Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(cli): --notification-arns not validated #20806

Closed
christopher-taormina-zocdoc opened this issue Jun 20, 2022 · 1 comment · Fixed by #21270
Closed

(cli): --notification-arns not validated #20806

christopher-taormina-zocdoc opened this issue Jun 20, 2022 · 1 comment · Fixed by #21270
Labels
bug This issue is a bug. effort/small Small work item – less than a day of effort good first issue Related to contributions. See CONTRIBUTING.md p1 package/tools Related to AWS CDK Tools or CLI

Comments

@christopher-taormina-zocdoc
Copy link

Describe the bug

When deploying using the --notification-arns argument, it's possible to pass in an invalid arn as an SNS topic arn, causing a change set to be uploaded with an invalid arn. If possible, the cli should at least validate the structure of the notification arn's being passed in.

Creating a change set with an invalid SNS arn seems to put the stack into a bad state, as the change seemingly cannot be deleted. So far I've found the only remedy is to delete the stack

Expected Behavior

Expected the cli to throw when receiving invalid notification arns.

Current Behavior

The deploy still uploads a change set with an invalid SNS topic arn.

Reproduction Steps

This can be reproduced easily with any type of stack.

  1. Deploy stack without using --notification-arns cdk deploy --require-approval never --all
  2. Make a change to the stack and deploy using an invalid notification arn such as arn:aws:sns:us-east-1::some-sns-topic cdk deploy --require-approval never --all --notification-arns arn:aws:sns:us-east-1::some-sns-topic
  3. The deploy will fail with a validation error.
 ❌  dev001-ct-s3-test-s3 failed: Error [ValidationError]: Invalid parameter: AccountId (Service: AmazonSNS; Status Code: 400; Error Code: InvalidParameter; Request ID: 8089a9f5-8661-5487-b5db-f2df5a335207; Proxy: null)
    at Request.extractError (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/protocol/query.js:50:29)
    at Request.callListeners (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
    at Request.emit (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
    at Request.emit (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/request.js:686:14)
    at Request.transition (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/request.js:22:10)
    at AcceptorStateMachine.runTo (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request.<anonymous> (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/request.js:38:9)
    at Request.<anonymous> (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/request.js:688:12)
    at Request.callListeners (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/sequential_executor.js:116:18) {
  code: 'ValidationError',
  time: 2022-06-20T20:35:30.070Z,
  requestId: 'a5b58918-f6cd-4b36-a9fe-a89aa2f915f7',
  statusCode: 400,
  retryable: false,
  retryDelay: 772.0194690899034
}
  1. Try to delete the change set by cli, met with the error An error occurred (InvalidChangeSetStatus) when calling the DeleteChangeSet operation: An operation on this ChangeSet is currently in progress. Please attempt this operation again later.
  2. Try to deploy the stack with a valid SNS topic. This is met with the following error
 ❌  dev001-ct-s3-test-s3 failed: InvalidChangeSetStatus: An operation on this ChangeSet is currently in progress.  Please attempt this operation again later.
    at Request.extractError (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/protocol/query.js:50:29)
    at Request.callListeners (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
    at Request.emit (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
    at Request.emit (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/request.js:686:14)
    at Request.transition (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/request.js:22:10)
    at AcceptorStateMachine.runTo (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request.<anonymous> (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/request.js:38:9)
    at Request.<anonymous> (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/request.js:688:12)
    at Request.callListeners (/Users/christopher.taormina/src/intern-cdk/cdk/node_modules/aws-sdk/lib/sequential_executor.js:116:18) {
  code: 'InvalidChangeSetStatus',
  time: 2022-06-20T20:39:18.375Z,
  requestId: '83a73e9a-77fc-456c-87ee-ac8a5416946f',
  statusCode: 400,
  retryable: false,
  retryDelay: 92.08934678630065
}

Possible Solution

The nicest thing to have is making a check to see if the SNS topic in fact exists. However even the simplest check for a valid SNS arn structure could prevent this from occurring.

Additional Information/Context

No response

CDK CLI Version

2.27.0

Framework Version

No response

Node.js Version

14.19.1

OS

Macos Monterey

Language

Typescript

Language Version

Typescrit 4.5.5

Other information

No response
@christopher-taormina-zocdoc christopher-taormina-zocdoc added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Jun 20, 2022
@github-actions github-actions bot added the package/tools Related to AWS CDK Tools or CLI label Jun 20, 2022
@rix0rrr rix0rrr added effort/small Small work item – less than a day of effort good first issue Related to contributions. See CONTRIBUTING.md p1 and removed needs-triage This issue or PR still needs to be triaged. labels Jul 7, 2022
@rix0rrr rix0rrr removed their assignment Jul 7, 2022
@TrygviZL TrygviZL mentioned this issue Jul 21, 2022
Merged
4 tasks
@mergify mergify bot closed this as completed in #21270 Jul 23, 2022
mergify bot pushed a commit that referenced this issue Jul 23, 2022
@TrygviZL
fix(cli): add validation of --notification-arns structure (#21270)
6d157d1 
When deploying using the `--notification-arns` argument, it's possible to pass in an invalid arn as an SNS topic arn, causing a change set to be uploaded with an invalid arn. This PR adds a check for the structure of the input ARN.

I was originally looking into possibly adding the check earlier in the process such as adding a .check() method to the yargs option in [packages/aws-cdk/lib/cli.ts](https://github.com/aws/aws-cdk/blob/f66f94e9201b9c9d5e0f1b713a6f30194b323b28/packages/aws-cdk/lib/cli.ts). But as I see it there are no tests for these, so it was difficult to validate the change.

closes #20806 


----

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@github-actions
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

comcalvi pushed a commit to comcalvi/aws-cdk that referenced this issue Jul 25, 2022
@TrygviZL @comcalvi
fix(cli): add validation of --notification-arns structure (aws#21270)
684b17c 
When deploying using the `--notification-arns` argument, it's possible to pass in an invalid arn as an SNS topic arn, causing a change set to be uploaded with an invalid arn. This PR adds a check for the structure of the input ARN.

I was originally looking into possibly adding the check earlier in the process such as adding a .check() method to the yargs option in [packages/aws-cdk/lib/cli.ts](https://github.com/aws/aws-cdk/blob/f66f94e9201b9c9d5e0f1b713a6f30194b323b28/packages/aws-cdk/lib/cli.ts). But as I see it there are no tests for these, so it was difficult to validate the change.

closes aws#20806 


----

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
josephedward pushed a commit to josephedward/aws-cdk that referenced this issue Aug 30, 2022
@TrygviZL @josephedward
fix(cli): add validation of --notification-arns structure (aws#21270)
2f5bef9 
When deploying using the `--notification-arns` argument, it's possible to pass in an invalid arn as an SNS topic arn, causing a change set to be uploaded with an invalid arn. This PR adds a check for the structure of the input ARN.

I was originally looking into possibly adding the check earlier in the process such as adding a .check() method to the yargs option in [packages/aws-cdk/lib/cli.ts](https://github.com/aws/aws-cdk/blob/f66f94e9201b9c9d5e0f1b713a6f30194b323b28/packages/aws-cdk/lib/cli.ts). But as I see it there are no tests for these, so it was difficult to validate the change.

closes aws#20806 


----

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug This issue is a bug. effort/small Small work item – less than a day of effort good first issue Related to contributions. See CONTRIBUTING.md p1 package/tools Related to AWS CDK Tools or CLI
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(cli): add validation of --notification-arns structure
2 participants
@rix0rrr @christopher-taormina-zocdoc