(core): file asset publishing role is not used while performing cdk diff with larger templates

[mrlikl]

Describe the bug

cdk diff is not using file asset publish role when uploading larger templates to S3 while creating the change set. It is using the user/role that is configured in the CLI. If the user/role (configured in CLI) lacks permissions then AccessDenied error is thrown and fallback to template differences.

Expected Behavior

File asset publish role to be used to upload templates for cdk diff

Current Behavior

fail: Access Denied Failed to publish one or more assets. See the error messages above for more information.

Reproduction Steps

1. Create IAM user or role with deny all S3 actions.

2. Configure your CLI with the above role/user.

3. Create a CDK project with one SQS queue

   // create a stack with one sqs queue
   new sqs.Queue(this, `Queue`, {});

4. Deploy

5. Add more resources that will create a larger template to the stack and execute cdk diff -v

   // add 300 more sqs queue's to the same stack and perform cdk diff -v
   for (let i = 0; i < 300; i++) {
     new sqs.Queue(this, `Queue${i}`, {
     });
   }   

Stack trace -

Stack CdktsStack
[23:46:13] Retrieved account ID xxxxxxxxxxxx from disk cache
[23:46:13] Assuming role 'arn:aws:iam::xxxxxxxxxxxx:role/cdk-hnb659fds-lookup-role-xxxxxxxxxxxx-us-east-1'.
[23:46:18] Retrieved account ID xxxxxxxxxxxx from disk cache
[23:46:20] Retrieved account ID xxxxxxxxxxxx from disk cache
[23:46:20] Assuming role 'arn:aws:iam::xxxxxxxxxxxx:role/cdk-hnb659fds-deploy-role-xxxxxxxxxxxx-us-east-1'.
[23:46:21] Waiting for stack CDKToolkit to finish creating or updating...
[23:46:22] Storing template in S3 at: https://cdk-hnb659fds-assets-xxxxxxxxxxxx-us-east-1.s3.us-east-1.amazonaws.com/cdk/CdktsStack/e6cbc1ec64bd0bf5f83ee188026e9c010633551b8252f036384f6dddb29932f0.yml
[23:46:22] [0%] start: Publishing e6cbc1ec64bd0bf5f83ee188026e9c010633551b8252f036384f6dddb29932f0:current
[23:46:23] [0%] check: Check s3://cdk-hnb659fds-assets-xxxxxxxxxxxx-us-east-1/cdk/CdktsStack/e6cbc1ec64bd0bf5f83ee188026e9c010633551b8252f036384f6dddb29932f0.yml
[23:46:32] [0%] upload: Upload s3://cdk-hnb659fds-assets-xxxxxxxxxxxx-us-east-1/cdk/CdktsStack/e6cbc1ec64bd0bf5f83ee188026e9c010633551b8252f036384f6dddb29932f0.yml
[100%] fail: Access Denied
[23:46:36] Failed to publish one or more assets. See the error messages above for more information.
Could not create a change set, will base the diff on template differences (run again with -v to see the reason)

The IAM user configured in my CLI does not have S3 permissions.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.138.0

Framework Version

No response

Node.js Version

20.10

OS

macos

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

I am not sure if I get it correct.

Can you elaborate about the steps with some real code snippets or commands and share the full error message when you cdk diff -v?

Reproduction Steps
Create IAM user or role with deny all S3 actions.

Configure an environment with the role/user

[mrlikl]

Apologies ! I have updated the issue with more detailed steps and stack trace @pahud !

[JoHuang]

I got the same issue after upgrading from 2.86.0 to 2.147.0 .