[s3-deployment] BucketDeployment not reading role from Role.fromRoleArn

[mukeshchauhan]

Role.fromRoleArn have no affect when provided to BucketDeployment via props

Issue

Instantiating BucketDeployment with provided Role.fromRoleArn have no affect, approval for updating the policy is presented with the same permissions that are in the existing role. Due to corporate IAM limitations, we cannot approve the IAM changes on fly and have to use existing roles.

Environment

• CDK CLI Version: 1.60.0
• Module Version: 1.60.0
• Node.js Version: v12.18.2
• OS: osx 10.15.6
• Language: Typescript

Code Snippet

        let destinationBucket = Bucket.fromBucketName(this, 'myexistingbucket', 'test-dev-us-east-1');
        let irole = Role.fromRoleArn(this, 'exising_role', 'arn:aws:iam::12345:role/MyRole');
        let dep = new BucketDeployment(this, 'MyFiles', {
            sources: [Source.asset(path.join(__dirname, '../../dist/test'))],
            destinationBucket: destinationBucket,
            role: irole,
            serverSideEncryption: ServerSideEncryption.AWS_KMS,
            serverSideEncryptionAwsKmsKeyId: 'arn:aws:kms:us-east-1:12345:key/123-123-1233'
        });

[iliapolo]

@mukeshchauhan

Instantiating BucketDeployment with provided Role.fromRoleArn have no affect

What do you mean have no affect? The way it should work is by adding an AWS::IAM::Policy resource that grants your role the necessary permissions to download from the staging bucket and upload to the destination bucket.

Is that policy not being created? Are you getting errors during deployment?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[mukeshchauhan]

Because of corporate policies, creating roles at runtime is not allowed (which cdk is doing ) All roles are reviewed and approved before they can be used. For now we found a work around mentioned here. #3684

[otaviomacedo]

@mukeshchauhan, just to clarify a couple of things first: when you provide a role to BucketDeployment, the CDK will respect that and assign that role to the Lambda function. And, as @iliapolo pointed out, it will create a policy with the right permissions (s3:GetObject*, s3:GetBucket*, etc) and attach that policy to the function's role, regardless of where that role came from.

Now, to your problem: I get it. It would make more sense if, when presented with a custom role, it didn't attach any policy to it. As part of its contract, BucketDeployment should assume that the role has all the right permissions already. But if we change that now, it will remove some permissions that users are (implicitly or explicitly) relying on.

[Georift]

@otaviomacedo we noticed this today at work. I also feel like providing a custom role should prevent a new one being made. I've been thinking but I can't think of a use case where adding extra permissions would make sense for a S3 Deployment. Given we're not in control of the code, what more permission could it need than the S3 access it's already making?

FWIW we worked around it with some disgusting patching of the bucket passed in to make grantReadWrite have no effect:

Bucket.fromBucketArn(this, "nulledReadWrite", filesBucket.bucketArn).grantReadWrite = (() => {
	console.trace('nulled out grantReadWrite() will have no effect');
}) as any;

[otaviomacedo]

Ok, what I said above is not entirely correct. I wasn't aware that there is a boolean property, mutable that you can pass to Role.fromRoleArn(). If you set that property to false, the role will be left untouched and no additional policy or role will be created. I believe this solves the problem.

Feel free to reopen if you have additional questions.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[Georift]

Perfect thank you!

[BillyWitrock]

I also found, that if you are passing in a role, you can use the withoutPolicyUpdates() function to get a copy of the role that ignores any grants it is given, and pass that in instead.

https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_iam.Role.html#withoutwbrpolicywbrupdatesoptions