ashishdhingra
commented
5 months ago Bootstrap version SSM parameter is defined as DEFAULT_BOOTSTRAP_STACK_VERSION_SSM_PARAMETER here. During synthesize() operation, CheckBootstrapVersion rule would be added in the generated CloudFormation template along with the CfnParameter named BootstrapVersion as shown in example below:
Parameters:
BootstrapVersion:
Type: AWS::SSM::Parameter::Value<String>
Default: /cdk-bootstrap/hnb659fds/version
Description: Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]
Resources:
...
...
Rules:
CheckBootstrapVersion:
Assertions:
- Assert:
Fn::Not:
- Fn::Contains:
- - "1"
- "2"
- "3"
- "4"
- "5"
- Ref: BootstrapVersion
AssertDescription: CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI.As per description Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. of BootstrapVersion parameter in the generated CloudFormation template, the value for this parameter is automatically retrieved from SSM Parameter Store. The CDK deployment is essentially a CloudFormation deployment and is handled by the CloudFormation service.
Per CDK Bootstrapping documentation,
- AWS CDK's built-in stack synthesizers is called
DefaultStackSynthesizer(refer Stack synthesizers) - During initialization of a stack, it is possible to specify a synthesizer as per below example in the above documentation:
new MyStack(this, 'MyStack', { // stack properties synthesizer: new DefaultStackSynthesizer({ // synthesizer properties }), }); - Here it is possible to override certain properties (as mentioned in Customizing synthesis section)
- The property
generateBootstrapVersionRulecould be set tofalseand as per logic here, it should not emitBootstrapVersionCfnParameter andCheckBootstrapVersionCfnRule (these are added here). Unsure if this should be used since bootstrap version should always be validated. - Per Roles section at The bootstrapping template contract, the
DefaultStackSynthesizerrequires five IAM roles for five different purposes. For your use case, since the issue happens during deployment process, in your AWS environment, you could add necessary IAM permissions to thecloudFormationExecutionRole, which per above documentation isARN of the role passed to CloudFormation to execute the deployments.and has format likearn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-${Qualifier}-cfn-exec-role-${AWS::AccountId}-${AWS::Region}(here the default value for${Qualifier}ishnb659fds) deployment role created by CDK bootstrapping process. You could refer IAM permissions for using AWS default keys and customer managed keys for example policy.
- The property
I would rather go with 2nd option to add necessary IAM permissions. Hope it unblocks you.
On a side note, is there any specific reason for which you would you like to make the SSM parameter /cdk-bootstrap/<blabla>/version encrypted as it's not sensitive data and you will need to manage a key for that.
Thanks, Ashish
maddyexplore
github-actions[bot]
aws-cdk-automation
Describe the bug
I was trying to secure all strings in ssm parameter group and I found the cdk-bootstrap version there and I changed it into securestring, after that any deployment with cdk fails with error
AutomationStack: SSM parameter /cdk-bootstrap/<blabla>/version not a numberExpected Behavior
it should sense and decrypt with the km kwy
Current Behavior
throws me error
Reproduction Steps
secure all strings in ssm parameter group and I found the cdk-bootstrap version there and I changed it into securestring, after that any deployment with cdk fails
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.124.0
Framework Version
No response
Node.js Version
v21.6.1
OS
Windows
Language
Python
Language Version
python 3.10
Other information
No response