Unable to deploy with AWS_ROLE_ARN

[kabo]

What is the problem?

CDK seems to try to do something in the account, but fails because it can't find the credentials.
We're deploying from a bitbucket pipeline using AWS_ROLE_ARN/AWS_WEB_IDENTITY_TOKEN_FILE.
The AWS CLI can use the credentials.

Reproduction Steps

I suspect this has to do with

    const vpc = Vpc.fromLookup(this, 'Vpc', {
      vpcId: props.vpcId,
    })

but I'm not sure.

What did you expect to happen?

The deploy to work as normal

What actually happened?

CDK CLI Version

2.18.0

Framework Version

No response

Node.js Version

14

OS

Alpine

Language

Typescript

Language Version

No response

Other information

No response

[kabo]

OK, it's not this.

    const vpc = Vpc.fromLookup(this, 'Vpc', {
      vpcId: props.vpcId,
    })

I figured out the only reason that was there was to be able to create a security group, and I could do this instead of actually looking up the VPC.

    const sg = new SecurityGroup(this, 'SG', {
      securityGroupName: `foo`,
      description: `foo`,
      vpc: { vpcId: props.vpcId } as Vpc,
    })

But I'm still getting the same error.

[kabo]

It's not

ssm.StringParameter.valueForStringParameter(this, props.parentImagePath)

either...

[kabo]

It's not

kms.Alias.fromAliasName(this, 'snsKeyAlias', 'alias/foo')

either...

[kabo]

Minimal stack that still fails

import { Stack, StackProps } from 'aws-cdk-lib'
import { Construct } from 'constructs'
import { Topic } from 'aws-cdk-lib/aws-sns'

export interface TestStackProps extends StackProps {
  readonly stage: string
}
export class TestStack extends Stack {
  constructor(scope: Construct, id: string, props: TestStackProps) {
    super(scope, id, props)

    new Topic(this, 'AlarmNotificationTopic', {})

  }
}

[kabo]

my bin file

#!/usr/bin/env node
import 'source-map-support/register'
import * as cdk from 'aws-cdk-lib'
import { TestStack } from '../lib/test-stack'

const app = new cdk.App()
new TestStack(app, 'TestStackTest', {
  env: { account: '46xxx', region: 'us-east-1' },
  stage: 'test',
})

[peterwoodworth]

Hey @kabo, I'm not sure we ever claim to support these environment variables - Have you checked out our guide on setting up credentials?

[kabo]

It's working fine in lots of other repos, it's just this one that's acting weird for some unknown reason.

I've also tried clearing cdk.context.json. Do you think clearing cdk.json could help? Wondering if there's some state somewhere that's wonky and causing these issues...

[peterwoodworth]

It's working fine in lots of other repos

What exactly do you mean by this, can you use these environment variables in other CDK projects?

[kabo]

What exactly do you mean by this, can you use these environment variables in other CDK projects?

Exactly.

[peterwoodworth]

Ok so I was mistaken, we do support these ENV variables. TIL!

aws-cdk/packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts

Line 167 in 16d293d

function hasWebIdentityCredentials(): boolean {

If it normally works and it's not now then I'm honestly not too sure what might be going on here... I'll try to look into this some more

[kabo]

OK, I figured it out.
Notice how I in the first screenshot have set

export AWS_DEFAULT_REGION=eu-west-1

If I instead change that to

export AWS_REGION=eu-west-1

it works!

Even though I've set the region I want to use in my bin file.

So the CDK requires that one sets AWS_REGION when using AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE. I don't see this requirements with other projects, e.g. deploying using the serverless framework. Kind of sounds like a bug to me, but if it's not it could it please be mentioned in the documentation?

[peterwoodworth]

Hmm, I'm not too sure that would be it - here's where we set the region:

aws-cdk/packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts

Line 111 in 16d293d

let region = process.env.AWS_REGION || process.env.AMAZON_REGION ||

It allows for any of the region env variables to be set

[peterwoodworth]

But that's strange, can you consistently reproduce this error?

And also either way you're right - our documentation lacks proper explanation on the environment variables you can use with the CDK

[kabo]

Yup, every time I set AWS_DEFAULT_REGION it fails, and every time I set AWS_REGION it works fine.

[0x4d4e]

Finally! Thank you so much for documenting this here ... I thought I was going crazy.

I had a similar situation: bitbucket pipeline using OIDC to authenticate to AWS. Worked fine for SAM. Then I added another CDK subproject to the same repo/pipeline but it wouldn't work.

AWS_ROLE_ARN = <redacted>
AWS_DEFAULT_REGION = eu-central-1

CDK_DEFAULT_ACCOUNT = <redacted>
CDK_DEFAULT_REGION = eu-central-1

These were the relevant ENV variables before - no luck. After also adding AWS_REGION it also worked for CDK.

[GoGoris]

Because I also ran into this issue and this thread is already quite old, I created the following bug report: #25082

[peterwoodworth]

Closing this discussion in favor of #25082

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.