Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CodePipeline: AssetsFileRoleDefaultPolicy exceeds IAM policy limit (10KB) when deploying to ~72 targets #19939

Closed
AhmadDaoud opened this issue Apr 15, 2022 · 4 comments · Fixed by #20400
Closed

CodePipeline: AssetsFileRoleDefaultPolicy exceeds IAM policy limit (10KB) when deploying to ~72 targets #19939

AhmadDaoud opened this issue Apr 15, 2022 · 4 comments · Fixed by #20400
Assignees
@rix0rrr
Labels
@aws-cdk/aws-iam Related to AWS Identity and Access Management bug This issue is a bug. effort/medium Medium work item – several days of effort in-progress This issue is being actively worked on. p1

Comments

@AhmadDaoud
Copy link

Describe the bug

In order for CDK actions to deploy to remote accounts/regions, CloudFormation templates and local assets (i.e. Lambda zip files) are uploaded to an assets bucket in each of those accounts/regions.

As the CDK manages AssetsFileRoleDefaultPolicy associated to the IAM role used by CodeBuild to publish those assets, it keeps updating it with allow actions for assuming the remote file-publishing-role roles creating by the bootstrap process. This method of 1 block per account/region pair causes the policy size to exceed IAM policy maximum limit at 72 targets (72 accounts in 1x region, or 31 in 2x regions, etc.).

Expected Behavior

It is common for enterprises to deploy to 100s (if not 1000s of targets). We expect the CDK to allow us to pass our own policies for every stage of the pipeline, including assets publishing stage. We also expect the CDK to be aware of CloudFormation and IAM limits and abstract the complexity of managing those services.

Current Behavior

This is an example of the policy created by the CDK (minified size > 10KB)

{
    "accountsbaseliningpipelinexxxxxxxxxxxx0AssetsFileRoleDefaultPolicyxxxxxxxx": {
        "Type": "AWS::IAM::Policy",
        "Properties": {
            "PolicyDocument": {
                "Statement": [
                    {
                        "Action": [
                            "logs:CreateLogGroup",
                            "logs:CreateLogStream",
                            "logs:PutLogEvents"
                        ],
                        "Effect": "Allow",
                        "Resource": {
                            "Fn::Join": [
                                "",
                                [
                                    "arn:",
                                    {
                                        "Ref": "AWS::Partition"
                                    },
                                    ":logs:region-1:xxxxxxxxxxxx:log-group:/aws/codebuild/*"
                                ]
                            ]
                        }
                    },
                    {
                        "Action": [
                            "codebuild:CreateReportGroup",
                            "codebuild:CreateReport",
                            "codebuild:UpdateReport",
                            "codebuild:BatchPutTestCases",
                            "codebuild:BatchPutCodeCoverages"
                        ],
                        "Effect": "Allow",
                        "Resource": {
                            "Fn::Join": [
                                "",
                                [
                                    "arn:",
                                    {
                                        "Ref": "AWS::Partition"
                                    },
                                    ":codebuild:region-1:xxxxxxxxxxxx:report-group/*"
                                ]
                            ]
                        }
                    },
                    {
                        "Action": [
                            "codebuild:BatchGetBuilds",
                            "codebuild:StartBuild",
                            "codebuild:StopBuild"
                        ],
                        "Effect": "Allow",
                        "Resource": "*"
                    },
                    {
                        "Action": "sts:AssumeRole",
                        "Effect": "Allow",
                        "Resource": [
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-cdkqualifier-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-1"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-cdkqualifier-file-publishing-role-${AWS::AccountId}-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            },
                            {
                                "Fn::Sub": "arn:${AWS::Partition}:iam::xxxxxxxxxxxx:role/cdk-cdkqualifier-file-publishing-role-xxxxxxxxxxxx-region-2"
                            }
                        ]
                    },
                    {
                        "Action": [
                            "s3:GetObject*",
                            "s3:GetBucket*",
                            "s3:List*"
                        ],
                        "Effect": "Allow",
                        "Resource": [
                            {
                                "Fn::GetAtt": [
                                    "accountsbaseliningpipelinexxxxxxxxxxxx0skeletonArtifactsBucket2201989E",
                                    "Arn"
                                ]
                            },
                            {
                                "Fn::Join": [
                                    "",
                                    [
                                        {
                                            "Fn::GetAtt": [
                                                "accountsbaseliningpipelinexxxxxxxxxxxx0skeletonArtifactsBucket2201989E",
                                                "Arn"
                                            ]
                                        },
                                        "/*"
                                    ]
                                ]
                            }
                        ]
                    },
                    {
                        "Action": [
                            "kms:Decrypt",
                            "kms:DescribeKey"
                        ],
                        "Effect": "Allow",
                        "Resource": {
                            "Fn::GetAtt": [
                                "accountsbaseliningpipelinexxxxxxxxxxxx0skeletonArtifactsBucketEncryptionKeyF3A5899F",
                                "Arn"
                            ]
                        }
                    }
                ],
                "Version": "2012-10-17"
            },
            "PolicyName": "accountsbaseliningpipelinexxxxxxxxxxxx0AssetsFileRoleDefaultPolicyxxxxxxxx",
            "Roles": [
                {
                    "Ref": "accountsbaseliningpipelinexxxxxxxxxxxx0AssetsFileRolexxxxxxxx"
                }
            ]
        },
        "Metadata": {
            "aws:cdk:path": "cdk-deployment-pipelines/accounts-baselining-pipeline-3-xxxxxxxxxxxx/Assets/FileRole/DefaultPolicy/Resource"
        }
    }
}

