fix(toolkit): support multiple toolkit stacks in the same environment #1427

eladb · 2018-12-24T15:41:56Z

The --toolkit-stack-name option can be used to specify the name for
the toolkit stack. However, since the the toolkit stack outputs
had "Export"s, which must be unique within an environment, it was
impossible to deploy multiple toolkit stacks.

This change removes the "Export"s as they are actually not used or needed
and also adds an integration test to verify that multiple toolkit stacks
can be deployed into the same environment.

toolkitStackName can also be specified in cdk.json or ~/.cdk.json.
Updated the toolkit documentation topic to describe this.

Fixes #1416

Pull Request Checklist

Testing
- Unit test added
- CLI change?: manually run integration tests and paste output as a PR comment
- CLI init template change?: coordinated update of integration tests with team
Docs
- jsdocs: All public APIs documented
- README: README and/or documentation topic updated
Title and Description
- Change type: title prefixed with fix, feat will appear in changelog
- Title: use lower-case and doesn't end with a period
- Breaking?: last paragraph: "BREAKING CHANGE: <describe what changed + link for details>"
- Issues: Indicate issues fixed via: "Fixes #xxx" or "Closes #xxx"
Sensitive Modules (requires 2 PR approvers)
- IAM Policy Document (in @aws-cdk/aws-iam)
- EC2 Security Groups and ACLs (in @aws-cdk/aws-ec2)
- Grant APIs (only if not based on official documentation with a reference)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.

The --toolkit-stack-name option can be used to specify the name for the toolkit stack. However, since the the toolkit stack outputs had "Export"s, which must be unique within an environment, it was impossible to deploy multiple toolkit stacks. This change removes the "Export"s as they are actually not used or needed and also adds an integration test to verify that multiple toolkit stacks can be deployed into the same environment. `toolkitStackName` can also be specified in `cdk.json` or `~/.cdk.json`. Updated the toolkit documentation topic to describe this. Fixes #1416

eladb · 2018-12-24T15:48:26Z

Toolkit integration tests passed:

============================================================================================
test-cdk-context.sh
============================================================================================
Testing for the context value
Context value contextkey reset. It will be refreshed on the next SDK synthesis run.
No context value with key contextkey
✅  success
============================================================================================
test-cdk-deploy-all.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
cdk-toolkit-integration-test-1
cdk-toolkit-integration-test-1: deploying...
cdk-toolkit-integration-test-1: creating CloudFormation changeset...
 0/2 | 5:42:28 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic (topic69831491)
 0/2 | 5:42:29 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic (topic69831491) Resource creation Initiated
 1/2 | 5:42:39 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic (topic69831491)
 2/2 | 5:42:41 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-1

 ✅  cdk-toolkit-integration-test-1

Stack ARN:
cdk-toolkit-integration-test-2
cdk-toolkit-integration-test-2: deploying...
cdk-toolkit-integration-test-2: creating CloudFormation changeset...
 0/3 | 5:42:59 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37)
 0/3 | 5:42:59 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 0/3 | 5:42:59 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37) Resource creation Initiated
 0/3 | 5:42:59 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F) Resource creation Initiated
 1/3 | 5:43:09 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic1 (topic152D84A37)
 2/3 | 5:43:10 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 3/3 | 5:43:11 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-2

 ✅  cdk-toolkit-integration-test-2

Stack ARN:
Stack deployed successfully
cdk-toolkit-integration-test-1: destroying...
   0 | 5:43:17 PM | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-1 User Initiated
   0 | 5:43:21 PM | DELETE_IN_PROGRESS   | AWS::SNS::Topic | topic (topic69831491)
   1 | 5:43:21 PM | DELETE_COMPLETE      | AWS::SNS::Topic | topic (topic69831491)

 ✅  cdk-toolkit-integration-test-1: destroyed
cdk-toolkit-integration-test-2: destroying...

