aws-iam: service principal name mismatch in CN partition

[jy19]

Describe the bug

hey folks, we have a CDK stack that currently create an IAM role that does this:

assumedBy: new ServicePrincipal("elasticmapreduce.amazonaws.com"),
(this uses iam.ServicePrincipal)

when we upgrade our CDK version, infrastructure that uses this role starts failing being able to create EMR clusters in CN partition because we noticed that the role changes from elasticmapreduce.amazonaws.com.cn to elasticmapreduce.amazonaws.com. this seems related to this CDK change that removes "deprecated SP mappings" . i am trying to work around this by creating a temporary mapping for EMR, so i explicitly specify the endpoint like so:
assumedBy: new ServicePrincipal("elasticmapreduce.amazonaws.com.cn"),

but when i run cdk diff against my CN stack i see this:

 [-]       "Service": {
 [-]         "Fn::Join": [
 [-]           "",
 [-]           [
 [-]             "elasticmapreduce.",
 [-]             {
 [-]               "Ref": "AWS::URLSuffix"
 [-]             }
 [-]           ]
 [-]         ]
 [-]       }
 [+]       "Service": "elasticmapreduce.amazonaws.com"

why does it ignore the name? i see in the cdk file it says the format should still be supported.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

the cdk version in our CN regions is ~2.130.0, we are trying to upgrade to ~2.150.0

Expected Behavior

I expected that specifying elasticmapreduce.amazonaws.com.cn on ServicePrincipal to put that same string into the created iam role.

Current Behavior

Specifying elasticmapreduce.amazonaws.com.cn on ServicePrincipal gets translated to elasticmapreduce.amazonaws.com in the iam role.

Reproduction Steps

repro steps:
create an iam role with trust relationship to service principal elasticmapreduce.amazonaws.com.cn in a CN region.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.158.0

Framework Version

No response

Node.js Version

^20.11.22

OS

amazon linux

Language

TypeScript

Language Version

^5.3.3

Other information

No response

[jy19]

actually - based on this - should I be moving to use new ServicePrincipal(ServicePrincipal.servicePrincipalName('elasticmapreduce.amazonaws.com.cn') instead

[khushail]

@jy19 , thanks for reaching out.

Parsing through the recent CDK Changes, it seems that this change-

https:/aws/aws-cdk/blob/7d6bf773d3a8f17d94c4aa5d5aa9025270c254aa/packages/aws-cdk-lib/region-info/lib/region-info.ts#L124C1-L132C4

I am not able to repro this due to access rights but sure, please give it a try and see if that works.

[jy19]

i changed the call pattern to:

assumedBy: new ServicePrincipal(
        ServicePrincipal.servicePrincipalName('elasticmapreduce.amazonaws.com.cn')
      ),

but unfortunately still see the same issue

[khushail]

Internal Ticket reference- V1549524507

[mrgrain]

Irrespectively of the observed failure, the service principal appears to be documented as elasticmapreduce.amazonaws.com even for CN regions:

https://docs.amazonaws.cn/en_us/emr/latest/ManagementGuide/emr-iam-role.html
https://docs.amazonaws.cn/en_us/emr/latest/ManagementGuide/emr-iam-roles.html

[moelasmar]

Thanks @jy19 for raising this issue. Unfortunately, I am not able to reproduce this issue. This is the sample application I am using to reproduce this issue:

class EmrServicePrincipalTestStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const subnetId = process.env.SUBNET_ID;
   
    const emrServiceRole = new iam.Role(this, 'EMRServiceRole', {
      assumedBy: new iam.ServicePrincipal('elasticmapreduce.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonElasticMapReduceRole'),
      ],
    });

    const emrJobFlowRole = new iam.Role(this, 'EMRJobFlowRole', {
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonElasticMapReduceforEC2Role'),
      ],
    });

    const emrJobFlowProfile = new iam.CfnInstanceProfile(this, 'EMRJobFlowProfile', {
      roles: [emrJobFlowRole.roleName],
      instanceProfileName: 'EMRJobFlowProfile_',
    });

    const sshKey = new ec2.CfnKeyPair(this, 'SSHKey', {
      keyName: 'TestingSSHKey',
    });

    new emr.CfnCluster(this, 'EMRCluster', {
      name: 'My first cluster',
      instances: {
        coreInstanceGroup: {
          instanceCount: 1,
          instanceType: 'm5.xlarge',
        },
        ec2SubnetId: subnetId,
        hadoopVersion: 'Amazon',
        keepJobFlowAliveWhenNoSteps: false,
        ec2KeyName: sshKey.ref,
        terminationProtected: false,
        masterInstanceGroup: {
          instanceCount: 1,
          instanceType: 'm5.xlarge',
        },
      },
      jobFlowRole: emrJobFlowProfile.ref,
      applications: [
        { name: 'Spark' },
      ],
      serviceRole: emrServiceRole.roleName,
      releaseLabel: 'emr-6.4.0',
    });
  }
}

const app = new cdk.App();
const testingStack = new EmrServicePrincipalTestStack(app, 'EmrServicePrincipalTestingStack2', {
  env: {
    region: 'cn-north-1',
  },
});

and this is the CFN template for the generated service role:

EMRServiceRole2CF24E74:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Statement:
      - Action: sts:AssumeRole
        Effect: Allow
        Principal:
          Service: elasticmapreduce.amazonaws.com
      Version: '2012-10-17'
    ManagedPolicyArns:
    - Fn::Join:
      - ''
      - - 'arn:'
        - Ref: AWS::Partition
        - ":iam::aws:policy/service-role/AmazonElasticMapReduceRole"

The stack created successfully, and the EMR cluster started, created EC2 instances, and then terminated successfully.

Could you please retry the deployment from your side, and if it is still failing, please share the code of your CDK app so we can replicate the issue.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.