(aws-cli): import ressources failed (fail to publish assets)

[BDeus]

Describe the bug

When i try to import supported ressources through cdk import command, the command failed with a fail: Access Denied.
It seems that the import command use the DeploymentActionRole to push assets on staging bucket.

Here the output logs:

[12:05:33] Reading existing template for stack XXXXXXX.
[12:05:33] Retrieved account ID 00000000 from disk cache
[12:05:33] Assuming role 'arn:aws:iam::00000000:role/cdk-lookup-role'.
[12:05:39] Retrieving template summary for stack XXXXXXX.
[12:05:39] Retrieved account ID 00000000 from disk cache
[12:05:39] Assuming role 'arn:aws:iam::00000000:role/cdk-deploy-role'.
[12:05:39] Waiting for stack cdk-bootstrap to finish creating or updating...
[12:05:39] Storing template in S3 at: https://cdk-assets-00000000-region.s3.region.amazonaws.com/cdk/XXXXXXX/2accfd15fcf2c18a2beecf6b63897529f60e2a0398b4148cc94b4e93c86e7b81.yml
[12:05:39] [0%] start: Publishing 2accfd15fcf2c18a2beecf6b63897529f60e2a0398b4148cc94b4e93c86e7b81:current
[12:05:40] [0%] check: Check s3://cdk-assets-00000000/cdk/XXXXXXX/2accfd15fcf2c18a2beecf6b63897529f60e2a0398b4148cc94b4e93c86e7b81.yml
[12:05:40] [0%] upload: Upload s3://cdk-assets-00000000/cdk/XXXXXXX/2accfd15fcf2c18a2beecf6b63897529f60e2a0398b4148cc94b4e93c86e7b81.yml
[100%] fail: Access Denied
Failed to publish one or more assets. See the error messages above for more information.

Expected Behavior

Use FilePublishingRole to push assets like the deploy command

Current Behavior

The DeploymentActionRole used from bootstrap do not have the permission to PutObject on the assets Bucket.

aws-cdk/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml

Lines 509 to 517 in 4fd510e

	- Sid: CliStagingBucket
	Effect: Allow
	Action:
	- s3:GetObject*
	- s3:GetBucket*
	- s3:List*
	Resource:
	- Fn::Sub: ${StagingBucket.Arn}
	- Fn::Sub: ${StagingBucket.Arn}/*

Reproduction Steps

Create an importable ressource manually (i tried with an ECR Repository) and try to import it to an existing CDK stacks

Possible Solution

Use the FilePublishingRole to push assets

Additional Information/Context

Bootstrap used: 12

CDK CLI Version

2.93.0

Framework Version

No response

Node.js Version

18

OS

windows 10

Language

Java

Language Version

No response

Other information

No response

[peterwoodworth]

Could you provide some more details about your setup? I don't think I understand exactly what you're doing. All you're trying to do is import an ECR repo correct? I'm not sure how bucket permissions are coming into play if that's the case. Additionally, did you make sure that your cdk diff is showing nothing aside from the resource you want to import? Reproduction code and explicit steps would be helpful here 🙂

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.