Cross account deployment using CodeDeployServerDeployAction

[dhirajkhodade]

I am creating a cross account deployment code pipeline to deploy my application to EC2 instance which is in another aws account.
But I don't see account account property of CommonAwsActionProps being used in implementation of this action here - server-deploy-action.ts

Should I implement my own custom action to do a cross account deployment to EC2 instances?

Like I did for cross account deployment to my Elastic beanstalk environments in another aws account which works perfectly. - ElasticBeanstalkDeployAction.ts

[skinny85]

Hey @dhirajkhodade ,

The CodeDeployServerDeployAction passes its underlying CodeDeploy DeploymentGroup through the resource property. So the account and region of the Action will be decided by the account and region of the DeploymentGroup.

Thanks,
Adam

[skinny85]

You pass the ServerDeploymentGroup object from one Stack in account-2 to another Stack in account-1.

[dhirajkhodade]

my architecture is bit different.
I have two different code pipelines one for infra (i.e. ec2 and deployment groups) and another for ci/cd
both pipelines have their own different git repositories.
So I can not really pass objects.

Do you think there is any other way to refer ServerDeploymentGroup of another account ?

It was really easy with cross account deployments to Elastic Beanstalk (although I had to create custom deploy action for EB as suggested by you ) I could just give account number to my deploy action and it will create support stack which I will deploy to account-2 and my pipeline in account-1 will deploy artifacts to EB env in account-2 - like this

[skinny85]

There is a way to refer to an existing ServerDeploymentGroup, and that's through the fromServerDeploymentGroupAttributes() static method on that class.

Note that, since that method only takes in the name of the Deployment Group, not its ARN, you need to import it into a Stack that is in the other account - if you import it into the pipeline's Stack, the CodePipeline construct will think you're referring to something in the same account, and things will not work.

[dhirajkhodade]

I will give it a try.
I think the first approach you told (passing ServerDeploymentGroup object from one Stack in account-2 to another Stack in account-1.) seems more robust will try if can do that without changing lots of things in my current setup.

[dhirajkhodade]

I tried to create separate stack in account-2 for ServerDeploymentGroup and then pass object of that stack to pipeline stack in account-1 but I am getting this error when I run cdk syth command -

Error: Resolution error: Resolution error: Resolution error: Resolution error: Cannot use resource 'DeploymentGroupStack/my-app/Application' in a cross-environment fashion, the resource's physical name must be explicit set or use PhysicalName.GENERATE_IF_NEEDED.

Not sure how to fix this error I tried to give deployment group name as -
deploymentGroupName: PhysicalName.GENERATE_IF_NEEDED but still getting same error.

This is my code for deployment group stack
lib/ec2-deployment-group-stack.ts

interface Ec2DeploymentGroupStackProps extends cdk.StackProps {
  applicationName: string,
}

export class Ec2DeploymentGroupStack extends cdk.Stack {
  public readonly ec2deploymentGroup: codedeploy.IServerDeploymentGroup;
  constructor(scope: cdk.Construct, id: string, props: Ec2DeploymentGroupStackProps) {
    super(scope, id, props);

    this.ec2deploymentGroup = new codedeploy.ServerDeploymentGroup(this, props.applicationName, {
       deploymentGroupName: props.applicationName + "-ec2-deployment-group",
     // deploymentGroupName: PhysicalName.GENERATE_IF_NEEDED,
      ec2InstanceTags: new codedeploy.InstanceTagSet({
        'Name': [props.applicationName],
      }),
    })
  }
}

and here i am trying to pass object of deployment group stack in account-2 to pipeline stack in account-1

bin/my-app-pipeline.ts

const app = new cdk.App();

const envDev = { account: "22222", region: "us-east-1" };
const ec2DeploymentGroupDev=new Ec2DeploymentGroupStack(app,'DeploymentGroupStack',{
    env: envDev,
    applicationName: "my-app"
});
const envShared = { account: "11111", region: "us-east-1" };
const pipeline = new MyAppCodepipelineStack(app, 'MyAppPipelineStackDev', {
    env: envShared, //environment for pipeline which will always be Shared account
    applicationName: "my-app",
    ec2DeploymentGroup:ec2DeploymentGroupDev.ec2deploymentGroup 
});

pipeline.addDependency(ec2DeploymentGroupDev);

