aws / aws/aws-cdk

(amplify): Amplify SSR compute role is never set during deploy

Open
#34,992 2 comments 3 reactions 0 assignees View on GitHub
@aws-cdk/aws-amplify bug cause/not-a-bug p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Hi,

The Amplify SDK allows setting a `computeRole` on a new Amplify `App` thanks to https://github.com/aws/aws-cdk/pull/33962.

While the CloudFormation output includes `ComputeRoleArn`, running `cdk deploy` has no effect on the underlying compute role in Amplify

Image

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

The default compute role should be set:

Image

### Current Behavior

The default compute role is not set:

Image

### Reproduction Steps

Create a new stack with an Amplify app and a DynamoDB:

```typescript
import { AttributeType, TableClass, TableV2 } from "aws-cdk-lib/aws-dynamodb";
import { RemovalPolicy, SecretValue } from "aws-cdk-lib";
import {
Effect,
PolicyStatement,
Role,
ServicePrincipal,
ManagedPolicy,
} from "aws-cdk-lib/aws-iam";
import { App, Platform, GitHubSourceCodeProvider } from "@aws-cdk/aws-amplify-alpha";

const table = new TableV2(this, "DynamoDBTable", {
tableName: "MyTable",
partitionKey: { name: "PK", type: AttributeType.STRING },
tableClass: TableClass.STANDARD,
removalPolicy: RemovalPolicy.RETAIN,
});

const ddbRole = new Role(this, "DynamoDbRole", {
assumedBy: new ServicePrincipal("amplify.amazonaws.com"),
description: "IAM role to access a DynamoDB table",
});

ddbRole.addToPolicy(
new PolicyStatement({
effect: Effect.ALLOW,
actions: ["dynamodb:GetItem"],
resources: [table.tableArn],
})
);

const role = new Role(this, "AmplifyRoleWebApp", {
assumedBy: new ServicePrincipal("amplify.amazonaws.com"),
description: "Custom role permitting resources creation from Amplify",
managedPolicies: [
ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess"),
],
});

const sourceCodeProvider = new GitHubSourceCodeProvider({
oauthToken: SecretValue.unsafePlainText("my-token"),
owner: 'MyCompany',
repository: 'my-repo',
});

new App(this, "AmplifyConsumerBeyfortus", {
appName: "MyApp",
role,
sourceCodeProvider,
platform: Platform.WEB_COMPUTE,
computeRole: ddbRole,
});

```

### Possible Solution

The compute role should be applied to Amplify correctly.

### Additional Information/Context

Right now the only way to circumvent this issue is to create an `AwsCustomResource` that manually passes the `computeRoleArn`.

### AWS CDK Library version (aws-cdk-lib)

2.204.0

### AWS CDK CLI version

2.1020.2

### Node.js Version

22.13.1

### OS

macOS

### Language

TypeScript

### Language Version

_No response_

### Other information

@aws-cdk/aws-amplify-alpha: v2.204.0-alpha.0

Contributor guide

Open the contributing guide

Research direction

Start at the Amplify App construct entry point and trace how computeRole is handled after the synthesized CloudFormation includes ComputeRoleArn. Reproduce the example with cdk deploy and compare the generated template with the deployed Amplify configuration; done means the specified default compute role is applied without an AwsCustomResource.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.