"],
resources: [table.tableArn],
})
);
const role = new Role(this, "AmplifyRoleWebApp", {
assumedBy: new ServicePrincipal("amplify.amazonaws.com"),
description: "Custom role permitting resources creation from Amplify",
managedPolicies: [
ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess"),
],
});
const sourceCodeProvider = new GitHubSourceCodeProvider({
oauthToken: SecretValue.unsafePlainText("my-token"),
owner: 'MyCompany',
repository: 'my-repo',
});
new App(this, "AmplifyConsumerBeyfortus", {
appName: "MyApp",
role,
sourceCodeProvider,
platform: Platform.WEB_COMPUTE,
computeRole: ddbRole,
});
```
### Possible Solution
The compute role should be applied to Amplify correctly.
### Additional Information/Context
Right now the only way to circumvent this issue is to create an `AwsCustomResource` that manually passes the `computeRoleArn`.
### AWS CDK Library version (aws-cdk-lib)
2.204.0
### AWS CDK CLI version
2.1020.2
### Node.js Version
22.13.1
### OS
macOS
### Language
TypeScript
### Language Version
_No response_
### Other information
@aws-cdk/aws-amplify-alpha: v2.204.0-alpha.0
Contributor guide
Research direction
Start at the Amplify App construct entry point and trace how computeRole is handled after the synthesized CloudFormation includes ComputeRoleArn. Reproduce the example with cdk deploy and compare the generated template with the deployed Amplify configuration; done means the specified default compute role is applied without an AwsCustomResource.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100