Skip to content

Commit 432af34

Browse files
rix0rrrrix0rrr
authored
fix(s3-deployment): doesn't work in ADC regions (#25363)
The AWS CLI that we use to run `aws s3 sync` comes with its own certificate bundle, which doesn't include the certificates used in ADC regions. Fortunately, Lambda has curated a CA bundle already, we just need to force the CLI to use it. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 8c0de6d commit 432af34

File tree

37 files changed

+224
-107
lines changed

37 files changed

+224
-107
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeilne-elastic-beanstalk-deploy.js.snapshot/aws-cdk-codepipeline-elastic-beanstalk-deploy.assets.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,15 @@
5353
}
5454
}
5555
},
56-
"f30f5d2688dbc7b1ebba16623b198fd11257f447cb2d01e5325ebad5bfb206d8": {
56+
"700b33b613fbd899489f08c591ff8e002d433573bc48eca4a106e66109f3087f": {
5757
"source": {
5858
"path": "aws-cdk-codepipeline-elastic-beanstalk-deploy.template.json",
5959
"packaging": "file"
6060
},
6161
"destinations": {
6262
"current_account-current_region": {
6363
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
64-
"objectKey": "f30f5d2688dbc7b1ebba16623b198fd11257f447cb2d01e5325ebad5bfb206d8.json",
64+
"objectKey": "700b33b613fbd899489f08c591ff8e002d433573bc48eca4a106e66109f3087f.json",
6565
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
6666
}
6767
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeilne-elastic-beanstalk-deploy.js.snapshot/aws-cdk-codepipeline-elastic-beanstalk-deploy.template.json

+5
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,11 @@
326326
"Arn"
327327
]
328328
},
329+
"Environment": {
330+
"Variables": {
331+
"AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
332+
}
333+
},
329334
"Handler": "index.handler",
330335
"Layers": [
331336
{

‎packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeilne-elastic-beanstalk-deploy.js.snapshot/manifest.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
"validateOnSynth": false,
1818
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
1919
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/f30f5d2688dbc7b1ebba16623b198fd11257f447cb2d01e5325ebad5bfb206d8.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/700b33b613fbd899489f08c591ff8e002d433573bc48eca4a106e66109f3087f.json",
2121
"requiresBootstrapStackVersion": 6,
2222
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2323
"additionalDependencies": [

‎packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeilne-elastic-beanstalk-deploy.js.snapshot/tree.json

+5
Original file line numberDiff line numberDiff line change
@@ -508,6 +508,11 @@
508508
"Arn"
509509
]
510510
},
511+
"environment": {
512+
"variables": {
513+
"AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
514+
}
515+
},
511516
"handler": "index.handler",
512517
"layers": [
513518
{

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/aws-ecs-integ.assets.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -66,15 +66,15 @@
6666
}
6767
}
6868
},
69-
"8aa5759f14144b0e926e1a721b0d46e3703a8858ef439535708bc694c4388650": {
69+
"1a9bbcda71c448921127f084fce2798f586bec7ad012007e06ea6a63ef8cdefc": {
7070
"source": {
7171
"path": "aws-ecs-integ.template.json",
7272
"packaging": "file"
7373
},
7474
"destinations": {
7575
"current_account-current_region": {
7676
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
77-
"objectKey": "8aa5759f14144b0e926e1a721b0d46e3703a8858ef439535708bc694c4388650.json",
77+
"objectKey": "1a9bbcda71c448921127f084fce2798f586bec7ad012007e06ea6a63ef8cdefc.json",
7878
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
7979
}
8080
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/aws-ecs-integ.template.json

+5
Original file line numberDiff line numberDiff line change
@@ -1298,6 +1298,11 @@
12981298
"Arn"
12991299
]
13001300
},
1301+
"Environment": {
1302+
"Variables": {
1303+
"AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
1304+
}
1305+
},
13011306
"Handler": "index.handler",
13021307
"Layers": [
13031308
{

