[BUG] Upgrade from v1.30.1 to v1.32.0 causing No export named ${App}-ArtifactKey found

[sumar-triniti]

We have static website deployed using copilot. Today we update the copilot cli to v1.32.0 and we unable to deploy again.

Log:

 copilot svc deploy --app myapp --name app --env development
- Updating the infrastructure for stack myapp-development-app                         [update rollback complete]  [12.4s]
  No export named myapp-ArtifactKey found                                                                         
  - Request and validate the certificate for your Static Site                            [not started]               
  - A CloudFront distribution for global content delivery                                [not started]               
  - An IAM Role for the state machine that moves source files to the S3 bucket           [not started]               
  - A state machine that moves source files to the S3 bucket                             [not started]               
  - Add A-records for your Static Site alias                                             [not started]               
  - A custom resource that starts the process of moving files to the S3 bucket           [not started]               
  - An IAM Role for the lambda that starts the process of moving files to the S3 bucket  [not started]               
  - A lambda that starts the process of moving files to the S3 bucket                    [not started]               
✘ deploy service app to environment development: deploy service: stack myapp-development-app did not complete successfully and exited with status UPDATE_ROLLBACK_COMPLETE

[Lou1415926]

@sumar-triniti I'm sorry that you are facing issue after upgrading! It is true that static site only started using the app-level artifact key from v1.32.0; however, what's baffling is that the said key - myapp-ArtifactKey should be always exported.

Can you take a look at a stack named "Stackset-myapp-infrastructure-", from the same region as "development" environment, then go to the "Outputs" tab, see if you can find something like this:

[sumar-triniti]

Hi @Lou1415926 here is my 'StackSet-myapp-infrastructure-' outputs:

Another details about our infrastructure: we have separated aws account:

• shared
• dev
• stag
• prod

Stackset-myapp-infrastructure- is at shared account, and all workload is at dev/stag/prod account.

[Lou1415926]

Thanks for sharing the information. The last bit is extremely helpful!

I can confirm that this is a bug from v1.32.0. From https://github.com/aws/copilot-cli/pull/5329/files, the static site's CopyAssetsStateMachineRole role stated having the permission to decrypt the KMS key stored in the app account. However, CFN import doesn't work for cross account.

I am testing a workaround before I suggest it to you! Thanks for the patience.

[sumar-triniti]

I am glad to hear that you already figured out the problem and testing a workaround. Thank you

[Lou1415926]

Okay! To unblock you for now, you can use this YAML patch for your static site:

- op: add
  path: /Mappings
  value:
    KMSKeyArn:
      dev:
        KMSKey: <key arn in "dev"'s region, app account, can be found in the "Outputs" section of the "StackSet-myapp-infrastructure-xxx" stack>
      stag:
        KMSKey: <key arn in "stag"'s region, app account>
      prod:
        KMSKey: <key arn in "prod"'s region, app account>
- op: replace
  path: /Resources/CopyAssetsStateMachineRole/Properties/Policies/0/PolicyDocument/Statement/1/Resource
  value: !FindInMap
    - KMSKeyArn
    - !Ref EnvName
    - KMSKey

[sumar-triniti]

Tested the workaround, i can confirm it work i can deploy existing static site app and new static site app.
Thanks

[sumar-triniti]

Another issue that might related. service package command is not work:

copilot-linux-amd64-v1.32.0 svc package --name app --env production

✘ generate workload app template against environment production: override template: invalid template: yaml: line 326: mapping values are not allowed in this context

That happen with any override, for example

- op: add
  path: /Resources/CloudFrontDistribution/Properties/DistributionConfig/HttpVersion
  value: http2 

[KollaAdithya]

Hey @sumar-triniti

I am able to reproduce the issue. Thanks for reporting the bug

[iamhopaul123]

Hello! The fix is now released in v1.32.1: https://github.com/aws/copilot-cli/releases/tag/v1.32.1