How to resolve physical name issue CodePipelineActionRole for cross region cross account pipeline?

[kinderlars]

Hi,

I am currently trying to create a CodePipeline pipeline and make it deploy to multiple regions in multiple accounts. As I use custom qualifiers, I am creating the replica stacks (buckets and kms keys) myself and want to pass the buckets and keys directly to the Pipeline construct. So far so good.

Now that I created everything, I keep hitting the same error.

RuntimeError: Error: Resolution error: Resolution error: Resolution error: Resolution error: Cannot use resource 'f9999999-BaselinePipelineStack/BasePipeline/Source/abc-workbench-imagebuilder-baseline/CodePipelineActionRole' in a cross-environment fashion, the resource's physical name must be explicit set or use "PhysicalName.GENERATE_IF_NEEDED".

I created two custom roles that I provide to the constructs, but I don't see where else I need to replace the action_role in order to fix the issue.

Anyone got any idea how to solve it or simplify the solution?

How my code looks.

       base_pipeline_role = iam.Role(
            self,
            "BasePipelineRole",
            role_name=PhysicalName.GENERATE_IF_NEEDED,
            assumed_by=iam.ServicePrincipal("codepipeline.amazonaws.com"),
        )

        pipeline_action_role = iam.Role(
            self,
            "PipelineActionRole",
            role_name=PhysicalName.GENERATE_IF_NEEDED,
            assumed_by=iam.ServicePrincipal("codebuild.amazonaws.com"),
        )

        replica_stacks = {}
        for cross_region in helper_functions.get_cross_regions():
            _ = str(cross_region).title()
            cap_region = _.replace("-", "")
            replica_stacks[cross_region] = ReplicaStack(
                self,
                f"{cap_region}ReplicaStack",
                termination_protection=termination_protection,
                synthesizer=DefaultStackSynthesizer(
                    qualifier=qualifier
                ),
                env=Environment(
                    account=dev_account_id,
                    region=cross_region
                )
            )

        replica_buckets = {}
        replica_bucket_keys = {}
        for cross_region, stack in replica_stacks.items():
            replica_buckets[cross_region] = stack.node.find_child("PipelineReplicaBucket")
            replica_bucket_keys[cross_region] = stack.node.find_child("PipelineReplicaBucketKeyAlias")

# Create basic pipeline to customize CodePipeline
        pipeline_base = code_pipeline.Pipeline(
            self,
            "BasePipeline",
            pipeline_name=f"{prefix}-{qualifier}-{app_name_short}-pipeline",
            role=base_pipeline_role,
            restart_execution_on_update=True,
            # artifact_bucket=artifacts_bucket,
            cross_account_keys=True,
            cross_region_replication_buckets=replica_buckets
        )

        # Create CodePipeline pipeline for deploying infrastructure
        pipeline = pipelines.CodePipeline(
            self,
            "BaseInfraPipeline",
            code_pipeline=pipeline_base,
            code_build_defaults=pipelines.CodeBuildOptions(
                role_policy=[
                    iam.PolicyStatement(
                        effect=iam.Effect.ALLOW,
                        actions=[
                            "sns:Publish",
                        ],
                        resources=[
                            self.pipeline_topic.topic_arn
                        ],
                    ),
                    iam.PolicyStatement(
                        effect=iam.Effect.ALLOW,
                        actions=[
                            "kms:Decrypt",
                            "kms:DescribeKey",
                            "kms:Encrypt",
                            "kms:GenerateDataKey"
                        ],
                        resources=[
                            sns_key.key_arn
                        ],
                    ),
                ]
            ),
            synth=pipelines.CodeBuildStep(
                id="Synth",
                action_role=pipeline_action_role,
                input=pipelines.CodePipelineSource.code_commit(repo, branch),
                env={
                    "QUALIFIER": qualifier,
                    "CDK_ENV": cdk_env,
                },
                commands=[
                    f'npm i -g aws-cdk@{constants.npm_cdk_version}',
                    'mkdir .venv',
                    'pipenv install',
                    '. .venv/bin/activate',
                    'cd ./cdk/',
                    'cdk synth',
                ],
                primary_output_directory="./cdk/cdk.out",
                role_policy_statements=[
                    iam.PolicyStatement(
                        actions=["sts:AssumeRole"],
                        resources=["*"],
                        conditions={
                            "StringEquals": {
                                "iam:ResourceTag/aws-cdk:bootstrap-role": "lookup"
                            }
                        }
                    )
                ]
            )
        )

[kinderlars]

The solution was to set the context in the App construct like this
app = cdk.App(context={ "@aws-cdk/core:bootstrapQualifier": helper_functions.get_qualifier()} )

Additionally, remove the custom logic e.g. the role creation etc. and let CodePipeline handle it.

[arcardon]

where is the code of helper_functions ?

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.