Reproduction Steps

You can reproduce the issue by creating a CodePipeline with actions deploying assets to ~72 account/region pairs.

Possible Solution

Similar to the CodePipeline Pipeline role that we can pass, allowing us to pass an assets publishing role or policy would solve the problem.

Additional Information/Context

No response

CDK CLI Version

2.20.0

Framework Version

No response

Node.js Version

6.14.15

OS

Amazon Linux 2

Language

Python

Language Version

Python 3.8.13

Other information

No response
@AhmadDaoud AhmadDaoud added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Apr 15, 2022
@github-actions github-actions bot added the @aws-cdk/aws-iam Related to AWS Identity and Access Management label Apr 15, 2022
@AhmadDaoud AhmadDaoud changed the title CodePipeline: Assets file role policy Exceeds IAM policy limit (10KB) when deploying to 72 targets CodePipeline: AssetsFileRoleDefaultPolicy exceeds IAM policy limit (10KB) when deploying to ~72 targets Apr 15, 2022
@github-actions github-actions bot added the @aws-cdk/aws-codepipeline Related to AWS CodePipeline label Apr 15, 2022
@peterwoodworth
Copy link
Contributor

This is a common issue unfortunately, we're tracking all the issues similar to this here and are trying to figure out the best ways to approach this problem. Thanks for sharing your experience 🙂

@peterwoodworth peterwoodworth added p1 and removed @aws-cdk/aws-codepipeline Related to AWS CodePipeline needs-triage This issue or PR still needs to be triaged. labels Apr 19, 2022
@rix0rrr rix0rrr mentioned this issue Apr 20, 2022
Closed
rix0rrr added a commit that referenced this issue May 3, 2022
@rix0rrr
fix(pipelines): policy size too large at around ~70 actions
aab2603 
Two changes:

- Collapse CodeBuild action Roles: each CodeBuild step used to create a
  fresh Role to run the CodeBuild action. Change to use one Role for all
  CodeBuild actions. This saves a lot of resources and policy space when
  using a lot of CodeBuild steps, and doesn't appreciably change the
  security posture of the Pipeline (note: this is *not* about the
  Execution Role of the CodeBuild projects, this is about the Role
  assumed by the Pipeline to initiate execution of the Project).
- If inline policies grow bigger than 10k, split additional statements
  off into ManagedPolicies.

Since we want to do the splitting post-merging (to get the most bang for
our buck), we now need to do statement merging during the `prepare`
phase (that is, pre-rendering, instead of post-rendering). That means it
had to be modified to work on `PolicyStatement` objects, instead of on
raw IAM JSON documents.

Closes #19276, closes #19939, closes #19835.
rix0rrr added a commit that referenced this issue May 3, 2022
@rix0rrr
fix(pipelines): policy size too large at around ~70 actions
fbdd9e8 
Two changes:

- Collapse CodeBuild action Roles: each CodeBuild step used to create a
  fresh Role to run the CodeBuild action. Change to use one Role for all
  CodeBuild actions. This saves a lot of resources and policy space when
  using a lot of CodeBuild steps, and doesn't appreciably change the
  security posture of the Pipeline (note: this is *not* about the
  Execution Role of the CodeBuild projects, this is about the Role
  assumed by the Pipeline to initiate execution of the Project).
- If inline policies grow bigger than 10k, split additional statements
  off into ManagedPolicies.

