cdk diff: in 2.134.0 diff fails if deploy cannot be assumed

[Smeb]

Describe the bug

In our CI we have a readonly role with access to the lookup role, but not the deploy role for non protected branches.

In version 2.133.0 running diff works - in 2.134.0 we get a crash.

For now we fixed it by pinning the previous version.

Expected Behavior

Diffing with a role which can assume the lookup role works

Current Behavior

Diffing with a role which cannot assume deploy fails.

current credentials could not be used to assume '<deploy role>' but are for the right account. Proceeding anyway.
User: <ci_role> is not authorized to perform: cloudformation:DescribeStacks on <stack> because no identity-based policy allows the cloudformation:DescribeStacks action

Not clear what's happening here - I guess after failing to assume the deploy role the current role is the ci role which attempted to assume deploy, and then after DescribeStacks is called.

Reproduction Steps

I don't think I can easily provide this, since you would need to set up the same roles, stacks, etc. This does work with a higher privilege role, which indicates it's to do with the role assumption.

• Bootstrapped CDK
• CDK setup (we use Go, but it seems very clearly to be a permission issue).
• Run cdk diff --all --ci

Possible Solution

Ensure that the lookup role is still used after trying to assume the deploy role and failing.

Additional Information/Context

No response

CDK CLI Version

v2.134.0

Framework Version

No response

Node.js Version

20

OS

Darwin

Language

Go

Language Version

1.22

Other information

No response

[Smeb]

Also: running with the top level role seems like an oversight - in theory that role could have more permissions than intended. I also tried running with --no-changeset, which didn't help.

[Smeb]

On the above, when I run with --no-changeset then my params for the diff have the following:

changeset: false
changeSet: true
'chage-set': true

-> because it should be --change-set=false. There are a couple of places in the codebase where --no-changeset is mentioned which I can update PR

[scanlonp]

Hey @Smeb, once you caught the typo in our docs, did running diff with the correct spelling of the flag solve your issue? I believe in v2.134 that we put logic in exactly for this case, so I want to make sure you are not still running into issues.

[Smeb]

Yes, using the correct flag did work around the issue - I would still expect to not fall back to the parent role though (that, or the change in behaviour would be worth documentation)

[scanlonp]

@Smeb, good to hear. Yes, this should be documented.

Thanks for your PR! We are also adding --changeset as an alias.

[scanlonp]

@Smeb, after some digging, there is a deeper problem here.

Before, if the deploy role could not be assumed, we caught the error in the changeset creation and defaulted back to the classic diff behavior. Now, if the describeStacks call fails, we hard fail.

I have made a PR that both handles the error if describeStacks fails and attempts to use the lookup role for the call in the first place.

Thanks again for reporting this.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.