cdklabs / cdklabs/cdk-stacksets

s3 sync returns non-zero exit status 1

Open
#456 2 comments 0 reactions 0 assignees View on GitHub
documentation effort/small p2 question
Dominant language
TypeScript
Stars
118
Forks
25
Avg merge
33m
Merged PRs (30d)
4

Description

I would like to leverage `cdk-stacksets` in order to deploy multiregional and into multiple accounts **including File Assets**.

Environment:
```
Node: v18.14.2
TypeScript: ~5.4.5
CDK: 2.138.0
cdk-stacksets: ^0.0.150
```

I have created a list of buckets accordingly to this scheme `-` outside the scope of my CDK app, each with these bucket-permissions:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"s3:Get*",
"s3:List*",
"s3:Put*",
"s3:Delete*",
],
"Resource": [
"arn:aws:s3:::-",
"arn:aws:s3:::-/*"
],
"Condition": {
"StringEquals": {
"aws:PrincipalOrgID": ""
}
}
}
]
}
```
Then I imported the bucket, assigned the `assetBucket` and `assetBucketPrefix` in order to create the stack:
```
// import only eu-central-1 bucket
const sharedAssetBucket = aws_s3.Bucket.fromBucketName(this, "SharedAssetsBucket", "-")
const myStackSetStack = new MyStackSetStack(this, 'MyStackSetStack', {
assetBuckets: [sharedAssetBucket],
assetBucketPrefix: ""
})
const myStackSet = new StackSet(this, 'MyStackSet', {
stackSetName: "MyStackSet",
template: StackSetTemplate.fromStackSetStack(myStackSetStack),
target: ...
}
);
```

This is my SteckSetTemplate:
```
export class MyStackSetStack extends StackSetStack {
constructor(scope: Construct, id: string, props: StackSetStackProps) {
super(scope, id);

new cr.AwsCustomResource(this, 'GetParameterCustomResource', {
onUpdate: {
service: 'SSM',
action: 'getParameter',
parameters: {
Name: 'my-parameter',
},
physicalResourceId: cr.PhysicalResourceId.of('test-resource'),
},
policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
}),
});
// or any other resource leveraging file assets
}
}
```

When I run `deploy` I get the error message:
```
Command '['/opt/awscli/aws', 's3', 'sync', '/tmp/tmp04w0o9tq/contents', 's3://-/']' returned non-zero exit status 1.
```

Accordingly to #428 permissions for the AwsApiCall are not being created, however he fixed it, without mentioning the fix.

1. Is it correct to provide only one single bucket in the `assetBuckets`-array, if so why is it an array?
2. Should `assetBuckets` be an array of every regional asset bucket, then whats the point of `assetBucketPrefix`?
3. Is there any workaround to fixing this issue?

Please clarify.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the deploy command with the shown StackSetStack configuration, focusing on assetBuckets and assetBucketPrefix and the failing S3 sync. Compare the behavior with issue #428 and inspect how the AwsCustomResource and file assets are handled. Done means a documented configuration or fix that deploys file assets across the intended regions and accounts without the non-zero exit status.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.