Skip to content

Commit 7a6f585

Browse files
TheRealAmazonKendraTheRealAmazonKendra
authored
fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) (#19418)
When multiple copies of the same pipeline are deployed in separate stacks, the alias name for the KMS key is the same, causing the deployment to fail. This hcange fixes that using the stack name instead of the stack ID to create a stack safe uniqueId for the alias name. This fix is behind the following feature flag: @aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeUniqueId Fixes issue #18828. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 5429e55 commit 7a6f585

File tree

21 files changed

+672
-20
lines changed

21 files changed

+672
-20
lines changed

‎packages/@aws-cdk/aws-codepipeline-actions/test/cfn-template-from-repo.lit.integ.snapshot/aws-cdk-codepipeline-cloudformation.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
"PipelineArtifactsBucketEncryptionKeyAlias5C510EEE": {
4545
"Type": "AWS::KMS::Alias",
4646
"Properties": {
47-
"AliasName": "alias/codepipeline-awscdkcodepipelinecloudformationpipeline7dbde619",
47+
"AliasName": "alias/codepipeline-aws-cdk-codepipeline-cloudformation-pipeline-7dbde619",
4848
"TargetKeyId": {
4949
"Fn::GetAtt": [
5050
"PipelineArtifactsBucketEncryptionKey01D58D69",

‎packages/@aws-cdk/aws-codepipeline-actions/test/lambda-deployed-through-codepipeline.lit.integ.snapshot/PipelineStack.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
"PipelineArtifactsBucketEncryptionKeyAlias5C510EEE": {
3939
"Type": "AWS::KMS::Alias",
4040
"Properties": {
41-
"AliasName": "alias/codepipeline-pipelinestackpipeline9db740af",
41+
"AliasName": "alias/codepipeline-pipelinestack-pipeline-9db740af",
4242
"TargetKeyId": {
4343
"Fn::GetAtt": [
4444
"PipelineArtifactsBucketEncryptionKey01D58D69",

‎packages/@aws-cdk/aws-codepipeline-actions/test/lambda-pipeline.integ.snapshot/aws-cdk-codepipeline-lambda.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
"PipelineArtifactsBucketEncryptionKeyAlias5C510EEE": {
3939
"Type": "AWS::KMS::Alias",
4040
"Properties": {
41-
"AliasName": "alias/codepipeline-awscdkcodepipelinelambdapipeline87a4b3d3",
41+
"AliasName": "alias/codepipeline-aws-cdk-codepipeline-lambda-pipeline-87a4b3d3",
4242
"TargetKeyId": {
4343
"Fn::GetAtt": [
4444
"PipelineArtifactsBucketEncryptionKey01D58D69",

‎packages/@aws-cdk/aws-codepipeline-actions/test/pipeline-alexa-deploy.integ.snapshot/aws-cdk-codepipeline-alexa-deploy.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@
4848
"PipelineArtifactsBucketEncryptionKeyAlias5C510EEE": {
4949
"Type": "AWS::KMS::Alias",
5050
"Properties": {
51-
"AliasName": "alias/codepipeline-awscdkcodepipelinealexadeploypipeline961107f5",
51+
"AliasName": "alias/codepipeline-aws-cdk-codepipeline-alexa-deploy-pipeline-961107f5",
5252
"TargetKeyId": {
5353
"Fn::GetAtt": [
5454
"PipelineArtifactsBucketEncryptionKey01D58D69",

‎packages/@aws-cdk/aws-codepipeline-actions/test/pipeline-cfn.integ.snapshot/aws-cdk-codepipeline-cloudformation.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
"PipelineArtifactsBucketEncryptionKeyAlias5C510EEE": {
3939
"Type": "AWS::KMS::Alias",
4040
"Properties": {
41-
"AliasName": "alias/codepipeline-awscdkcodepipelinecloudformationpipeline7dbde619",
41+
"AliasName": "alias/codepipeline-aws-cdk-codepipeline-cloudformation-pipeline-7dbde619",
4242
"TargetKeyId": {
4343
"Fn::GetAtt": [
4444
"PipelineArtifactsBucketEncryptionKey01D58D69",

‎packages/@aws-cdk/aws-codepipeline-actions/test/pipeline-code-commit-build.integ.snapshot/aws-cdk-codepipeline-codecommit-codebuild.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,7 @@
244244
"PipelineArtifactsBucketEncryptionKeyAlias5C510EEE": {
245245
"Type": "AWS::KMS::Alias",
246246
"Properties": {
247-
"AliasName": "alias/codepipeline-awscdkcodepipelinecodecommitcodebuildpipeline9540e1f5",
247+
"AliasName": "alias/codepipeline-aws-cdk-codepipeline-codecommit-codebuild-pipeline-9540e1f5",
248248
"TargetKeyId": {
249249
"Fn::GetAtt": [
250250
"PipelineArtifactsBucketEncryptionKey01D58D69",

‎packages/@aws-cdk/aws-codepipeline-actions/test/pipeline-code-commit.integ.snapshot/aws-cdk-codepipeline-codecommit.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@
109109
"PipelineArtifactsBucketEncryptionKeyAlias5C510EEE": {
110110
"Type": "AWS::KMS::Alias",
111111
"Properties": {
112-
"AliasName": "alias/codepipeline-awscdkcodepipelinecodecommitpipelinef780ca18",
112+
"AliasName": "alias/codepipeline-aws-cdk-codepipeline-codecommit-pipeline-f780ca18",
113113
"TargetKeyId": {
114114
"Fn::GetAtt": [
115115
"PipelineArtifactsBucketEncryptionKey01D58D69",

