aws / aws/aws-cdk

(cdk): (cdk deploy fails when DefaultSynthesizer is customised with a fileAssetsBucketName with a different region)

Open
#35,670 7 comments 0 reactions 0 assignees View on GitHub
bug effort/medium p1 package/tools
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

We unfortunately have a company policy that disallows any creations of s3 buckets and ecr repositories outside of EU. This meant that we were unable to deploy WAF infront of CloudFront using aws-cdk as that requires bootstrapping in us-east-1. As a workaround I tried to create a simple stack (I ran `cdk init --language typescript`) and then added a custom DefaultStackSynthesizer where I hardcoded our approved bootstrap region `eu-north-1` and then set env.region as `us-east-1` but this causes the deploy to fail because the resolution of the url for where to store assets etc. does not take cross-region buckets into consideration:
`fail: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.`.

The unfortunate consequences of this has been that my company is now considering SST v3 as our IaC.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

I expect cdk deploy to be able to use a bootstrap s3 bucket from a different region as long as the credentials are valid.

### Current Behavior

fail: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.

### Reproduction Steps

`cdk init --language typescript`

Then use the following DefaultStackSynthesizer:
```
new CrossRegionCdkWoBootstrapStack(app, 'CrossRegionCdkWoBootstrapStack', {
synthesizer: new cdk.DefaultStackSynthesizer({
// Name of the S3 bucket for file assets
fileAssetsBucketName: 'cdk-${Qualifier}-assets-${AWS::AccountId}-eu-north-1',
bucketPrefix: '',

// Name of the ECR repository for Docker image assets
imageAssetsRepositoryName: 'cdk-${Qualifier}-container-assets-${AWS::AccountId}-eu-north-1',
dockerTagPrefix: '',

// ARN of the role assumed by the CLI and Pipeline to deploy here
deployRoleArn: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-${Qualifier}-deploy-role-${AWS::AccountId}-eu-north-1',
deployRoleExternalId: '',

// ARN of the role used for file asset publishing (assumed from the CLI role)
fileAssetPublishingRoleArn: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-${Qualifier}-file-publishing-role-${AWS::AccountId}-eu-north-1',
fileAssetPublishingExternalId: '',

// ARN of the role used for Docker asset publishing (assumed from the CLI role)
imageAssetPublishingRoleArn: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-${Qualifier}-image-publishing-role-${AWS::AccountId}-eu-north-1',
imageAssetPublishingExternalId: '',

// ARN of the role passed to CloudFormation to execute the deployments
cloudFormationExecutionRole: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-${Qualifier}-cfn-exec-role-${AWS::AccountId}-eu-north-1',

// ARN of the role used to look up context information in an environment
lookupRoleArn: 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-${Qualifier}-lookup-role-${AWS::AccountId}-eu-north-1',
lookupRoleExternalId: '',

// Name of the SSM parameter which describes the bootstrap stack version number
bootstrapStackVersionSsmParameter: '/cdk-bootstrap/${Qualifier}/version',

// Add a rule to every template which verifies the required bootstrap stack version
generateBootstrapVersionRule: true,

}),
```
You can replace eu-north-1 with w/e region you already have bootstrapped.
Then set env.region to a different region.
You will also need to manually set the /cdk-boostrap/${Qualifier}/version in the new region by manually looking it up in the bootstrapped region and "copying" it to the new region (or disable `generateBootstrapVersionRule`).

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.215.0

### AWS CDK CLI version

2.1029.3 (build 2f0cfc4)

### Node.js Version

22.20.0

### OS

Mac OS Sonoma

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the custom DefaultStackSynthesizer configuration and reproduce the issue from a TypeScript project created with `cdk init --language typescript`, using a file-assets bucket in eu-north-1 and a stack region of us-east-1. Trace the asset URL resolution during `cdk deploy`; done means deployment can publish and access assets from the cross-region bootstrap bucket without the S3 endpoint error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.