cdklabs / cdklabs/cdk-cicd-wrapper
[BUG] Use GitHubPipelinePlugin while SCP forbids Lambda outside of VPC
- Dominant language
- TypeScript
- Stars
- 34
- Forks
- 9
- Avg merge
- 2h 57m
- Merged PRs (30d)
- 48
Description
### Describe the bug
Hi, I wanted to try out the new GitHubPipelinePlugin for a new project of and tried to deploy it in one of our accounts. This failed however because of SCP at our company.
### Expected Behavior
Successful creation of the GitHubRepositoryStack.
### Current Behavior
SCP in our company forbids deployment of Lambda functions outside of a VPC.
```text
Resource handler returned message:
"User: arn:aws:sts::123456789123:assumed-role/cdk-aplperso-cfn-exec-role-123456789123eu-west-1/AWSCloudFormation is not authorized to perform: lambda:CreateFunction on resource: arn:aws:lambda:eu-west-1:123456789123:function:apl-personalGitHubReposit-CustomAWSCDKOpenIdConnec-84c3d0znMTNY with an explicit deny in a service control policy (Service: Lambda, Status Code: 403, Request ID: f1b78bb4-729e-44e8-ba13-43af9fb9f0b4)" (RequestToken: 39446d60-5e6f-672b-4b8a-29fffc2e5689, HandlerErrorCode: AccessDenied)
```
### Reproduction Steps
Deploying with the GitHub plugin in one of our accounts or any other with the mentioned SCP.
### Possible Solution
The OIDC connection provider you are using is probably trying to deploy this Lambda without being assigned to a VPC.
https://github.com/cdklabs/cdk-cicd-wrapper/blob/6b6ce9bc256c38608b061f2298fa56804aeffb27/packages/%40cdklabs/cdk-cicd-wrapper/src/plugins/pipeline/resources/github/GitHubRepositoryProvider.ts#L119
Is there a way to tell it to use the same VPC as the pipeline instead?
### Additional Information/Context
_No response_
### CDK CI/CD Wrapper version used
0.2.20
### Environment details (OS name and version, etc.)
Ubuntu 22.04
Contributor guide
Assessment
This issue has not been assessed yet.