‎packages/@aws-cdk/aws-codepipeline-actions/test/pipeline-events.integ.snapshot/aws-cdk-pipeline-event-target.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
"MyPipelineArtifactsBucketEncryptionKeyAlias9D4F8C59": {
3939
"Type": "AWS::KMS::Alias",
4040
"Properties": {
41-
"AliasName": "alias/codepipeline-awscdkpipelineeventtargetmypipeline4ae5d407",
41+
"AliasName": "alias/codepipeline-aws-cdk-pipeline-event-target-mypipeline-4ae5d407",
4242
"TargetKeyId": {
4343
"Fn::GetAtt": [
4444
"MyPipelineArtifactsBucketEncryptionKey8BF0A7F3",

‎packages/@aws-cdk/aws-codepipeline-actions/test/pipeline-stepfunctions.integ.snapshot/aws-cdk-codepipeline-stepfunctions.template.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@
7878
"MyPipelineArtifactsBucketEncryptionKeyAlias9D4F8C59": {
7979
"Type": "AWS::KMS::Alias",
8080
"Properties": {
81-
"AliasName": "alias/codepipeline-awscdkcodepipelinestepfunctionsmypipelinece88aa28",
81+
"AliasName": "alias/codepipeline-aws-cdk-codepipeline-stepfunctions-mypipeline-ce88aa28",
8282
"TargetKeyId": {
8383
"Fn::GetAtt": [
8484
"MyPipelineArtifactsBucketEncryptionKey8BF0A7F3",

‎packages/@aws-cdk/aws-codepipeline/lib/pipeline.ts

+15-4
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import {
77
ArnFormat,
88
BootstraplessSynthesizer,
99
DefaultStackSynthesizer,
10+
FeatureFlags,
1011
IStackSynthesizer,
1112
Lazy,
1213
Names,
@@ -17,6 +18,7 @@ import {
1718
Stage as CdkStage,
1819
Token,
1920
} from '@aws-cdk/core';
21+
import * as cxapi from '@aws-cdk/cx-api';
2022
import { Construct } from 'constructs';
2123
import { ActionCategory, IAction, IPipeline, IStage, PipelineNotificationEvents, PipelineNotifyOnOptions } from './action';
2224
import { CfnPipeline } from './codepipeline.generated';
@@ -697,10 +699,19 @@ export class Pipeline extends PipelineBase {
697699
private generateNameForDefaultBucketKeyAlias(): string {
698700
const prefix = 'alias/codepipeline-';
699701
const maxAliasLength = 256;
700-
const uniqueId = Names.uniqueId(this);
701-
// take the last 256 - (prefix length) characters of uniqueId
702-
const startIndex = Math.max(0, uniqueId.length - (maxAliasLength - prefix.length));
703-
return prefix + uniqueId.substring(startIndex).toLowerCase();
702+
const maxResourceNameLength = maxAliasLength - prefix.length;
703+
// Names.uniqueId() may have naming collisions when the IDs of resources are similar
704+
// and/or when they are too long and sliced. We do not want to update this and
705+
// automatically change the name of every KMS key already generated so we are putting
706+
// this under a feature flag.
707+
const uniqueId = FeatureFlags.of(this).isEnabled(cxapi.CODEPIPELINE_CROSS_ACCOUNT_KEY_ALIAS_STACK_SAFE_UNIQUE_ID) ?
708+
Names.uniqueResourceName(this, {
709+
separator: '-',
710+
maxLength: maxResourceNameLength,
711+
allowedSpecialCharacters: '/_-',
712+
}) :
713+
Names.uniqueId(this).slice(-maxResourceNameLength);
714+
return prefix + uniqueId.toLowerCase();
704715
}
705716

706717
/**

‎packages/@aws-cdk/aws-codepipeline/package.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,6 @@
8888
"@aws-cdk/cdk-build-tools": "0.0.0",
8989
"@aws-cdk/integ-runner": "0.0.0",
9090
"@aws-cdk/cfn2ts": "0.0.0",
91-
"@aws-cdk/cx-api": "0.0.0",
9291
"@aws-cdk/pkglint": "0.0.0",
9392
"@types/jest": "^27.5.0",
9493
"jest": "^27.5.1"
@@ -100,6 +99,7 @@
10099
"@aws-cdk/aws-kms": "0.0.0",
101100
"@aws-cdk/aws-s3": "0.0.0",
102101
"@aws-cdk/core": "0.0.0",
102+
"@aws-cdk/cx-api": "0.0.0",
103103
"constructs": "^3.3.69"
104104
},
105105
"homepage": "https://github.com/aws/aws-cdk",
@@ -110,6 +110,7 @@
110110
"@aws-cdk/aws-kms": "0.0.0",
111111
"@aws-cdk/aws-s3": "0.0.0",
112112
"@aws-cdk/core": "0.0.0",
113+
"@aws-cdk/cx-api": "0.0.0",
113114
"constructs": "^3.3.69"
114115
},
115116
"engines": {

0 commit comments

Comments
 (0)