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/manifest.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
"validateOnSynth": false,
1818
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
1919
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/8aa5759f14144b0e926e1a721b0d46e3703a8858ef439535708bc694c4388650.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/1a9bbcda71c448921127f084fce2798f586bec7ad012007e06ea6a63ef8cdefc.json",
2121
"requiresBootstrapStackVersion": 6,
2222
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2323
"additionalDependencies": [

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/tree.json

+5
Original file line numberDiff line numberDiff line change
@@ -2092,6 +2092,11 @@
20922092
"Arn"
20932093
]
20942094
},
2095+
"environment": {
2096+
"variables": {
2097+
"AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
2098+
}
2099+
},
20952100
"handler": "index.handler",
20962101
"layers": [
20972102
{

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-cloudfront.js.snapshot/manifest.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
"validateOnSynth": false,
1818
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
1919
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/bbd88d83102b3e32b899afe0d87246311679398907317a82708147a774e14faf.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/95bddee0ddc3585e4b7e3eb6a1676f7a96abb59a75d7d9b0631ffa6d30996d20.json",
2121
"requiresBootstrapStackVersion": 6,
2222
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2323
"additionalDependencies": [

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-cloudfront.js.snapshot/test-bucket-deployments-1.assets.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,15 @@
5353
}
5454
}
5555
},
56-
"bbd88d83102b3e32b899afe0d87246311679398907317a82708147a774e14faf": {
56+
"95bddee0ddc3585e4b7e3eb6a1676f7a96abb59a75d7d9b0631ffa6d30996d20": {
5757
"source": {
5858
"path": "test-bucket-deployments-1.template.json",
5959
"packaging": "file"
6060
},
6161
"destinations": {
6262
"current_account-current_region": {
6363
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
64-
"objectKey": "bbd88d83102b3e32b899afe0d87246311679398907317a82708147a774e14faf.json",
64+
"objectKey": "95bddee0ddc3585e4b7e3eb6a1676f7a96abb59a75d7d9b0631ffa6d30996d20.json",
6565
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
6666
}
6767
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-cloudfront.js.snapshot/test-bucket-deployments-1.template.json

+5
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,11 @@
385385
"Arn"
386386
]
387387
},
388+
"Environment": {
389+
"Variables": {
390+
"AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
391+
}
392+
},
388393
"Handler": "index.handler",
389394
"Layers": [
390395
{

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-cloudfront.js.snapshot/tree.json

+5
Original file line numberDiff line numberDiff line change
@@ -579,6 +579,11 @@
579579
"Arn"
580580
]
581581
},
582+
"environment": {
583+
"variables": {
584+
"AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
585+
}
586+
},
582587
"handler": "index.handler",
583588
"layers": [
584589
{

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/TestBucketDeploymentContent.assets.json

+5-5
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,15 @@
1414
}
1515
}
1616
},
17-
"2bc265c5e0569aeb24a6349c15bd54e76e845892376515e036627ab0cc70bb64": {
17+
"9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd": {
1818
"source": {
19-
"path": "asset.2bc265c5e0569aeb24a6349c15bd54e76e845892376515e036627ab0cc70bb64",
19+
"path": "asset.9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd",
2020
"packaging": "zip"
2121
},
2222
"destinations": {
2323
"current_account-current_region": {
2424
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25-
"objectKey": "2bc265c5e0569aeb24a6349c15bd54e76e845892376515e036627ab0cc70bb64.zip",
25+
"objectKey": "9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd.zip",
2626
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
2727
}
2828
}
@@ -79,15 +79,15 @@
7979
}
8080
}
8181
},
82-
"2961e8222a48394849f4466d2789ae256aa88adc4ccbf79feb35306b850c08dc": {
82+
"6c07fbb89bbff6b2b1c4ddd3e1d445bc5b965519deab9fa8e860ccd5312df197": {
8383
"source": {
8484
"path": "TestBucketDeploymentContent.template.json",
8585
"packaging": "file"
8686
},
8787
"destinations": {
8888
"current_account-current_region": {
8989
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
90-
"objectKey": "2961e8222a48394849f4466d2789ae256aa88adc4ccbf79feb35306b850c08dc.json",
90+
"objectKey": "6c07fbb89bbff6b2b1c4ddd3e1d445bc5b965519deab9fa8e860ccd5312df197.json",
9191
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
9292
}
9393
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/TestBucketDeploymentContent.template.json

