search

aws / aws-cdk

The AWS Cloud Development Kit is a framework for defining cloud infrastructure in code
https://aws.amazon.com/cdk
Apache License 2.0
11.62k stars 3.91k forks source link

withoutPolicyUpdates method not available in IAM Role #5902

Closed niranjan2020 closed 4 years ago

niranjan2020 commented 4 years ago

I have I am writing AWS CDK scripts using Python. I have updated my project to 1.21.1 (build 842cc5f).

Default task execution role and policy is getting created when I create container definition

container = task_definition.add_container(
            "mw-service",
            image=ecs.ContainerImage.from_registry("123.dkr.ecr.ap-southeast-2.amazonaws.com/location/location-service:latest"),
            memory_limit_mib=3072,
            logging = ecs.AwsLogDriver(stream_prefix='MerchServices', log_group=logDetails))

Below role is creating

MWSECSTaskExecutionRole40529A5B:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: "2012-10-17"
    Metadata:
      aws:cdk:path: location-agent-cdk/MWSECSTaskExecutionRole/Resource
  MWSECSTaskExecutionRoleDefaultPolicyEDA68720:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
            - Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Effect: Allow
            Resource:
              Fn::GetAtt:
                - MerchWebServicesLogGroup94598F8F
                - Arn
        Version: "2012-10-17"
      PolicyName: MWSECSTaskExecutionRoleDefaultPolicyEDA68720
      Roles:
        - Ref: MWSECSTaskExecutionRole40529A5B

I updated my cdk project to latest version 1.21 and try to call withoutPolicyUpdates method on role.

task_definition = ecs.Ec2TaskDefinition( self, "TaskDef", execution_role=MWSECSTaskExecutionRole.withoutPolicyUpdates// This method I dont see on roles )

Here I cant access withoutPolicyUpdates method on role. Can someone help me to use it appropriately. Thanks

skinny85 commented 4 years ago

Thanks for opening the issue @niranjan2020 . Can you show the code that creates MWSECSTaskExecutionRole?

niranjan2020 commented 4 years ago 
container = task_definition.add_container(
            "mw-service",
            image=ecs.ContainerImage.from_registry("123.dkr.ecr.ap-southeast-2.amazonaws.com/location/location-service:latest"),
            memory_limit_mib=3072,
            logging = ecs.AwsLogDriver(stream_prefix='MerchServices', log_group=logDetails))
niranjan2020 commented 4 years ago

Whenever I add above code taskexecutionrole will create automatically.

skinny85 commented 4 years ago

I mean in this code:

task_definition = ecs.Ec2TaskDefinition(
self, "TaskDef", execution_role=MWSECSTaskExecutionRole.withoutPolicyUpdates// This method I dont see on roles
)

where does MWSECSTaskExecutionRole come from?

niranjan2020 commented 4 years ago

MWSECSTaskExecutionRole = iam.Role(self, 'MWSECSTaskExecutionRole', assumed_by=iam.ServicePrincipal('ecs-tasks.amazonaws.com'))

skinny85 commented 4 years ago

Ah. I believe you want MWSECSTaskExecutionRole.without_policy_updates().

niranjan2020 commented 4 years ago

Yes exactly

skinny85 commented 4 years ago

Meaning... is the issue solved?

niranjan2020 commented 4 years ago

no no I do not see without_policy_updates method in intellisence

skinny85 commented 4 years ago

Can you share the output of pip list?

niranjan2020 commented 4 years ago

What is Pip list? How Can i do this?

skinny85 commented 4 years ago

Execute the command pip list in your CDK project.

