Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(toolkit): support multiple toolkit stacks in the same environment #1427

Merged
merged 2 commits into from
Dec 27, 2018

Conversation

eladb
Copy link
Contributor

@eladb eladb commented Dec 24, 2018

The --toolkit-stack-name option can be used to specify the name for
the toolkit stack. However, since the the toolkit stack outputs
had "Export"s, which must be unique within an environment, it was
impossible to deploy multiple toolkit stacks.

This change removes the "Export"s as they are actually not used or needed
and also adds an integration test to verify that multiple toolkit stacks
can be deployed into the same environment.

toolkitStackName can also be specified in cdk.json or ~/.cdk.json.
Updated the toolkit documentation topic to describe this.

Fixes #1416


Pull Request Checklist

  • Testing
    • Unit test added
    • CLI change?: manually run integration tests and paste output as a PR comment
    • CLI init template change?: coordinated update of integration tests with team
  • Docs
    • jsdocs: All public APIs documented
    • README: README and/or documentation topic updated
  • Title and Description
    • Change type: title prefixed with fix, feat will appear in changelog
    • Title: use lower-case and doesn't end with a period
    • Breaking?: last paragraph: "BREAKING CHANGE: <describe what changed + link for details>"
    • Issues: Indicate issues fixed via: "Fixes #xxx" or "Closes #xxx"
  • Sensitive Modules (requires 2 PR approvers)
    • IAM Policy Document (in @aws-cdk/aws-iam)
    • EC2 Security Groups and ACLs (in @aws-cdk/aws-ec2)
    • Grant APIs (only if not based on official documentation with a reference)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.

@eladb eladb requested review from Doug-AWS and a team as code owners December 24, 2018 15:41
The --toolkit-stack-name option can be used to specify the name for
the toolkit stack. However, since the the toolkit stack outputs
had "Export"s, which must be unique within an environment, it was
impossible to deploy multiple toolkit stacks.

This change removes the "Export"s as they are actually not used or needed
and also adds an integration test to verify that multiple toolkit stacks
can be deployed into the same environment.

`toolkitStackName` can also be specified in `cdk.json` or `~/.cdk.json`.
Updated the toolkit documentation topic to describe this.

Fixes #1416
@eladb
Copy link
Contributor Author

eladb commented Dec 24, 2018

Toolkit integration tests passed:

============================================================================================
test-cdk-context.sh
============================================================================================
Testing for the context value
Context value contextkey reset. It will be refreshed on the next SDK synthesis run.
No context value with key contextkey
✅  success
============================================================================================
test-cdk-deploy-all.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
cdk-toolkit-integration-test-1
cdk-toolkit-integration-test-1: deploying...
cdk-toolkit-integration-test-1: creating CloudFormation changeset...
 0/2 | 5:42:28 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic (topic69831491)
 0/2 | 5:42:29 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic (topic69831491) Resource creation Initiated
 1/2 | 5:42:39 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic (topic69831491)
 2/2 | 5:42:41 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-1

 ✅  cdk-toolkit-integration-test-1

Stack ARN:
cdk-toolkit-integration-test-2
cdk-toolkit-integration-test-2: deploying...
cdk-toolkit-integration-test-2: creating CloudFormation changeset...
 0/3 | 5:42:59 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37)
 0/3 | 5:42:59 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 0/3 | 5:42:59 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37) Resource creation Initiated
 0/3 | 5:42:59 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F) Resource creation Initiated
 1/3 | 5:43:09 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic1 (topic152D84A37)
 2/3 | 5:43:10 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 3/3 | 5:43:11 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-2

 ✅  cdk-toolkit-integration-test-2

Stack ARN:
Stack deployed successfully
cdk-toolkit-integration-test-1: destroying...
   0 | 5:43:17 PM | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-1 User Initiated
   0 | 5:43:21 PM | DELETE_IN_PROGRESS   | AWS::SNS::Topic | topic (topic69831491)
   1 | 5:43:21 PM | DELETE_COMPLETE      | AWS::SNS::Topic | topic (topic69831491)

 ✅  cdk-toolkit-integration-test-1: destroyed
cdk-toolkit-integration-test-2: destroying...