 ✅  cdk-toolkit-integration-test-2: destroyed
✅  success
============================================================================================
test-cdk-deploy-no-tty.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
This deployment will make potentially sensitive changes according to your current security approval level (--require-approval broadening).
Please confirm you intend to make the following modifications:

IAM Statement Changes
┌───┬─────────────────┬────────┬────────────────┬────────────────────────────┬───────────┐
│   │ Resource        │ Effect │ Action         │ Principal                  │ Condition │
├───┼─────────────────┼────────┼────────────────┼────────────────────────────┼───────────┤
│ + │ ${SomeRole.Arn} │ Allow  │ sts:AssumeRole │ Service:ec2.amazon.aws.com │           │
└───┴─────────────────┴────────┴────────────────┴────────────────────────────┴───────────┘
(NOTE: There may be security-related changes not in this list. See http://bit.ly/cdk-2EhF7Np)

"--require-approval" is enabled and stack includes security-sensitive updates, but terminal (TTY) is not attached so we are unable to get a confirmation from the user
✅  success
============================================================================================
test-cdk-deploy-with-role.sh
============================================================================================

An error occurred (NoSuchEntity) when calling the ListRolePolicies operation: The role with name cdk-integ-test-role cannot be found.

An error occurred (NoSuchEntity) when calling the DeleteRole operation: The role with name cdk-integ-test-role cannot be found.
Role does not exist yet
Sleeping a bit to improve chances of the role having propagated
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
cdk-toolkit-integration-test-2: deploying...
cdk-toolkit-integration-test-2: creating CloudFormation changeset...
 0/3 | 5:44:12 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37)
 0/3 | 5:44:12 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 0/3 | 5:44:12 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37) Resource creation Initiated
 0/3 | 5:44:12 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F) Resource creation Initiated
 1/3 | 5:44:22 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic1 (topic152D84A37)
 2/3 | 5:44:22 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 3/3 | 5:44:24 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-2

 ✅  cdk-toolkit-integration-test-2

Stack ARN:
Stack deployed successfully
| assert that last command returned 1 line(s)
cdk-toolkit-integration-test-2: destroying...

 ✅  cdk-toolkit-integration-test-2: destroyed
✅  success
============================================================================================
test-cdk-deploy.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
cdk-toolkit-integration-test-2: deploying...
cdk-toolkit-integration-test-2: creating CloudFormation changeset...
 0/3 | 5:45:00 PM | CREATE_IN_PROGRESS   | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-2 User Initiated
 0/3 | 5:45:04 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37)
 0/3 | 5:45:05 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 0/3 | 5:45:05 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37) Resource creation Initiated
 0/3 | 5:45:05 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F) Resource creation Initiated
 1/3 | 5:45:15 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic1 (topic152D84A37)
 2/3 | 5:45:16 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 3/3 | 5:45:17 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-2

 ✅  cdk-toolkit-integration-test-2

Stack ARN:
Stack deployed successfully
| assert that last command returned 1 line(s)
cdk-toolkit-integration-test-2: destroying...

 ✅  cdk-toolkit-integration-test-2: destroyed
✅  success
============================================================================================
test-cdk-diff.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
| assert that last command returned 2 line(s)
| assert that last command returned 3 line(s)
✅  success
============================================================================================
test-cdk-iam-diff.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
| running nonfailing_diff cdk-toolkit-integration-iam-test
✅  success
============================================================================================
test-cdk-ls.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
| running cdk ls
✅  success
============================================================================================
test-cdk-multiple-toolkit-stacks.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
Toolkit stack: toolkit-stack-9193
 ⏳  Bootstrapping environment 585695036304/us-east-1...
toolkit-stack-9193: creating CloudFormation changeset...
 0/2 | 5:46:10 PM | CREATE_IN_PROGRESS   | AWS::S3::Bucket | StagingBucket
 0/2 | 5:46:11 PM | CREATE_IN_PROGRESS   | AWS::S3::Bucket | StagingBucket Resource creation Initiated
 1/2 | 5:46:31 PM | CREATE_COMPLETE      | AWS::S3::Bucket | StagingBucket
 2/2 | 5:46:33 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | toolkit-stack-9193
 ✅  Environment 585695036304/us-east-1 bootstrapped.
Toolkit stack: toolkit-stack-23512
 ⏳  Bootstrapping environment 585695036304/us-east-1...
toolkit-stack-23512: creating CloudFormation changeset...
 0/2 | 5:46:50 PM | CREATE_IN_PROGRESS   | AWS::S3::Bucket | StagingBucket
 0/2 | 5:46:51 PM | CREATE_IN_PROGRESS   | AWS::S3::Bucket | StagingBucket Resource creation Initiated
 1/2 | 5:47:11 PM | CREATE_COMPLETE      | AWS::S3::Bucket | StagingBucket
 2/2 | 5:47:13 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | toolkit-stack-23512
 ✅  Environment 585695036304/us-east-1 bootstrapped.
{
    "StackResources": [
        {
            "StackId": "arn:aws:cloudformation:us-east-1:585695036304:stack/toolkit-stack-9193/031f2330-0793-11e9-8eb3-12ece74fd46e",
            "ResourceStatus": "CREATE_COMPLETE",
            "DriftInformation": {
                "StackResourceDriftStatus": "NOT_CHECKED"
            },
            "ResourceType": "AWS::S3::Bucket",
            "Timestamp": "2018-12-24T15:46:31.485Z",
            "StackName": "toolkit-stack-9193",
            "PhysicalResourceId": "toolkit-stack-9193-stagingbucket-16xvdkp0yogca",
            "LogicalResourceId": "StagingBucket"
        }
    ]
}
{
    "StackResources": [
        {
            "StackId": "arn:aws:cloudformation:us-east-1:585695036304:stack/toolkit-stack-23512/1acb2a60-0793-11e9-adb1-126c686965ae",
            "ResourceStatus": "CREATE_COMPLETE",
            "DriftInformation": {
                "StackResourceDriftStatus": "NOT_CHECKED"
            },
            "ResourceType": "AWS::S3::Bucket",
            "Timestamp": "2018-12-24T15:47:11.373Z",
            "StackName": "toolkit-stack-23512",
            "PhysicalResourceId": "toolkit-stack-23512-stagingbucket-9qwfvenasu4b",
            "LogicalResourceId": "StagingBucket"
        }
    ]
}
✅  success
============================================================================================
test-cdk-synth.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
| running cdk synth cdk-toolkit-integration-test-1
| running cdk synth cdk-toolkit-integration-test-2
✅  success

