cdklabs / cdk-pipelines-github

Apache License 2.0
342 stars 36 forks source link

AWSCredentialsProvider.Credential_steps(region=XXX) not working #926

Open hogbinj opened 6 months ago

hogbinj commented 6 months ago

Not sure if this is a bug or working as designed.

aws_creds: AwsCredentialsProvider = AwsCredentials.from_git_hub_secrets(
            access_key_id="AWS_ACCESS_KEY_ID_DEV_EU_WEST_1",
            secret_access_key="AWS_SECRET_ACCESS_KEY_DEV_EU_WEST_1",
        )
aws_creds.credential_steps(region="eu-west-1)

Produces:

 - name: Authenticate Via GitHub Secrets
   uses: aws-actions/configure-aws-credentials@v4
   with:
      aws-region: us-west-2
      role-duration-seconds: 1800
      role-skip-session-tagging: true
      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_DEV_EU_WEST_1 }}
      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_DEV_EU_WEST_1 }}

It seems the setup is always the same so can patch it at the end of things

 def update_region_git_hub_secrets(self, env: Environment, asset: str) -> JsonPatch:
        return JsonPatch.replace(f"/jobs/{asset}/steps/2/with/aws-region", env.region) 

assets_to_update = ["Assets-DockerAsset1", "Assets-DockerAsset2", "Assets-FileAsset1", "Assets-FileAsset2", "Assets-FileAsset3"]
for asset in assets_to_update:
    patch = self.update_region_git_hub_secrets(env=env, asset=asset)
    deploy_workflow.patch(patch)
kaizencc commented 6 months ago

Hi @hogbinj, I'm not certain what the unexpected behavior is. Do you mind laying it out a bit clearer for me?

hogbinj commented 6 months ago

if you leave it as standard and your credentials are in a different AWS Region than us-west-2 or whatever then it cannot retrieve them and the job fails