awslabs / aws-codedeploy-plugin

Jenkins plugin for AWS CodeDeploy
Apache License 2.0
153 stars 132 forks source link

Fix cross-account deploys restricted by externalId #117

Open g-andrade opened 1 year ago

g-andrade commented 1 year ago

Issue

It's possible to restrict cross-account deploys to a specific externalId in IAM role policies.

Up until the present fix, however, such deploys with a custom externalId fail with HTTP 403 forbidden; removing the restriction from the IAM policy instantly allows for the deploy to happen.

My understanding of what's happening is:

  1. a new AWSCodeDeployPublisher instance receives the externalId through its constructor and saves it: https://github.com/awslabs/aws-codedeploy-plugin/blob/40d7b24c95edef27f2879037ae1add30fc3f3831/src/main/java/com/amazonaws/codedeploy/AWSCodeDeployPublisher.java#L108-L130
  2. when using "iamRoleArn" as credentials, the instance will retrieve externalId from the descriptor: https://github.com/awslabs/aws-codedeploy-plugin/blob/40d7b24c95edef27f2879037ae1add30fc3f3831/src/main/java/com/amazonaws/codedeploy/AWSCodeDeployPublisher.java#L204-L207
  3. but the descriptor instance initializes its own externalId randomly: https://github.com/awslabs/aws-codedeploy-plugin/blob/40d7b24c95edef27f2879037ae1add30fc3f3831/src/main/java/com/amazonaws/codedeploy/AWSCodeDeployPublisher.java#L460-L464

Description of changes

Functional:

Tooling-related:

[*] closes #107, #115 and #116

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.