MyAppCodepipelineStack this is the stack which has code for my code pipeline as given below

lib/my-app-pipeline-stack.ts

interface PipelinestackProps extends cdk.StackProps {
  applicationName: string,
  ec2DeploymentGroup:codedeploy.IServerDeploymentGroup
}

export class GiCrportCodepipelineStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props: PipelinestackProps) {
    super(scope, id, props);

    const pipeline = new codepipeline.Pipeline(this, "my-pipeline", {
      pipelineName: "my-app-pipeline",
      stages: [
      //rest of code like source and build stage is removed to make it small code snippet for reference
        {
          stageName: "deploy-to-dev",
          actions: [
            new codepipeline_actions.CodeDeployServerDeployAction({
              actionName: "deploy-to-"+props.applicationName + "-ec2",
              input: appBuildOutput,
              deploymentGroup: props.ec2DeploymentGroup  // this object is comming from deployment group stack in account-2
          })
          ]
        }
      ]
    });
  }
}

[skinny85]

Notice that the error message talks about an Application. You might have to do:

    const application = new codedeploy.ServerApplication(this, 'App', {
      applicationName: PhysicalName.GENERATE_IF_NEEDED,
    });
    this.ec2deploymentGroup = new codedeploy.ServerDeploymentGroup(this, props.applicationName, {
      deploymentGroupName: PhysicalName.GENERATE_IF_NEEDED,
      application: application,
      ec2InstanceTags: new codedeploy.InstanceTagSet({
        'Name': [props.applicationName],
      }),
    });

[dhirajkhodade]

ahh Silly me.
Thanks for pointing that out.
Now my code pipeline could trigger the Deployment in target account-2 however my deployment is failing at DownloadBundle deployment event with error

Access Denied

This is because my artifact's s3 bucket is in source account-1 and my deployment group in target account-2 is not able to access that bucket to download the artifacts.

const appBuildOutput = new codepipeline.Artifact();

{
stageName: "deploy-to-ec2",
actions: [
        new codepipeline_actions.CodeDeployServerDeployAction({
            actionName: "deploy-to-ec2",
            input: appBuildOutput,
            deploymentGroup: new codedeploy.ServerDeploymentGroup(this, "applicationName" , {
                ec2InstanceTags: new codedeploy.InstanceTagSet({
                    // any instance with tags satisfying
                    // key1=v1 or key1=v2 or key2 (any value) or value v3 (any key)
                    // will match this group
                    'Name': ["applicationName"],
                })
            }),
        })
    ]
}

I know we can give target account's deployment group role access to source account s3 bucket manually from aws dashboard.

But I couldn't figure out way to give my acount-2's ServerDeploymentGroup access to my account-1's artifact object appBuildOutput in my cdk code.

I am trying to do something like this - Issue-3765

[dhirajkhodade]

I found the issue.
As my EC2 instances were already created and were not part of cdk stack the ec2 instance profile didn't have access to KMS key of my artifacts bucket. I had to give s3 bucket and KMS key access to my instance profile and it started working as expected.

[skinny85]

I'm glad you figured it out @dhirajkhodade 🙂.

Would you mind opening us an issue about the use case you ran into? I feel like going

    new codedeploy.ServerDeploymentGroup(this, props.applicationName, {
      deploymentGroupName: PhysicalName.GENERATE_IF_NEEDED,
    });

should automatically create the Application owning the Deployment Group also with PhysicalName.GENERATE_IF_NEEDED.

[dhirajkhodade]

Sure. Here it is - issue #13337

[skinny85]

Thank you so much!

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.