Since we want to do the splitting post-merging (to get the most bang for
our buck), we now need to do statement merging during the `prepare`
phase (that is, pre-rendering, instead of post-rendering). That means it
had to be modified to work on `PolicyStatement` objects, instead of on
raw IAM JSON documents.

Closes #19276, closes #19939, closes #19835.
@rix0rrr rix0rrr mentioned this issue May 3, 2022
Closed
@skinny85 skinny85 added effort/medium Medium work item – several days of effort in-progress This issue is being actively worked on. labels May 4, 2022
@skinny85 skinny85 removed their assignment May 4, 2022
@sozonnyk sozonnyk mentioned this issue May 16, 2022
Closed
rix0rrr added a commit that referenced this issue May 18, 2022
@rix0rrr
fix(pipelines): too many CodeBuild steps inflate policy size
b539164 
(This change has been split off from #20189 because that PR was growing
too big)

Collapse CodeBuild action Roles: each CodeBuild step used to create a
fresh Role to run the CodeBuild action. Change to use one Role for all
CodeBuild actions. This saves a lot of resources and policy space when
using many CodeBuild steps, and doesn't appreciably change the
security posture of the Pipeline (note: this is not about the
Execution Role of the CodeBuild projects, this is about the Role
assumed by the Pipeline to initiate execution of the Project).

Relates to #19276, #19939, #19835.
@rix0rrr rix0rrr mentioned this issue May 18, 2022
Merged
4 tasks
rix0rrr added a commit that referenced this issue May 18, 2022
@rix0rrr
fix(iam): Role policies cannot grow beyond 10k
b6dcca2 
We add all Role policy statements to the Inline policy, which
has a maximums size of 10k. Especially when creating CDK Pipelines
that deploy to a lot of environments, the list of Role ARNs
the Pipeline should be allowed to assume exceeds this size.

Roles also have the ability to have Managed Policies attached
(10 by default, 20 with a quota increase), each of them can be 6k
in size. By spilling over from inline policies into Managed Policies
we can get a total of 70k of statements attached to reach Role.

This PR introduces `IComparablePrincipal` to be able to value-compare
two principals: since we want to merge first before we split (to get the
most bang for our buck), we now need to do statement merging during the
prepare phase, while we are still working on the object graph (instead
of the rendered CloudFormation template).
* That means statement merging had to be modified to work on
  PolicyStatement objects, which requires being able to compare
  Principal objects.

Closes #19276, closes #19939, closes #19835.
@rix0rrr rix0rrr mentioned this issue May 18, 2022
Merged
4 tasks
mergify bot pushed a commit that referenced this issue May 24, 2022
@rix0rrr
fix(pipelines): too many CodeBuild steps inflate policy size (#20396)
f334060 
(This change has been split off from #20189 because that PR was growing
too big)

Collapse CodeBuild action Roles: each CodeBuild step used to create a
fresh Role to run the CodeBuild action. Change to use one Role for all
CodeBuild actions. This saves a lot of resources and policy space when
using many CodeBuild steps, and doesn't appreciably change the
security posture of the Pipeline (note: this is not about the
Execution Role of the CodeBuild projects, this is about the Role
assumed by the Pipeline to initiate execution of the Project).

Relates to #19276, #19939, #19835.


----

### All Submissions:

* [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md)

### Adding new Unconventional Dependencies:

* [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md/#adding-new-unconventional-dependencies)

### New Features

* [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/master/INTEGRATION_TESTS.md)?
	* [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)?

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@mergify mergify bot closed this as completed in #20400 May 25, 2022
@github-actions
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

@Aayush-gupta10
Copy link

Aayush-gupta10 commented Jul 11, 2022 •
edited

Hi, do we get the solution of the above described problem, I am facing the same. @AhmadDaoud
@peterwoodworth

@skinny85
Copy link
Contributor

@Aayush-gupta10 this issue should have been fixed by #20400, and available in version 2.26.0 or later. Make sure to upgrade CDK to the appropriate version, and that you have the @aws-cdk/aws-iam:minimizePolicies feature flag set to true in your cdk.json file.

If you did all that, and things are still not working, please open a new issue (this one is closed already), showing your code, the command you're running, and the error that you get.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rix0rrr rix0rrr

Labels
@aws-cdk/aws-iam Related to AWS Identity and Access Management bug This issue is a bug. effort/medium Medium work item – several days of effort in-progress This issue is being actively worked on. p1
Projects
None yet
Milestone
No milestone
5 participants
@skinny85 @rix0rrr @AhmadDaoud @Aayush-gupta10 @peterwoodworth