cdklabs / cdklabs/cdk-cicd-wrapper

[BUG] Use GitHubPipelinePlugin while SCP forbids Lambda outside of VPC

Open
#117 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
34
Forks
9
Avg merge
2h 57m
Merged PRs (30d)
48

Description

### Describe the bug

Hi, I wanted to try out the new GitHubPipelinePlugin for a new project of and tried to deploy it in one of our accounts. This failed however because of SCP at our company.

### Expected Behavior

Successful creation of the GitHubRepositoryStack.

### Current Behavior

SCP in our company forbids deployment of Lambda functions outside of a VPC.

```text
Resource handler returned message:
"User: arn:aws:sts::123456789123:assumed-role/cdk-aplperso-cfn-exec-role-123456789123eu-west-1/AWSCloudFormation is not authorized to perform: lambda:CreateFunction on resource: arn:aws:lambda:eu-west-1:123456789123:function:apl-personalGitHubReposit-CustomAWSCDKOpenIdConnec-84c3d0znMTNY with an explicit deny in a service control policy (Service: Lambda, Status Code: 403, Request ID: f1b78bb4-729e-44e8-ba13-43af9fb9f0b4)" (RequestToken: 39446d60-5e6f-672b-4b8a-29fffc2e5689, HandlerErrorCode: AccessDenied)
```

### Reproduction Steps

Deploying with the GitHub plugin in one of our accounts or any other with the mentioned SCP.

### Possible Solution

The OIDC connection provider you are using is probably trying to deploy this Lambda without being assigned to a VPC.
https://github.com/cdklabs/cdk-cicd-wrapper/blob/6b6ce9bc256c38608b061f2298fa56804aeffb27/packages/%40cdklabs/cdk-cicd-wrapper/src/plugins/pipeline/resources/github/GitHubRepositoryProvider.ts#L119

Is there a way to tell it to use the same VPC as the pipeline instead?

### Additional Information/Context

_No response_

### CDK CI/CD Wrapper version used

0.2.20

### Environment details (OS name and version, etc.)

Ubuntu 22.04

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.