Default credentials can not be used to assume new style deployment roles

Question

Following pipelines readme to set up a deployment pipeline, I ran

$ env CDK_NEW_BOOTSTRAP=1 npx cdk bootstrap \
    --cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess \
    aws://[ACCOUNT_ID]/us-west-2

to create the necessary roles. I would assume the roles would automatically add sts assume role permissions from my account principle. However, when I run cdk deploy I get the following warning

current credentials could not be used to assume 'arn:aws:iam::[ACCOUNT_ID]:role/cdk-hnb659fds-file-publishing-role-[ACCOUNT_ID]-us-west-2', but are for the right account. Proceeding anyway.

I have root credentials in ~/.aws/credentials.

Looking at the deploy role policy, I don't see any sts permissions. What am I missing?

Answer 1

You will need to add permission to assume the role to the credentials from which you are trying to execute cdk deploy

{
  "Sid": "assumerole",
  "Effect": "Allow",
  "Action": [
     "sts:AssumeRole",
     "iam:PassRole"
  ],
  "Resource": [
     "arn:aws-cn:iam::*:role/cdk-readOnlyRole",
     "arn:aws-cn:iam::*:role/cdk-hnb659fds-deploy-role-*",
     "arn:aws-cn:iam::*:role/cdk-hnb659fds-file-publishing-*"
  ]
}

Answer 2

1. First thing you need to do is enabling the verbose mode to see what is actually happenning.

   cdk deploy --verbose
   

   If you see similar message below. Continue with step 2. Otherwise, you need to address the problem by understanding the error message.

   Could not assume role in target account using current credentials User: arn:aws:iam::XXX068599XXX:user/cdk-access is not authorized to perform: sts :AssumeRole on resource: arn:aws:iam::XXX068599XXX:role/cdk-hnb659fds-deploy-role-XXX068599XXX-us-east-2 . Please make sure that this role exists i n the account. If it doesn't exist, (re)-bootstrap the environment with the right '--trust', using the latest version of the CDK CLI.

2. Check S3 buckets related to CDK and CloudFormation stacks from AWS Console. Delete them manually.

3. Enable the new style bootstrapping by one of the method mentioned here

4. Bootstrap the stack using below command. Then it should create all required roles automatically.

   cdk bootstrap --trust=ACCOUNT_ID --cloudformation-execution-policies=arn:aws:iam::aws:policy/AdministratorAccess --verbose
   

NOTE: If you are working with docker image assets, make sure you have setup your repository before you deploy. New style bootstrapping does not create the repos automatically for you as mentioned in this comment.

Answer 3

I ran into a similar error. The critical part of my error was

failed: Error: SSM parameter /cdk-bootstrap/<>/version not found.

I had to re-run using the new bootstrap method that creates the SSM parameter. To run the new bootstrap method first set CDK_NEW_BOOTSTRAP via export CDK_NEW_BOOTSTRAP=1

Answer 4

Don't forget to run cdk bootstrap with those credentials against your account [ACCOUNT_ID].

Answer 5

This may be of use to somebody... The issue could be a mismatch of regions. I spotted it in verbose mode - the roles were created for us-east-1 but I had specified eu-west-2 in the bootstrap. For some reason it had not worked. The solution was to set the region (by adding AWS_REGION=eu-west-2 before the cdk deploy command).

Answer 6

For me, the problem was that I was using expired credentials. I was trying to use temporary credentials from AWS SSO, which were expired. The problem was that the error message is misleading: it says

current credentials could not be used to assume 'arn:aws:iam::123456789012:role/cdk-xxx999xxx-deploy-role-123456789012-us-east-1', but are for the right account. Proceeding anyway.
(To get rid of this warning, please upgrade to bootstrap version >= 8)

However, applying the --verbose flag as suggested above showed the real problem:

Assuming role 'arn:aws:iam::123456789012:role/cdk-xxx999xxx-deploy-role-123456789012-us-east-1'.
Assuming role failed: The security token included in the request is expired
Could not assume role in target account using current credentials The security token included in the request is expired . Please make sure that this role exists in the account. If it doesn't exist, (re)-bootstrap the environment with the right '--trust', using the latest version of the CDK CLI.

Getting the latest SSO credentials fixed the problem.

Answer 7

After deploying with --verbose I could see it was a clock issue in my case:

Assuming role failed: Signature expired: 20220428T191847Z is now earlier than 20220428T192528Z (20220428T194028Z - 15 min.)

I resolve the clock issue on ubuntu using:

sudo ntpdate ntp.ubuntu.com

which then resolves the cdk issue.