fix: CloudFormation timeout if $AWS_ENDPOINT_URL_S3 is set during cdk deploy
#933
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…k deploy` The CLI asks the SDK for the URL to an S3 bucket, in order to pass it to CloudFormation. CloudFormation will then attempt to contact S3 on that URL in order to download the template. A feature of the the SDK is to respect the `$AWS_ENDPOINT_URL_S3` environment variable, which can be used to override the S3 endpoint that the SDK will hit; you might use this if you have private VPC endpoints for a number of AWS services. The problem arises that `$AWS_ENDPOINT_URL_S3` also affects the URL that the CDK CLI passes to CloudFormation. This will most likely be an endpoint that is not routable for CloudFormation like `https://vpce-xxx.s3.us-east-1.vpce.amazonaws.com`, and CloudFormation will time out waiting for the template download. To get around this, we will temporarily unset `$AWS_ENDPOINT_URL_S3` for the duration of calling the SDK to provide us with a URL.
rix0rrr
temporarily deployed
to
integ-approval
GitHub Actions
Inactive
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #933 +/- ##
==========================================
- Coverage 84.10% 83.59% -0.51%
==========================================
Files 71 71
Lines 10437 10437
Branches 1336 1323 -13
==========================================
- Hits 8778 8725 -53
- Misses 1621 1674 +53
Partials 38 38
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
mrgrain
reviewed
Nov 14, 2025
Comment on lines
+110
to
+114
| * To allow for the off chance that someone is running this tool against a | ||
| * custom build of CloudFormation that does need a specific S3 endpoint passed | ||
| * to it, we'll introduce a new environment variable that we'll respect instead: | ||
| * | ||
| * AWS_ENDPOINT_URL_S3_FOR_CLOUDFORMATION |
Contributor
There was a problem hiding this comment.
(blocking): I'm leaning against the proliferation of introducing undocumented env vars doing things. I'm guessing this was added to preempt new issues? Let me reason this through:
- Currently when
AWS_ENDPOINT_URL_S3is set it will break deployment - This PR fixes that
- If someone deliberately used
AWS_ENDPOINT_URL_S3to do something unknown that we do not know about, they will be broken now. - How do they find the new env var? I say they won't and they will open an issue anyway.
I vote we only address this if someone has this problem.
Contributor
There was a problem hiding this comment.
Discussed offline. This might help use cases like OpenStack and LocalStack.
mrgrain
approved these changes
Nov 14, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The CLI asks the SDK for the URL to an S3 bucket, in order to pass it to CloudFormation. CloudFormation will then attempt to contact S3 on that URL in order to download the template.
A feature of the the SDK is to respect the
$AWS_ENDPOINT_URL_S3environment variable, which can be used to override the S3 endpoint that the SDK will hit; you might use this if you have private VPC endpoints for a number of AWS services.The problem arises that
$AWS_ENDPOINT_URL_S3also affects the URL that the CDK CLI passes to CloudFormation. This will most likely be an endpoint that is not routable for CloudFormation likehttps://vpce-xxx.s3.us-east-1.vpce.amazonaws.com, and CloudFormation will time out waiting for the template download.To get around this, we will temporarily unset
$AWS_ENDPOINT_URL_S3for the duration of calling the SDK to provide us with a URL.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license