Role.customizeRoles question for random construct path scenario '<stackName>/LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8a/ServiceRole'

[matthewloller-vf]

I was wondering if anyone has solved this or if this is even currently supported but for the case when dealing with an abstracted construct and the construct path has some randomly generated id tacked on to the tail end (IE. when you specify the 'retention' field on a lambda and it generates a custom resource and a role)

How can we use this feature to swap that role out since that id is created at synth time. Are we able to wildcard that id somehow?

Role.customizeRoles(app, { usePrecreatedRoles: { '<stackName>/LogRetention123481923740981237408921374/ServiceRole': 'myRoleName' } });

Role.customizeRoles(app, { usePrecreatedRoles: { '<stackName>/LogRetention*/ServiceRole': 'myRoleName' } });

@corymhall

[corymhall]

@matthewloller-vf I think you will need to use that first option. First synth the app to get the id and then you can add the customizeRoles entry.

[matthewloller-vf]

Thank you for the reply! I've found that when I try to use the 'Role.customizeRoles' function using the scope of a stack after the stack has been defined I get an error

throw new Error('Cannot set context after children have been added: ' + names.join(','));

So I've been defining the 'customizeRoles' after the initing the app scope.

What i've been doing:

const app = new App();

Role.customizeRoles(app, {
  preventSynthesis: false
});

const stack = new CustomStack(app, `CustomStack`, customStackProps);

What I think the doc shows but I cant get working:

const app = new App();

const stack = new CustomStack(app, `CustomStack`, customStackProps);

Role.customizeRoles(app, {
  preventSynthesis: false
});

[matthewloller-vf]

I also want to thank you for this feature, I discovered this recently and it's so far been a lifesaver for many of our high security use cases. I'm just hoping to get over this last hurdle.

[matthewloller-vf]

I attempted a basic example however even though I was successfully able to update the customizeRoles object, the role was not replaced because it was already synthed... and we're unable to modify the path after the synth.

#!/usr/bin/env node
/* eslint-disable @typescript-eslint/no-non-null-assertion */
import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import { TestStack } from '../lib/test-stack';
import { Code, Function, Runtime } from 'aws-cdk-lib/aws-lambda';
import { RetentionDays } from 'aws-cdk-lib/aws-logs';
import { CustomizeRolesOptions, Role } from 'aws-cdk-lib/aws-iam';

const app = new cdk.App();

const customizeRoles: CustomizeRolesOptions = {
  preventSynthesis: false,
  usePrecreatedRoles: {
    'TestStack/HelloWorldFunction/ServiceRole': 'BasicLogRetention'
  }
};

Role.customizeRoles(app, customizeRoles);

const stack = new TestStack(app, 'TestStack', {});

new Function(stack, 'HelloWorldFunction', {
  runtime: Runtime.NODEJS_14_X,
  handler: 'index.handler',
  logRetention: RetentionDays.EIGHT_YEARS,
  code: Code.fromInline(`
    exports.handler = async (event, context) => {
      return {
        statusCode: 200,
        body: 'Hello, World!'
      };
    };
  `)
});

stack.node.children.forEach((child: any) => {
  if (child.node.path.includes('LogRetention')) {
    console.log(child.node.path);
    child.node.children.forEach((baby: any) => {
      if (baby.node.path.includes('ServiceRole')) {
        console.log(baby.node.path);
        customizeRoles.usePrecreatedRoles![baby.node.path.toString()] = 'BasicLogRetention';
      }
    });
  }
});

console.log(customizeRoles);

[corymhall]

@matthewloller-vf the customizeRoles is usually a two step process.

1. First synth without any config. Synth will fail, but it will give you a report with the missing roles.

Role.customizeRoles(app, {
});

2. Plug in the missing roles and synth again.

Role.customizeRoles(app, {
  usePrecreatedRoles: {
    'TestStack/HelloWorldFunction/ServiceRole': 'BasicLogRetention',
    'TestStack/LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8a/ServiceRole': 'BasicLogRetention',
  }
});

[matthewloller-vf]

Hi Cory, my misunderstanding stemmed from thinking the 'LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8a' would rename itself every time synth occurred. Seems like that isn't the case and I just need to synth first to get that Id then pass it in manually. I was getting another issue however and it seems that this feature does not work with nested stacks, particularly defining at app scope and having something like

app = new App()
stack = new Stack(app)
nStack = new NestedStack(stack)

the roles in nested stack will be extracted in the report but not replaced by the role.customizeRoles function, maybe because the nested stack created a new template?

I have not tried defining another role.customize roles inside the stack scope for the nested stack yet, that may be a workaround.

Thanks for your replies!