 ✅  cdk-toolkit-integration-test-2: destroyed
✅  success
============================================================================================
test-cdk-deploy-no-tty.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
This deployment will make potentially sensitive changes according to your current security approval level (--require-approval broadening).
Please confirm you intend to make the following modifications:

IAM Statement Changes
┌───┬─────────────────┬────────┬────────────────┬────────────────────────────┬───────────┐
│   │ Resource        │ Effect │ Action         │ Principal                  │ Condition │
├───┼─────────────────┼────────┼────────────────┼────────────────────────────┼───────────┤
│ + │ ${SomeRole.Arn} │ Allow  │ sts:AssumeRole │ Service:ec2.amazon.aws.com │           │
└───┴─────────────────┴────────┴────────────────┴────────────────────────────┴───────────┘
(NOTE: There may be security-related changes not in this list. See http://bit.ly/cdk-2EhF7Np)

"--require-approval" is enabled and stack includes security-sensitive updates, but terminal (TTY) is not attached so we are unable to get a confirmation from the user
✅  success
============================================================================================
test-cdk-deploy-with-role.sh
============================================================================================

An error occurred (NoSuchEntity) when calling the ListRolePolicies operation: The role with name cdk-integ-test-role cannot be found.

An error occurred (NoSuchEntity) when calling the DeleteRole operation: The role with name cdk-integ-test-role cannot be found.
Role does not exist yet
Sleeping a bit to improve chances of the role having propagated
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
cdk-toolkit-integration-test-2: deploying...
cdk-toolkit-integration-test-2: creating CloudFormation changeset...
 0/3 | 5:44:12 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37)
 0/3 | 5:44:12 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 0/3 | 5:44:12 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37) Resource creation Initiated
 0/3 | 5:44:12 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F) Resource creation Initiated
 1/3 | 5:44:22 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic1 (topic152D84A37)
 2/3 | 5:44:22 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 3/3 | 5:44:24 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-2

 ✅  cdk-toolkit-integration-test-2

Stack ARN:
Stack deployed successfully
| assert that last command returned 1 line(s)
cdk-toolkit-integration-test-2: destroying...

 ✅  cdk-toolkit-integration-test-2: destroyed
✅  success
============================================================================================
test-cdk-deploy.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
cdk-toolkit-integration-test-2: deploying...
cdk-toolkit-integration-test-2: creating CloudFormation changeset...
 0/3 | 5:45:00 PM | CREATE_IN_PROGRESS   | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-2 User Initiated
 0/3 | 5:45:04 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37)
 0/3 | 5:45:05 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 0/3 | 5:45:05 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic1 (topic152D84A37) Resource creation Initiated
 0/3 | 5:45:05 PM | CREATE_IN_PROGRESS   | AWS::SNS::Topic | topic2 (topic2A4FB547F) Resource creation Initiated
 1/3 | 5:45:15 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic1 (topic152D84A37)
 2/3 | 5:45:16 PM | CREATE_COMPLETE      | AWS::SNS::Topic | topic2 (topic2A4FB547F)
 3/3 | 5:45:17 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | cdk-toolkit-integration-test-2

 ✅  cdk-toolkit-integration-test-2

Stack ARN:
Stack deployed successfully
| assert that last command returned 1 line(s)
cdk-toolkit-integration-test-2: destroying...

