cdklabs / cdklabs/cdk-pipelines-github

cdk Bootstrap 29 denies assume role calls using external ids

Open
#1,414 2 comments 5 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
384
Forks
45
Avg merge
1d 1h
Merged PRs (30d)
4

Description

Hi team!

Currently, we have faced some issues while implementing the bootstrapping of our aws accounts using the version 29 of the template provided by AWS.

Specifically, the new template denies all the assume role on the CDK roles when an external id is provided [Code Reference](https://github.com/aws/aws-cdk-cli/blob/e46adaf06467dfed206bddbf295f7f388fd05718/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml#L59-L70), but the github pipeline adds it automatically, and doesn't provide any mechanism to avoid setting it up [Code Reference](https://github.com/cdklabs/cdk-pipelines-github/blob/bebe6a5e626b838fdb3c479cef8e8ae1c6b08ab6/src/aws-credentials.ts#L131)

I'm opening this issue to ask for a solution that allows the consumer of this package to avoid setting up such property, in order to consume the new bootstrap configuration without issues.

Thanks!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.