I have a scenario where I need to deploy a stack using CDK in Account A by running cdk synth and cdk deploy in an ECS Task located in Account B.
To enable this, I set up a role in Account A with administrator access and granted permissions to Account B so that it can assume the role. However, when the ECS task executes the commands, it encounters the following error:
Could not assume role in target account using current credentials (which are for account 614863243217). User: arn:aws:sts::<B_account_id>:assumed-role/ecs-fargate-role/65dd98a9c327410 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::<A_account_id>:role/cdk-hnb659fds-deploy-role-473038482210-us-east-2 . Please make sure that this role exists in the account. If it doesn't exist, (re)-bootstrap the environment with the right '--trust', using the latest version of the CDK CLI.
It seems like the intended role is not being utilized to deploy the stack. How can I ensure that the created role is assumed to call CDK synth and deploy?
The role in Account A has the following permission policy and trust relationships:
Permissions Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
Trust Relationships
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<AccountB>:root"
},
"Action": "sts:AssumeRole"
}
]
}
I've also attempted to assume the role in ECS as follows:
role_arn = stack_json["role_arn"]
aws_region = stack_json["region"]
assumed_role_object = sts_client.assume_role(
RoleArn=role_arn,
RoleSessionName="AssumeRoleSession1"
)
credentials = assumed_role_object['Credentials']
p = Popen(['aws configure'], stdin=PIPE, shell=True)
aws_configure_str = f"{credentials['AccessKeyId']}\n{credentials['SecretAccessKey']}\n{aws_region}\njson\n";
p.communicate(input=bytes(aws_configure_str, 'utf-8'))
This writes the credentials for the default aws cli. Additionally, I tried passing the credentials directly like this:
sb.run(f"cdk deploy", shell=True, env={
"AWS_ACCESS_KEY_ID": credentials['AccessKeyId'],
"AWS_SECRET_ACCESS_KEY": credentials['SecretAccessKey'],
"AWS_DEFAULT_REGION": aws_region,
})
However, upon inspecting the logs, it appears that the credentials are not configured correctly, leading to the deployment failure with the message:
AWS Access Key ID [None]: AWS Secret Access Key [None]: Default region name [None]: Default output format [None]: Loaded stack_json
and the error states: Deployment failed: Error: Need to perform AWS calls for account , but no credentials have been configured