aws-cdk: (codepipeline): Cannot deploy multiple copies of the same Pipeline with `crossAccountKeys: true`
What is the problem?
Hi,
In our context we need to have multiple pipelines per pull request, each pull request deploys it own set of stacks in the same region and account.
We use a namespace partition key we name ‘env name’: this partition key is then used as a suffix to all ressources we create. This allows to have multiple isolated environments and provide a lot of flexibility.
Reproduction Steps
A basic pipeline is created:
def _create_domain_pipeline(self):
domain_pipeline = pipelines.CodePipeline(
self,
'Pipeline',
pipeline_name=f'Quickstart-Pipeline-{self._env_name}',
self_mutation=True,
synth=self._create_codestar_synth_step(),
cross_account_keys=True,
reuse_cross_region_support_stacks=False,
)
If the cross_account_keys props is true then a KMS alias is created in the synthetised pipeline template:
"PipelineArtifactsBucketEncryptionKeyAlias94A07392": {
"Type": "AWS::KMS::Alias",
"Properties": {
"AliasName": "alias/codepipeline-quickstartpipelineb94f72c0",
"TargetKeyId": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKeyF5BF0670",
"Arn"
]
}
},
What did you expect to happen?
I would like to create muliple pipelines stacks with different names like when the option cross_account_keys is False.
Please note that this was possible with CDK 1.134.0 version.
What actually happened?
If try to create multiple envs with different env names such as PR-1 and PR-10 it fails when the option cross_account_keys is True because the same KMS alias is shared between all the environments.
When I synthetised multiple times the same CDK app I got one stack template per env name which is good:
assembly-Quickstart-Pipeline-HelloWorld-PR-3
assembly-Quickstart-Pipeline-HelloWorld-PR-45
But I have only one template Quickstart-Pipeline.template.json and this template contains the same AliasName for the KMS key so it fails because for instance I already deployed PR-3 pipeline and the KMS alias is already there when I try to deploy PR-45.
CDK CLI Version
2.10.0
Framework Version
2.10.0
Node.js Version
v16.13.0
OS
Mac Monterey
Language
Python
Language Version
3.8
Other information
No response
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Reactions: 2
- Comments: 23 (12 by maintainers)
Commits related to this issue
- fix(codepipeline): use stack name instead of id in cross account key alias name (under feature flag) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for the ... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): use stack name instead of id in cross account key alias name (under feature flag) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for the ... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for the KMS ... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for the KMS ... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): use stack name instead of id in cross account key alias name (under feature flag) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for the ... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for the KMS ... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) (#19418) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) (#19418) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for... — committed to wphilipw/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for the KMS ... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for the KMS ... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for the KMS ... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) (#20745) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for... — committed to aws/aws-cdk by TheRealAmazonKendra 2 years ago
- fix(codepipeline): cannot deploy pipeline stack with crossAccountKeys twice (under feature flag) (#20745) When multiple copies of the same pipeline are deployed in separate stacks, the alias name for... — committed to daschaa/aws-cdk by TheRealAmazonKendra 2 years ago
thanks for the tips @skinny85
I would tend to avoid to patch CDK behaviour at runtime before I understand what is the intent of the CDK: is it expected to not support a basic use case to save KMS keys cost? Is it something else I don’t understand?
Especially if the patch relies on CDK template generation implementation details on which there are no API contract. I don’t want to base our entire CDK CI/CD strategy on such workaround.