Bug? in default policy created by CodeBuild with VPC config

[cjyclaire]

https://github.com/awslabs/aws-cdk/blob/master/packages/%40aws-cdk/aws-codebuild/lib/project.ts#L900

`arn:aws:ec2:${Aws.region}:${Aws.accountId}:subnet/[[subnets]]`

instead of [[subnets]], it need to provide actually subnet-ids such as

`arn:aws:ec2:${Aws.region}:${Aws.accountId}:subnet/subnet-dsdas`
...

current policy generated will cause

9/18 | 12:43:58 PM | CREATE_FAILED        | AWS::CodeBuild::Project     | XXX (XXX0DDC635A) Not authorized to perform DescribeSecurityGroups (Service: AWSCodeBuild; Status Code: 400; Error Code: InvalidInputException; Request ID: 4e0ba4fa-6212-11e9-9b2d-15eae6919f60)

I'm guessing the policy content is invalid as when I tried with exact subnet ids, deploy will succeed.

[RomainMuller]

Hey @cjyclaire,

Would you be able to provide a minimal reproduction of your problem? It'll help us solve it faster.

[cjyclaire]

you should be able to reproduce with a vpc and any codebuild project place in the private subnets of the vpc, such as:

// default vpc example
 const vpc = new ec2.VpcNetwork(this, 'Vpc', {
      maxAZs: 2,
      cidr: '10.0.0.0/21',
      enableDnsSupport: true,
      natGateways: 2,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'application',
          subnetType: ec2.SubnetType.Private
        },
        {
          cidrMask: 24,
          name: 'ingress',
          subnetType: ec2.SubnetType.Public
        },
        {
          cidrMask: 28,
          name: 'database',
          subnetType: ec2.SubnetType.Isolated
        },
      ],
    });

  const dbMigration = new codebuild.Project(this, '...', {
      source: new codebuild.CodeCommitSource({ repository: repo}),
      projectName: '...',
      description: '...',
      environment:{
        buildImage: codebuild.LinuxBuildImage.UBUNTU_14_04_RUBY_2_5_1
      },
      buildSpec: 'buildspec-db.yml',
      vpc: vpc,
      subnetSelection: {
        subnetType: ec2.SubnetType.Private
      }
    });

[skinny85]

Thanks for reporting @cjyclaire . Confirming this is a bug on our side.