The Amplify app changed the platform without outside intervention

[JZechy]

Environment information

"amplifyfinbobbohemikaamplifyapp26797FB3": {
      "Type": "AWS::Amplify::App",
      "Properties": {
        "BasicAuthConfig": {
          "EnableBasicAuth": false
        },
        "BuildSpec": "version: 1\nfrontend:\n  phases:\n    preBuild:\n      on-failure: CONTINUE\n      commands:\n        - npm ci\n    build:\n      on-failure: CONTINUE\n      commands:\n        - API_URL=$API_URL OLD_APP_URL=$OLD_APP_URL CONFIG_NAME=$CONFIG_NAME CLOUDFRONT_URL=$CLOUDFRONT_URL ENVIROMENT=$ENVIROMENT npm run generate\n  artifacts:\n    baseDirectory: .output/public\n    files:\n      - \"**/*\"\n  cache:\n    paths:\n      - node_modules/**/*\n",
        "CustomRules": [
          {
            "Source": "/<*>",
            "Status": "404-200",
            "Target": "/index.html"
          },
          {
            "Source": "</^[^.]+$|\\.(?!(css|gif|ico|jpg|js|png|txt|svg|woff|ttf|map|json)$)([^.]+$)/>",
            "Status": "200",
            "Target": "/index.html"
          }
        ],
        "EnvironmentVariables": [
          {
            "Name": "CONFIG_NAME",
            "Value": "bsf"
          }
        ],
        "IAMServiceRole": {
          "Fn::GetAtt": [
            "amplifyfinbobbohemikaamplifyappRole33D84F09",
            "Arn"
          ]
        },
        "Name": "FinBOB-Bohemika",
        "OauthToken": {
          "Fn::Join": [
            "",
            [
              "{{resolve:secretsmanager:",
              {
                "Ref": "SsmParameterValuefinbobsecretgithuboauthC96584B6F00A464EAD1953AFF4B05118Parameter"
              },
              ":SecretString:::}}"
            ]
          ]
        },
        "Platform": "WEB",
        "Repository": "https://github.com/Bohemika-eu/bsf"
      },
      "Metadata": {
        "aws:cdk:path": "finbob-bohemika/running-environments/deployment-support/amplify/finbob-bohemika/amplify-app/Resource"
      }
    }

Describe the bug

We have AWS Amplify Applicationm described by Infrastrcture as Code through AWS CDK. We created the application with platform WEB, because we are using a static site generator. How the application was created and how it is still described in the CloudFormation stack can be seen in Environment Information.

This was perfectly fine until our application switched to the WEB_COMPUTE platform on its own today. Nothing has changed in the CDK code, the application is still described in CloudFormation as above. Other users do not have permission to change the application settings, and at the same time no one could - The option to switch platforms is simply not available in the interface.

This is critical behaviour for us. We can't simply switch our workflow to SSR to use WEB_COMPUTE. And this change is now blocking our deployments, because obviously a different output is expected. We need to transition our platform back.

I would like to add that such critical arbitrary changes are not happening for the first time in a new application backend. When updates to the functionality of the Production Branch settings has been applied, our production branch was automatically switched to the development branch. As a result, the end users got a completely bad environment that was in operation for several hours.

Reproduction steps

No steps to reproduce.

[JZechy]

AWS CLI amplify update-app command has worked for the change. Yet it is unfortunate these background changes are happening.

[Jay2113]

Hi @JZechy 👋 , thanks for reaching out. As a first step, I'd recommend reviewing the UpdateApp API calls in CloudTrail that may have occurred for the app when this issue first surfaced. This should be a good starting point to debug how/why the app's platform changed to WEB_COMPUTE.

[JZechy]

@Jay2113 Examined the CloudTrail for Amplify and UpdateApp call during Thursday 6th, and Friday 7th November. Where the Amplify changed its platform, and when I turned it back.

Let me start with the AWS CLI when I turned the Amplify's platform back. In the event record we can find that I send in the request parameters about the appId and platform. Leading to a change of application's platform as expected. If someone is changing the application's platform, we will see it in the parameters.

{
    "requestParameters": {
        "appId": "***",
        "platform": "WEB"
    },
}

Now, let's take a look at Thursday 6th, where our Frontend team lead was making some changed to the deployment. The first request that day contains these parameters about some chnage to buildspec of the application.

{
    "requestParameters": {
        "appId": "***",
        "buildSpec": "***"
    },
}

Amplify API responded with App's platform still set to WEB. That was ok. Second API call was about changing the environment variables.

{
    "requestParameters": {
        "environmentVariables": "***",
        "appId": "***"
    },
}

This second call send a response from Amplify, which was already telling the App's platform is WEB_COMPUTE. So the platform somehow changed by itself, because no UpdateApp call contains the Platform parameter in request. Also I can see via logged AccessKeyId that both calls was made by our frontend developer only from the Amplify Console, where is impossible to change the platform.

It is leading me still to same suspicion: The platform was not changed on our behalf.

[Jay2113]

@JZechy thank for you reviewing the CloudTrail event logs and for sharing that information. As next steps, can you share your Amplify app id along with the branch name and build # where you observed this issue?