Default credentials can not be used to assume new style deployment roles

Question

Following pipelines readme to set up a deployment pipeline, I ran

$ env CDK_NEW_BOOTSTRAP=1 npx cdk bootstrap \
    --cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess \
    aws://[ACCOUNT_ID]/us-west-2

to create the necessary roles. I would assume the roles would automatically add sts assume role permissions from my account principle. However, when I run cdk deploy I get the following warning

current credentials could not be used to assume 'arn:aws:iam::[ACCOUNT_ID]:role/cdk-hnb659fds-file-publishing-role-[ACCOUNT_ID]-us-west-2', but are for the right account. Proceeding anyway.

I have root credentials in ~/.aws/credentials.

Looking at the deploy role policy, I don't see any sts permissions. What am I missing?

Answer 1

You will need to add permission to assume the role to the credentials from which you are trying to execute cdk deploy

{
  "Sid": "assumerole",
  "Effect": "Allow",
  "Action": [
     "sts:AssumeRole",
     "iam:PassRole"
  ],
  "Resource": [
     "arn:aws-cn:iam::*:role/cdk-readOnlyRole",
     "arn:aws-cn:iam::*:role/cdk-hnb659fds-deploy-role-*",
     "arn:aws-cn:iam::*:role/cdk-hnb659fds-file-publishing-*"
  ]
}

Answer 2

1. First thing you need to do is enabling the verbose mode to see what is actually happenning.

   cdk deploy --verbose
   

   If you see similar message below. Continue with step 2. Otherwise, you need to address the problem by understanding the error message.

   Could not assume role in target account using current credentials User: arn:aws:iam::XXX068599XXX:user/cdk-access is not authorized to perform: sts :AssumeRole on resource: arn:aws:iam::XXX068599XXX:role/cdk-hnb659fds-deploy-role-XXX068599XXX-us-east-2 . Please make sure that this role exists i n the account. If it doesn't exist, (re)-bootstrap the environment with the right '--trust', using the latest version of the CDK CLI.

2. Check S3 buckets related to CDK and CloudFormation stacks from AWS Console. Delete them manually.

3. Enable the new style bootstrapping by one of the method mentioned here

4. Bootstrap the stack using below command. Then it should create all required roles automatically.

   cdk bootstrap --trust=ACCOUNT_ID --cloudformation-execution-policies=arn:aws:iam::aws:policy/AdministratorAccess --verbose
   

NOTE: If you are working with docker image assets, make sure you have setup your repository before you deploy. New style bootstrapping does not create the repos automatically for you as mentioned in this comment.

Answer 3

This may be of use to somebody... The issue could be a mismatch of regions. I spotted it in verbose mode - the roles were created for us-east-1 but I had specified eu-west-2 in the bootstrap. For some reason it had not worked. The solution was to set the region (by adding AWS_REGION=eu-west-2 before the cdk deploy command).

Answer 4

I ran into a similar error. The critical part of my error was

failed: Error: SSM parameter /cdk-bootstrap/<>/version not found.

I had to re-run using the new bootstrap method that creates the SSM parameter. To run the new bootstrap method first set CDK_NEW_BOOTSTRAP via export CDK_NEW_BOOTSTRAP=1

Answer 5

Don't forget to run cdk bootstrap with those credentials against your account [ACCOUNT_ID].