packages/aws-cdk/integ-tests/test-cdk-multiple-toolkit-stacks.sh

RomainMuller · 2018-12-27T09:32:38Z

Also - I don't know what the use-case is to have more than one bootstrap stack in a given account. But I also don't see why it should be forbidden.

eladb · 2018-12-27T09:48:30Z

@RomainMuller wrote:

Also - I don't know what the use-case is to have more than one bootstrap stack in a given account. But I also don't see why it should be forbidden.

See #1416

mergify · 2019-09-23T15:07:49Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

ryancastle · 2022-11-28T23:21:18Z

In some situations it may be necessary to add --qualifier to the bootstrap command, to avoid resource name collisions with other CDK bootstrap toolkits.

cdk bootstrap --qualifier gateway --toolkit-stack-name=CDKToolkitGateway \
  --cloudformation-execution-policies arn:aws:iam::123:policy/GatewayExecutionPolicy

eladb requested review from Doug-AWS and a team as code owners December 24, 2018 15:41

eladb force-pushed the benisrae/multi-toolkit-stacks branch from af8f23d to a5ceee2 Compare December 24, 2018 15:43

eladb mentioned this pull request Dec 24, 2018

cdk bootstrap in multi-tenant accounts #1416

Closed

RomainMuller approved these changes Dec 27, 2018

View reviewed changes

packages/aws-cdk/integ-tests/test-cdk-multiple-toolkit-stacks.sh Outdated Show resolved Hide resolved

Extended toolkit stack string literal portion to avoid duplicates

66343e7

eladb merged commit 095da14 into master Dec 27, 2018

eladb deleted the benisrae/multi-toolkit-stacks branch December 27, 2018 13:54

NGL321 added the contribution/core This is a PR that came from AWS. label Sep 23, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(toolkit): support multiple toolkit stacks in the same environment #1427

fix(toolkit): support multiple toolkit stacks in the same environment #1427

eladb commented Dec 24, 2018 •

edited

eladb commented Dec 24, 2018

RomainMuller commented Dec 27, 2018

eladb commented Dec 27, 2018

mergify bot commented Sep 23, 2019

ryancastle commented Nov 28, 2022 •

edited

fix(toolkit): support multiple toolkit stacks in the same environment #1427

fix(toolkit): support multiple toolkit stacks in the same environment #1427

Conversation

eladb commented Dec 24, 2018 • edited

Pull Request Checklist

eladb commented Dec 24, 2018

RomainMuller commented Dec 27, 2018

eladb commented Dec 27, 2018

mergify bot commented Sep 23, 2019

ryancastle commented Nov 28, 2022 • edited

eladb commented Dec 24, 2018 •

edited

ryancastle commented Nov 28, 2022 •

edited