Pipelines: Build Synth role missing AssumeRole permission

[rupe120]

Describe the bug

I attempted to add a Key.fromLookup() to a stack and received a not authorized to perform: sts:AssumeRole for the CodeBuild role.

I added sts:AssumeRole to the permissions policy and it resolved the issue

Expected Behavior

Allow the code build role to assume the cross account roles

Current Behavior

The code build role is missing sts:AssumeRole from the permissions policy

Reproduction Steps

Add a Key.fromLookup() to a stack that executes in a different account than the CDK Pipeline.

Possible Solution

Add sts:AssumeRole to https://github.com/aws/aws-cdk/blob/cea1039e3664fdfa89c6f00cdaeb1a0185a12678/packages/@aws-cdk/pipelines/lib/private/asset-singleton-role.ts

I think that is the correct place.

Additional Information/Context

No response

CDK CLI Version

2.45.0 (build af1fb7c)

Framework Version

No response

Node.js Version

v16.16.0

OS

Windows 10 Pro 19043.1889

Language

Typescript

Language Version

TypeScript 4.8.3

Other information

No response

[gshpychka]

This is intentional - lookup values are cached in cdk.context.json, which should be committed to Git. After you do that, there will be no further lookups during synth. I understand that may be limiting sometimes and not cover all use-cases, but it's the best practice.

This is explained here: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines-readme.html#context-lookups

[rupe120]

This is intentional - lookup values are cached in cdk.context.json, which should be committed to Git. After you do that, there will be no further lookups during synth. I understand that may be limiting sometimes and not cover all use-cases, but it's the best practice.

This is explained here: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines-readme.html#context-lookups

Then I think there is a problem with the caching because it was throwing an error trying to query across accounts instead of using the cached value.

[gshpychka]

You would need to open a new issue for that and include more information in it.

[rupe120]

@gshpychka I just had a thought. It might be because the cached value changed. Should the cached value change if the associated stack needed to be rebuilt? Or would I need to remove the cached value if that happens?

[rix0rrr]

The cache key is a combination of account, region and input to the lookup function. If any of those change, that will cause a new lookup to happen.

The cached value will not automatically be invalidated. You are responsible for removing the cache key (by editing cdk.context.json or using the cdk context command) if you have outside knowledge that the cached value needs to be refreshed.

This isn't really a bug report. Moving this to discussions.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.