Skip to content

Conversation

@dgandhi62
Copy link
Contributor

@dgandhi62 dgandhi62 commented Sep 24, 2025

The gc command currently ignores the --role-arn parameter and always uses the user's default credentials, regardless of whether a role ARN is specified. This can potentially lead to silent failures, permission issues, as well as a bad user experience due to confusion.

This pr adds a check to throw a warning when the --role-arn parameter is used in the gc command. This helps improve user experience and avoid mismanaged expectations.

A consideration to throw an error was made. However, this could be a breaking change for existing ci/cd pipeline users. Therefore, this idea was discarded


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@codecov-commenter
Copy link

codecov-commenter commented Sep 24, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.49%. Comparing base (75b8256) to head (8170fb3).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #893      +/-   ##
==========================================
+ Coverage   83.23%   83.49%   +0.25%     
==========================================
  Files          71       71              
  Lines       10396    10401       +5     
  Branches     1306     1315       +9     
==========================================
+ Hits         8653     8684      +31     
+ Misses       1705     1679      -26     
  Partials       38       38              
Flag Coverage Δ
suite.unit 83.49% <100.00%> (+0.25%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@iankhou
Copy link
Contributor

iankhou commented Sep 25, 2025

Why not implement roleArn functionality instead?

@dgandhi62
Copy link
Contributor Author

Why not implement roleArn functionality instead?

In the command documentation, roleArn is defined for when we invoke Cloudformation. gc seems to have some direct calls to s3/Ecr. I think there is scope for implementing this functionality but it might need a bigger discussion on the design implications. I can investigate this more and make an update later for this if needed, this should work as a primary fix meanwhile. Thanks for the feedback

Copy link
Contributor

@kaizencc kaizencc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what about a test?

@dgandhi62 dgandhi62 changed the title feat(cli): throw error when --role-arn is used with gc command feat(cli): display warning when --role-arn is used with gc command Oct 20, 2025
@aws-cdk-automation aws-cdk-automation added this pull request to the merge queue Oct 21, 2025
Merged via the queue into aws:main with commit 3d7b09b Oct 21, 2025
28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants