(cli): Watch mode doesn't assume-role for cross-account deploys

[mikestopcontinues]

Describe the bug

Simply adding --watch breaks cross-account deploys.

Expected Behavior

🚀

Current Behavior

❌  SomeStack failed: Error: Need to perform AWS calls for account 000000000000, but the current credentials are for 111111111111

Reproduction Steps

Take any cross-account deploy and try to watch for changes. I reproduced the effect in two projects.

Possible Solution

My only guess is that it was simply forgotten in the watch implementation. Or that it was excluded for speed?

Additional Information/Context

Thanks!

CDK CLI Version

2.29.1

Framework Version

No response

Node.js Version

16.x

OS

OSX 12.3.1

Language

Typescript

Language Version

No response

Other information

No response

[rix0rrr]

I think you are right (this is actually not about --watch but about --hotswap, although one implies the other), and if I recall correctly this was an intentional omission of the cdk watch MVP launch (though I see it currently goes undocumented).

The reason is that the bootstrap roles are laid out as follows:

• deploy-role
  • can be assumed by the CLI
  • allowed to call cloudformation:CreateChangeSet (only)
• cfn-exec-role
  • can be assumed by CloudFormation (and only by CloudFormation)
  • allowed to call lambda:UpdateFunctionCode

To do a --hotswap deployment however, we need a role that:

• Can be assumed by the CLI
• Can call lambda:UpdateFunctionCode

And there is currently no such role.

I will update the documentation to document this limitation. It's a somewhat significant engineering project to fix this, so don't count on it any time soon.

In the mean time, I would suggest you get the target account credentials directly and invoke the CLI with the credentials in the shell.

[rix0rrr]

It was in fact documented already: https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk/README.md#hotswap-deployments-for-faster-development

[mikestopcontinues]

Good to know! I wish there was a single spot for documentation. I live in the API docs and the AWS docs. You don't typically find projects with an official doc site where the readme has anything of interest.