-
Notifications
You must be signed in to change notification settings - Fork 3.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(codepipeline): x-env ECS deployment lacking support stack-depende…
…ncy (#24053) In the case of a cross-account AND cross-region ECS deployment, a dependency between the support stacks that is necessary is missing. This cannot be fixed globally. Because the resources reference each other bidirectionally (user -> bucket, bucket -> user), the only way to fix this is to do it locally: in the CodePipeline module, where we can have the knowledge that we use generated names and that everything will work out if we deploy the role before the bucket. All CodePipeline Actions must have this fix eventually, but since people may have crazy stack setups in which addition of this dependency may introduce a cyclic dependency (breaking the synth), we're rolling this fix out with limited blast radius. Follow-up in #24050, and suggest a good clean-up in #24051. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
- Loading branch information
Showing
10 changed files
with
64 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
27 changes: 27 additions & 0 deletions
27
packages/@aws-cdk/aws-codepipeline-actions/lib/private/stack-dependency.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,27 @@ | ||
import * as iam from '@aws-cdk/aws-iam'; | ||
import * as s3 from '@aws-cdk/aws-s3'; | ||
import { Resource, Stack } from '@aws-cdk/core'; | ||
|
||
/** | ||
* Create a dependency between the stack of the replication bucket and the stack of the action role | ||
* | ||
* If the deployment action happens in across-account/cross-region fashion, we | ||
* create two support stacks (stack R for the cross-account role, and stack B for the | ||
* cross-region replication bucket), but these stacks are not related to each | ||
* other by default. | ||
* | ||
* To make it more interesting, if these are roles with autogenerated names, the | ||
* stacks have bidirectional policies: the bucket and key (B) refer to the role | ||
* (R), and the role (R) refers to the bucket and key (B). This is an | ||
* unfortunate way of setting up the policies, and it should really be | ||
* completely replaced with a tag-based mechanism. | ||
* | ||
* Until then, we've determined that deployment accidentally works fine if we deploy | ||
* the account stack R first, followed by the region stack B. So explicitly establish | ||
* this dependency in CodePipeline Actions. | ||
*/ | ||
export function forceSupportStackDependency(bucket: s3.IBucket, role: iam.IRole) { | ||
if (Resource.isOwnedResource(bucket) && Resource.isOwnedResource(role)) { | ||
Stack.of(bucket).addDependency(Stack.of(role), `replication bucket {${bucket.node.path}} to action role {${role}}`); | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -2231,7 +2231,6 @@ describe('regionalFact', () => { | |
}, | ||
}); | ||
}); | ||
|
||
}); | ||
|
||
class StackWithPostProcessor extends Stack { | ||
|