feat(codepipeline): validate that source actions are in the same region as the pipeline (#4303)

This is something that the CodePipeline API enforces in the backend,
so we should validate it before, at synthesis time.

Author: skinny85

packages/@aws-cdk/aws-codepipeline/lib/pipeline.ts

@@ -3,7 +3,7 @@ import iam = require('@aws-cdk/aws-iam');
 import kms = require('@aws-cdk/aws-kms');
 import s3 = require('@aws-cdk/aws-s3');
 import { App, Construct, Lazy, PhysicalName, RemovalPolicy, Resource, Stack, Token } from '@aws-cdk/core';
-import { IAction, IPipeline, IStage } from "./action";
+import { ActionCategory, IAction, IPipeline, IStage } from "./action";
 import { CfnPipeline } from './codepipeline.generated';
 import { CrossRegionSupportConstruct, CrossRegionSupportStack } from './cross-region-support-stack';
 import { FullActionDescriptor } from './full-action-descriptor';
@@ -402,6 +402,11 @@ export class Pipeline extends PipelineBase {
       };
     }
 
+    // source actions have to be in the same region as the pipeline
+    if (action.actionProperties.category === ActionCategory.SOURCE) {
+      throw new Error(`Source action '${action.actionProperties.actionName}' must be in the same region as the pipeline`);
+    }
+
     // check whether we already have a bucket in that region,
     // either passed from the outside or previously created
     let crossRegionSupport = this._crossRegionSupport[actionRegion];

packages/@aws-cdk/aws-codepipeline/test/fake-source-action.ts

@@ -6,6 +6,8 @@ export interface FakeSourceActionProps extends codepipeline.CommonActionProps {
   output: codepipeline.Artifact;
 
   extraOutputs?: codepipeline.Artifact[];
+
+  region?: string;
 }
 
 export class FakeSourceAction implements codepipeline.IAction {

packages/@aws-cdk/aws-codepipeline/test/test.pipeline.ts

@@ -46,6 +46,26 @@ export = {
     },
 
     'that is cross-region': {
+      'validates that source actions are in the same account as the pipeline'(test: Test) {
+        const app = new cdk.App();
+        const stack = new cdk.Stack(app, 'PipelineStack', { env: { region: 'us-west-1', account: '123456789012' }});
+        const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
+        const sourceStage = pipeline.addStage({
+          stageName: 'Source',
+        });
+        const sourceAction = new FakeSourceAction({
+          actionName: 'FakeSource',
+          output: new codepipeline.Artifact(),
+          region: 'ap-southeast-1',
+        });
+
+        test.throws(() => {
+          sourceStage.addAction(sourceAction);
+        }, /Source action 'FakeSource' must be in the same region as the pipeline/);
+
+        test.done();
+      },
+
       'allows passing an Alias in place of the KMS Key in the replication Bucket'(test: Test) {
         const app = new cdk.App();