Cross account stage deployment addPost step

[willruggiano]

class DeploymentStage extends cdk.Stage {
  readonly application: ApplicationStack;

  constructor(scope: Construct, stage: Stage) {
    super(scope, `${stage.charAt(0).toUpperCase() + stage.slice(1)}`);
    this.application = new ApplicationStack(this, stage);
  }
}

...

const stages: AppStage[] = ["staging", "release"];
for (const stageName of stages) {
  const stage = new DeploymentStage(this, stageName);
  const deployment = pipeline.addStage(stage);
  deployment.addPost(
    new pipelines.CodeBuildStep("Validate", {
      installCommands: ["npm install -g npm@latest"],
      commands: ["npm run ci:integration"],
      vpc: stage.application.vpc
    })
  );
}

Basically, I am creating a number of canonical stages (in the case of the above sample code, just two: "staging" and "release") which will deploy stacks into separate accounts (separate from the pipeline account, which the above CodePipeline will be deployed into). I'd like to add post-deployment steps to validate the stack deployments in each of the accounts at each stage, however whichever way I try I always run into the same error:

Error: Stack "Pipeline" cannot reference {Staging/Service/Vpc/PrivateSubnet1/Subnet[Ref]} in stack "Staging/Service". Cross stack references are only supported for stacks deployed to the same account or between nested stacks and their parent stack

I'd just like to be able to run the post-deployment validation step (which is a CodeBuildStep) in the application VPC deployed into the application/stage specific account.

[aodj-kara]

@willruggiano did you get anywhere with resolving this? I'm running into the same thing, and was curious if had managed to solve it.

[willruggiano]

You can use CfnOutputs to do cross account, cross stack references, but there is a limit to what you can with such a reference. To accomplish what I described in the OP, I ended up using two CodeBuild projects: one in the pipeline account and another in the deployment account, and the CodeBuild project in the pipeline account just invokes the one in the deployment account.

According to CodePipeline and CodeBuild, it is theoretically possible to directly invoke a cross-account CodeBuild project. To do so however you almost certainly will have to resort to L1 constructs since the high-level constructs provide no way of specifying the required information for doing such cross-account invocations.

I will try to dig up the documentation that I found on the subject. I actually discovered it by accident through the aws-cli :D