Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(cli): cross-account asset publishing doesn't work without bootstrap stack #31876

Merged
merged 2 commits into from
Oct 24, 2024
Merged

fix(cli): cross-account asset publishing doesn't work without bootstrap stack #31876

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6523cc0
fix(cli): cross-account asset publishing doesn't work without bootstr…
rix0rrr Oct 24, 2024
af27bf6
Add test
rix0rrr Oct 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions packages/aws-cdk/lib/api/util/checks.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,13 +18,19 @@ export async function determineAllowCrossAccountAssetPublishing(sdk: ISDK, custo
return true;
}

// other scenarios are highly irregular and potentially dangerous so we prevent it by
// instructing cdk-assets to detect foreign bucket ownership and reject.
// If there is a staging bucket AND the bootstrap version is old, then we want to protect
// against accidental cross-account publishing.
return false;
} catch (e) {
// You would think we would need to fail closed here, but the reality is
// that we get here if we couldn't find the bootstrap stack: that is
// completely valid, and many large organizations may have their own method
// of creating bootstrap resources. If they do, there's nothing for us to validate,
// but we can't use that as a reason to disallow cross-account publishing. We'll just
// have to trust they did their due diligence. So we fail open.
debug(`Error determining cross account asset publishing: ${e}`);
debug('Defaulting to disallowing cross account asset publishing');
return false;
debug('Defaulting to allowing cross account asset publishing');
return true;
}
}

Expand Down
Loading