policyName longer than 128 characters for auto generated AWS::IAM::Policy for CodeBuild project

[juanrh]

Note: for support questions, please first reference our documentation, then use Stackoverflow. This repository's issues are intended for feature requests and bug reports.

• I'm submitting a ...

  • [x ] 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior?
  If the current behavior is a 🪲bug🪲: Please provide the steps to reproduce
  new codebuild.Project
  I'm using CDK 1.0.0 to setup several code build projects. We have to run the same tests in different environments, so I have done something similar to travis build matrix, by having a TestMatrix construct that contains several instantiations of a TestSuite construct that creates a CodeBuild project with the required IAM permissions. As a result I get long cdk paths

The problem is that when I deploy the stack to my dev account the deployment fails because tje name of the IAM policies associated to each CodeBuild project is too long

1 validation error detected: Value '***********************' at 'policyName' failed to satisfy constraint: Member must have length less than or equal to 128 (Service: AmazonIdentityManagement; Status Code: 400; Error Code: ValidationError; Request ID: ad619787-ad6f-11e9-bfef-a3a40d689eaf)

However I haven't defined that policy explicitly, I just called codeBuildProject.addToRolePolicy to add additional PolicyStatement objects, and CDK added permissions automatically for accessing a CodeCommit repository that is used as source.

• What is the expected behavior (or behavior of feature suggested)?
  There is no validation error when deploying the Cfn stack

• What is the motivation / use case for changing the behavior or adding this feature?
  The policy name is defined automatically by CDK

• Please tell us about your environment:

  • CDK CLI Version: 1.0.0
  • Module Version: 1.0.0
  • OS: Ubuntu
  • Language: TypeScript

• Other information (e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. associated pull-request, stackoverflow, gitter, etc)

[juanrh]

This workaround seems to work. Please let confirm whether this is a reasonable solution or not

if (codeBuildProject.role) {
	const policy = codeBuildProject.role["defaultPolicy"].node.defaultChild as CfnPolicy ;
	// Override the policy name using Escape Hatches
	// https://docs.aws.amazon.com/cdk/latest/guide/cfn_layer.html
	policy.addOverride("Properties.PolicyName", `${projectName}-policy`);
}	

Thanks

[skinny85]

Hey @juanrh ,

sorry for the late response. If your workaround works fine, then I don't see a problem with it.

I'll work on a fix for this issue.

Thanks,
Adam

[juanrh]

I'm having the same problem when defining a cw events rule for a CodeBuild project, as part of the same construct

new events.Rule(this, `trigger-${projectName}`, {
			schedule: events.Schedule.cron({
				// "All scheduled events use UTC time zone"
				// https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html
				hour: "7" // daily at 07:00 UTC ~ 00:00 PDT
			}),
			targets: [
				new events_targets.CodeBuildProject(project)
			]

I'm having more problems to find a workaround here, any suggestion would be appreciated

[juanrh]

Is there a simple way to traverse all resources in a cdk.Stack, so I can detect those corresponding to a IAM policy, and modify their name if needed?

[eladb]

stack.node.findAll

[juanrh]

I'm using this as a workaround

this.node.findAll().forEach(child => {
    // HACK for https://github.com/aws/aws-cdk/issues/3402
    // Cannot check the actual policy name, because the token hasn't been expanded yet
    const childClass = child.constructor.name;
    if (childClass == 'CfnPolicy') {
        const policy = child as CfnPolicy;
        const maxPolicyNameLength = 128;					
        const newPolicyName = `policy-${uuid4()}${uuid4()}${uuid4()}${uuid4()}`.slice(0, maxPolicyNameLength);
        console.warn(`Renaming policy ${newPolicyName} to ensure the policy name passes validation`)
        policy.addOverride("Properties.PolicyName", newPolicyName);
    }
});

running from the stack constructor. I understand this means CDK will always generate new policy names, so each time I deploy a change for any resource, all the IAM policies will be regenerated too. That should be ok because there is no state associated to policies AFAIK, it will just make deployments slower.

Does this workaround sound good, or do you think there can be any problems with this approach?

Thanks