Deploying legacy cdk bootstrap template on cdk version 2

[abjoshi2785]

How can i deploy the legacy cdk bootstrap template if i am on version 2 of cdk. Is there a flag in the CDK bootstrap command that can help in identifying if i need legacy template or the new template?

I am trying to use legacy synthesizer with CDK V2 (Have set the @aws-cdk/core:newStyleStackSynthesis": false)
This flexibility is need during the app migrations to CDK V2. Though we have migrated the app to V2 but we still want to use the legacy synthesizer.

[jumic]

How can i deploy the legacy cdk bootstrap template if i am on version 2 of cdk. Is there a flag in the CDK bootstrap command that can help in identifying if i need legacy template or the new template?

CDK v2 doesn't support bootstrapping the legacy template:
"CDK v2 uses a bootstrap template dubbed the modern template. The legacy template from CDK v1 is not supported in v2." (see documentation).

Regarding the LegacyStackSynthesizer I found this note in the v1 documentation: "Bootstrap stack: Both legacy and modern bootstrap stack"

Did you try to deploy a stack using the LegacyStackSynthesizer in an AWS account where the modern bootstrapping was used? Does it work or are there some error messages during deployment?

[abjoshi2785]

@jumic There are no errors but i will loose the ability to save the assets as the legacy template is not available in the account.

[peterwoodworth]

Like Jumic said, you cannot deploy the legacy template with v2. There's just no way to do this. However, I'm not sure why you'd want to do this, or how this would be a blocker - if you're migrating why would you need to deploy the legacy template?

You can still use the LegacyStackSynthesizer - could you expand on the issues you have with using this stack synthesizer?

[abjoshi2785]

@peterwoodworth The cdk v2 dosent offer Least privilege deployments, the roles are overly permissive. So we were trying to fall back to older method of deployment but still using v2. Is CliCredentialsStackSynthesizer an option?

One of the recommendation in discussion "#19715" is to use LegacyStackSynthesizer. But how can we deploy the legacy template and store the assets in s3 if the older bootstrap template is not available?

[peterwoodworth]

It's not clear to me what you're trying to accomplish exactly. Are you trying to bootstrap a new environment? Or are you trying to use an existing legacy bootstrap stack in v2

[abjoshi2785]

@peterwoodworth As we want to use the legacy synthesizer, have set the flag as "@aws-cdk/core:newStyleStackSynthesis":false". When we bootstrap the account we have the new version of bootstrap template being deployed. Now the issue is cdk deploy does not recognize the new template and we don't have the old bootstrap stack in the new account as there is no way to generate it
.

[peterwoodworth]

So you do need to create a new Legacy bootstrap stack, correct? Why do you need to do this?

[jumic]

@abjoshi2785 Could you please try to explain the main reason why you are trying to use the legacy bootstrap stack? E.g. the new bootstrapping creates role xyZ. My security department told my that it is insecure because of ...

Maybe there is better solution than using the legacy bootstrapping. Or we can create a feature request to remove this restriction.

[abjoshi2785]

@jumic @peterwoodworth With CDK v2 the biggest concern is that the CDK Deploy role uses an Exec role which has full administrative privileges. This gives complete access to perform any operation in account. So after going through the discussion #19715 it seems falling back to the legacy synthesizer was an option.

Now our stacks use assets and to deploy them we will need to bootstrap the environment. Without bootstrapping the environment we will get the error "Error: This stack uses assets, so the toolkit stack must be deployed to the environment". So we are trying to identify:

1. Can we use legacy bootstrap template with legacy synthesizer (This doesn't seem to be an option)
2. How to store those assets if we are using legacy synthesizer
3. Is there a better way to achieve this?

[jumic]

@abjoshi2785 You can use your own policy if you do not want to use the default policy with full administrative privileges. You have to add --cloudformation-execution-policies argument to cdk bootstrap.

[peterwoodworth]

Additionally, if there are any other parts of the template aren't viable per your security requirements, we recommend modifying the template itself with

cdk bootstrap --show-template > bootstrap-template.yaml

to show the template and save it in a new file

and

cdk bootstrap --template bootstrap-template.yaml

to deploy that template once changes have been made

I would highly recommend this approach, are there any issues with this approach and/or supplying the execution policy through CLI?

[abjoshi2785]

@peterwoodworth There are few issues. First maintaining the template itself is an issue, another issue is that the the we have large number of tenants and creating a generic template this way may not be a solution.

We did considered the approach you have mentioned above but that is something that we don't want to pursue until there is no better option.

[peterwoodworth]

You won't have to maintain or share a template if all you need to modify is the execution role permissions, but it sounds like you need to make more modifications beyond that. I don't know what your further requirements are however

[peterwoodworth]

CliCredentialsStackSynthesizer allows you to deploy with just CLI credentials and already existing "staging resources" (i.e. assets bucket and ecr repository). Just know that your CLI credentials must be valid for the duration of the entire deployment, and you cannot deploy using CDK pipelines this way (just like the legacy bootstrap). This is a good synthesizer to use in v2 if you wish to use the legacy template, because both of these only rely on existing staging resources and your CLI credentials to deploy

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.