niranjan2020 commented 4 years ago 
Package                             Version   Location
----------------------------------- --------- ------------------------------------------------------------------
appdirs                             1.4.3
atomicwrites                        1.3.0
attrs                               19.3.0
aws-cdk.assets                      1.18.0
aws-cdk.aws-apigateway              1.18.0
aws-cdk.aws-applicationautoscaling  1.18.0
aws-cdk.aws-autoscaling             1.18.0
aws-cdk.aws-autoscaling-common      1.18.0
aws-cdk.aws-autoscaling-hooktargets 1.18.0
aws-cdk.aws-certificatemanager      1.18.0
aws-cdk.aws-cloudformation          1.18.0
aws-cdk.aws-cloudfront              1.18.0
aws-cdk.aws-cloudwatch              1.18.0
aws-cdk.aws-ec2                     1.18.0
aws-cdk.aws-ecr                     1.18.0
aws-cdk.aws-ecr-assets              1.18.0
aws-cdk.aws-ecs                     1.18.0
aws-cdk.aws-elasticloadbalancing    1.18.0
aws-cdk.aws-elasticloadbalancingv2  1.18.0
aws-cdk.aws-events                  1.18.0
aws-cdk.aws-iam                     1.18.0
aws-cdk.aws-kms                     1.18.0
aws-cdk.aws-lambda                  1.18.0
aws-cdk.aws-logs                    1.18.0
aws-cdk.aws-route53                 1.18.0
aws-cdk.aws-route53-targets         1.18.0
aws-cdk.aws-s3                      1.18.0
aws-cdk.aws-s3-assets               1.18.0
aws-cdk.aws-secretsmanager          1.18.0
aws-cdk.aws-servicediscovery        1.18.0
aws-cdk.aws-sns                     1.18.0
aws-cdk.aws-sns-subscriptions       1.18.0
aws-cdk.aws-sqs                     1.18.0
aws-cdk.aws-ssm                     1.18.0
aws-cdk.cdk                         0.36.1
aws-cdk.core                        1.18.0
aws-cdk.cx-api                      1.18.0
aws-cdk.region-info                 1.18.0
beautifulsoup4                      4.8.1
boto3                               1.10.25
botocore                            1.13.25
cattrs                              0.9.0
certifi                             2019.9.11
chardet                             3.0.4
colorama                            0.4.1
coloredlogs                         10.0
configparser                        4.0.2
docutils                            0.15.2
entrypoints                         0.3
humanfriendly                       4.18
hvac                                0.9.6
idna                                2.8
importlib-metadata                  0.23
jmespath                            0.9.4
jsii                                0.20.8
kdk.aws-cfn                         1.0
kdk.aws-role                        1.0
kdk.controlm                        1.0
kdk.core                            1.0
kdk.env                             1.0
kdk.vault                           1.0
keyring                             19.2.0
more-itertools                      7.2.0
my-setup                            0.0.1     c:\users\ngodbole\documents\merchwebservices\simplify\simplify\aws
mypy-extensions                     0.4.3
netaddr                             0.7.19
packaging                           19.2
pip                                 19.0.3
pluggy                              0.13.1
psutil                              5.6.5
publication                         0.0.3
py                                  1.8.0
pyparsing                           2.4.5
pyreadline                          2.1
pytest                              5.3.0
python-dateutil                     2.8.0
pywin32-ctypes                      0.2.0
PyYAML                              5.1.2
requests                            2.22.0
retrying                            1.3.3
s3transfer                          0.2.1
setuptools                          40.8.0
six                                 1.13.0
soupsieve                           1.9.5
typing-extensions                   3.7.4.1
urllib3                             1.25.7
wcwidth                             0.1.7
zipp                                0.6.0
You are using pip version 19.0.3, however version 20.0.1 is available.
You should consider upgrading via the 'python -m pip install --upgrade pip' command.
skinny85 commented 4 years ago

There's your issue, clear as day:

aws-cdk.aws-iam 1.18.0

You're still on the old version. Update the version in your setup.py, and run pip install --upgrade.

niranjan2020 commented 4 years ago

Hey thanks. In setup.py I have below code. Where I need to change

import setuptools

with open("README.md") as fp:
    long_description = fp.read()

setuptools.setup(
    name="my_setup",
    version="0.0.1",

    description="A sample CDK Python app",
    long_description=long_description,
    long_description_content_type="text/markdown",

    author="author",

    # package_dir={"": "my_subfolder"},
    packages=setuptools.find_packages(),

    install_requires=[
        "aws-cdk.core",
        "aws-cdk.aws_iam",
        "aws-cdk.aws_sqs",
        "aws-cdk.aws_sns",
        "aws-cdk.aws_sns_subscriptions",
        "aws-cdk.aws_s3",
    ],

    python_requires=">=3.6",

    classifiers=[
        "Development Status :: 4 - Beta",

        "Intended Audience :: Developers",

        "License :: OSI Approved :: Apache Software License",

        "Programming Language :: JavaScript",
        "Programming Language :: Python :: 3 :: Only",
        "Programming Language :: Python :: 3.6",
        "Programming Language :: Python :: 3.7",
        "Programming Language :: Python :: 3.8",

        "Topic :: Software Development :: Code Generators",
        "Topic :: Utilities",

        "Typing :: Typed",
    ],
)
skinny85 commented 4 years ago

In this case, pip install --upgrade should be enough.

niranjan2020 commented 4 years ago

Fixed my issue. Thanks a lot

skinny85 commented 4 years ago

NP.