+6-1
Original file line numberDiff line numberDiff line change
@@ -220,14 +220,19 @@
220220
"S3Bucket": {
221221
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
222222
},
223-
"S3Key": "2bc265c5e0569aeb24a6349c15bd54e76e845892376515e036627ab0cc70bb64.zip"
223+
"S3Key": "9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd.zip"
224224
},
225225
"Role": {
226226
"Fn::GetAtt": [
227227
"CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265",
228228
"Arn"
229229
]
230230
},
231+
"Environment": {
232+
"Variables": {
233+
"AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
234+
}
235+
},
231236
"Handler": "index.handler",
232237
"Layers": [
233238
{

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.2bc265c5e0569aeb24a6349c15bd54e76e845892376515e036627ab0cc70bb64/index.py renamed to ‎packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd/index.py

+12-1
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,17 @@
2222
ENV_KEY_MOUNT_PATH = "MOUNT_PATH"
2323
ENV_KEY_SKIP_CLEANUP = "SKIP_CLEANUP"
2424

25+
AWS_CLI_CONFIG_FILE = "/tmp/aws_cli_config"
2526
CUSTOM_RESOURCE_OWNER_TAG = "aws-cdk:cr-owned"
2627

28+
os.putenv('AWS_CONFIG_FILE', AWS_CLI_CONFIG_FILE)
29+
2730
def handler(event, context):
2831

2932
def cfn_error(message=None):
3033
logger.error("| cfn_error: %s" % message)
31-
cfn_send(event, context, CFN_FAILED, reason=message)
34+
cfn_send(event, context, CFN_FAILED, reason=message, physicalResourceId=event.get('PhysicalResourceId', None))
35+
3236

3337
try:
3438
# We are not logging ResponseURL as this is a pre-signed S3 URL, and could be used to tamper
@@ -57,6 +61,7 @@ def cfn_error(message=None):
5761
prune = props.get('Prune', 'true').lower() == 'true'
5862
exclude = props.get('Exclude', [])
5963
include = props.get('Include', [])
64+
sign_content = props.get('SignContent', 'false').lower() == 'true'
6065

6166
# backwards compatibility - if "SourceMarkers" is not specified,
6267
# assume all sources have an empty market map
@@ -75,6 +80,12 @@ def cfn_error(message=None):
7580
cfn_error("missing request resource property %s. props: %s" % (str(e), props))
7681
return
7782

83+
# configure aws cli options after resetting back to the defaults for each request
84+
if os.path.exists(AWS_CLI_CONFIG_FILE):
85+
os.remove(AWS_CLI_CONFIG_FILE)
86+
if sign_content:
87+
aws_command("configure", "set", "default.s3.payload_signing_enabled", "true")
88+
7889
# treat "/" as if no prefix was specified
7990
if dest_bucket_prefix == "/":
8091
dest_bucket_prefix = ""

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/manifest.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
"validateOnSynth": false,
1818
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
1919
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/2961e8222a48394849f4466d2789ae256aa88adc4ccbf79feb35306b850c08dc.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/6c07fbb89bbff6b2b1c4ddd3e1d445bc5b965519deab9fa8e860ccd5312df197.json",
2121
"requiresBootstrapStackVersion": 6,
2222
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2323
"additionalDependencies": [

0 commit comments

Comments
 (0)