Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

route53: CrossAccountZoneDelegationRecord broken in opt-in regions #23081

Closed
rix0rrr opened this issue Nov 25, 2022 · 1 comment · Fixed by #23082
Closed

route53: CrossAccountZoneDelegationRecord broken in opt-in regions #23081

rix0rrr opened this issue Nov 25, 2022 · 1 comment · Fixed by #23082
Assignees
@comcalvi
Labels
@aws-cdk/aws-route53 Related to Amazon Route 53 bug This issue is a bug. effort/small Small work item – less than a day of effort p1

Comments

@rix0rrr
Copy link
Contributor

rix0rrr commented Nov 25, 2022 •
edited

Describe the bug

The changes introduced in #22370 (in response to #22022) seem to have broken some internal Amazon customers.

  • The STS AssumeRole call now fails because the target account is not opted in to the region.

It seems Route53 is a global (partitional) service so there is only one endpoint.

Original motivation for the change

The original motivation for the change seems to have been:

In our case, this was due to our use of a global service principal in the delegation role's trust policy, and opt-in accounts are not visible in such a service principal. One possible workaround is to add either regional service principals or opt-in account IDs directly to the trust policy, but this is not desirable as it requires updating the delegation role for each new opt-in region.

The response to this was to change the endpoints to regional, but that may have been a premature fix.

The original reporter was an AWS employee, capable of creating their own Service Principals, and they were using Service Principals in the trust policy. External customers would be using an Organization ID or Account number here.

We need to revert this.
@rix0rrr rix0rrr added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Nov 25, 2022
@github-actions github-actions bot added the @aws-cdk/aws-route53 Related to Amazon Route 53 label Nov 25, 2022
rix0rrr added a commit that referenced this issue Nov 25, 2022
@rix0rrr
fix(route53): cross-account delegation broken in opt-in regions
ba930bc 
This is a revert of #22370. The fix proposed there solved one very
specific (but rare) use case, in exchange for breaking common use cases.

- *It fixed the case of*: AWS service authors using their own global
  service principal in the delegation role, with both source and target
  account opted into the region.
- *It broke the case of*: all teams that didn't have both accounts opted
  into the region.

The second case is much more common, so revert to the old behavior.

Since the regional behavior might still be useful to *some* people
somewhere, it has been relegated to a context key,
`@aws-cdk/aws-route53:useRegionalStsEndpoint`, instead. It can be
configured, but is not advertised as 99.9% of users will not need
this behavior.

Since both STS and Route53 are global and regular customers cannot
usefully use Service Principals in this particular trust policy anyway,
there is no impact to regular customers.

Fixes #23081.
@rix0rrr rix0rrr mentioned this issue Nov 25, 2022
Merged
@peterwoodworth peterwoodworth added p1 effort/small Small work item – less than a day of effort and removed needs-triage This issue or PR still needs to be triaged. labels Nov 26, 2022
@mergify mergify bot closed this as completed in #23082 Nov 28, 2022
mergify bot pushed a commit that referenced this issue Nov 28, 2022
@rix0rrr
fix(route53): cross-account delegation broken in opt-in regions (#23082)
5ba35e4 
This is a revert of #22370. The fix proposed there solved one very specific (but rare) use case, in exchange for breaking common use cases.

- *It fixed the case of*: AWS service authors using their own global service principal in the delegation role, with both source and target account opted into the region.
- *It broke the case of*: all teams that didn't have both accounts opted into the region.

The second case is much more common, so revert to the old behavior.

Since the regional behavior might still be useful to *some* people somewhere, it has been relegated to a context key, `@aws-cdk/aws-route53:useRegionalStsEndpoint`, instead. It can be configured, but is not advertised as 99.9% of users will not need this behavior.

Since both STS and Route53 are global and regular customers cannot usefully use Service Principals in this particular trust policy anyway, there is no impact to regular customers.

Fixes #23081.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@github-actions
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

brennanho pushed a commit to brennanho/aws-cdk that referenced this issue Dec 9, 2022
@rix0rrr
fix(route53): cross-account delegation broken in opt-in regions (aws#…
33fe359 
…23082)

This is a revert of aws#22370. The fix proposed there solved one very specific (but rare) use case, in exchange for breaking common use cases.

- *It fixed the case of*: AWS service authors using their own global service principal in the delegation role, with both source and target account opted into the region.
- *It broke the case of*: all teams that didn't have both accounts opted into the region.

The second case is much more common, so revert to the old behavior.

Since the regional behavior might still be useful to *some* people somewhere, it has been relegated to a context key, `@aws-cdk/aws-route53:useRegionalStsEndpoint`, instead. It can be configured, but is not advertised as 99.9% of users will not need this behavior.

Since both STS and Route53 are global and regular customers cannot usefully use Service Principals in this particular trust policy anyway, there is no impact to regular customers.

Fixes aws#23081.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
brennanho pushed a commit to brennanho/aws-cdk that referenced this issue Jan 20, 2023
@rix0rrr
fix(route53): cross-account delegation broken in opt-in regions (aws#…
8deffc7 
…23082)

This is a revert of aws#22370. The fix proposed there solved one very specific (but rare) use case, in exchange for breaking common use cases.

- *It fixed the case of*: AWS service authors using their own global service principal in the delegation role, with both source and target account opted into the region.
- *It broke the case of*: all teams that didn't have both accounts opted into the region.

The second case is much more common, so revert to the old behavior.

Since the regional behavior might still be useful to *some* people somewhere, it has been relegated to a context key, `@aws-cdk/aws-route53:useRegionalStsEndpoint`, instead. It can be configured, but is not advertised as 99.9% of users will not need this behavior.

Since both STS and Route53 are global and regular customers cannot usefully use Service Principals in this particular trust policy anyway, there is no impact to regular customers.

Fixes aws#23081.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@tim-finnigan tim-finnigan mentioned this issue Feb 15, 2023
Closed
brennanho pushed a commit to brennanho/aws-cdk that referenced this issue Feb 22, 2023
@rix0rrr
fix(route53): cross-account delegation broken in opt-in regions (aws#…
eba83a6 
…23082)

This is a revert of aws#22370. The fix proposed there solved one very specific (but rare) use case, in exchange for breaking common use cases.

- *It fixed the case of*: AWS service authors using their own global service principal in the delegation role, with both source and target account opted into the region.
- *It broke the case of*: all teams that didn't have both accounts opted into the region.

The second case is much more common, so revert to the old behavior.

Since the regional behavior might still be useful to *some* people somewhere, it has been relegated to a context key, `@aws-cdk/aws-route53:useRegionalStsEndpoint`, instead. It can be configured, but is not advertised as 99.9% of users will not need this behavior.

Since both STS and Route53 are global and regular customers cannot usefully use Service Principals in this particular trust policy anyway, there is no impact to regular customers.

Fixes aws#23081.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@comcalvi comcalvi

Labels
@aws-cdk/aws-route53 Related to Amazon Route 53 bug This issue is a bug. effort/small Small work item – less than a day of effort p1
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(route53): cross-account delegation broken in opt-in regions aws/aws-cdk
3 participants
@rix0rrr @peterwoodworth @comcalvi