 ✅  cdk-toolkit-integration-test-2: destroyed
✅  success
============================================================================================
test-cdk-diff.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
| assert that last command returned 2 line(s)
| assert that last command returned 3 line(s)
✅  success
============================================================================================
test-cdk-iam-diff.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
| running nonfailing_diff cdk-toolkit-integration-iam-test
✅  success
============================================================================================
test-cdk-ls.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
| running cdk ls
✅  success
============================================================================================
test-cdk-multiple-toolkit-stacks.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
Toolkit stack: toolkit-stack-9193
 ⏳  Bootstrapping environment 585695036304/us-east-1...
toolkit-stack-9193: creating CloudFormation changeset...
 0/2 | 5:46:10 PM | CREATE_IN_PROGRESS   | AWS::S3::Bucket | StagingBucket
 0/2 | 5:46:11 PM | CREATE_IN_PROGRESS   | AWS::S3::Bucket | StagingBucket Resource creation Initiated
 1/2 | 5:46:31 PM | CREATE_COMPLETE      | AWS::S3::Bucket | StagingBucket
 2/2 | 5:46:33 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | toolkit-stack-9193
 ✅  Environment 585695036304/us-east-1 bootstrapped.
Toolkit stack: toolkit-stack-23512
 ⏳  Bootstrapping environment 585695036304/us-east-1...
toolkit-stack-23512: creating CloudFormation changeset...
 0/2 | 5:46:50 PM | CREATE_IN_PROGRESS   | AWS::S3::Bucket | StagingBucket
 0/2 | 5:46:51 PM | CREATE_IN_PROGRESS   | AWS::S3::Bucket | StagingBucket Resource creation Initiated
 1/2 | 5:47:11 PM | CREATE_COMPLETE      | AWS::S3::Bucket | StagingBucket
 2/2 | 5:47:13 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | toolkit-stack-23512
 ✅  Environment 585695036304/us-east-1 bootstrapped.
{
    "StackResources": [
        {
            "StackId": "arn:aws:cloudformation:us-east-1:585695036304:stack/toolkit-stack-9193/031f2330-0793-11e9-8eb3-12ece74fd46e",
            "ResourceStatus": "CREATE_COMPLETE",
            "DriftInformation": {
                "StackResourceDriftStatus": "NOT_CHECKED"
            },
            "ResourceType": "AWS::S3::Bucket",
            "Timestamp": "2018-12-24T15:46:31.485Z",
            "StackName": "toolkit-stack-9193",
            "PhysicalResourceId": "toolkit-stack-9193-stagingbucket-16xvdkp0yogca",
            "LogicalResourceId": "StagingBucket"
        }
    ]
}
{
    "StackResources": [
        {
            "StackId": "arn:aws:cloudformation:us-east-1:585695036304:stack/toolkit-stack-23512/1acb2a60-0793-11e9-adb1-126c686965ae",
            "ResourceStatus": "CREATE_COMPLETE",
            "DriftInformation": {
                "StackResourceDriftStatus": "NOT_CHECKED"
            },
            "ResourceType": "AWS::S3::Bucket",
            "Timestamp": "2018-12-24T15:47:11.373Z",
            "StackName": "toolkit-stack-23512",
            "PhysicalResourceId": "toolkit-stack-23512-stagingbucket-9qwfvenasu4b",
            "LogicalResourceId": "StagingBucket"
        }
    ]
}
✅  success
============================================================================================
test-cdk-synth.sh
============================================================================================
| ensuring cdk-toolkit-integration-test-1 is cleaned up
| ensuring cdk-toolkit-integration-test-2 is cleaned up
| ensuring cdk-toolkit-integration-iam-test is cleaned up
| running cdk synth cdk-toolkit-integration-test-1
| running cdk synth cdk-toolkit-integration-test-2
✅  success

@RomainMuller
Copy link
Contributor

Also - I don't know what the use-case is to have more than one bootstrap stack in a given account. But I also don't see why it should be forbidden.

@eladb
Copy link
Contributor Author

eladb commented Dec 27, 2018

@RomainMuller wrote:

Also - I don't know what the use-case is to have more than one bootstrap stack in a given account. But I also don't see why it should be forbidden.

See #1416

@eladb eladb merged commit 095da14 into master Dec 27, 2018
@eladb eladb deleted the benisrae/multi-toolkit-stacks branch December 27, 2018 13:54
@NGL321 NGL321 added the contribution/core This is a PR that came from AWS. label Sep 23, 2019
@mergify
Copy link
Contributor

mergify bot commented Sep 23, 2019

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist
:

  • PR title type(scope): text
    • type: fix, feat, refactor go into CHANGELOG, chore is hidden
    • scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
    • text: use all lower-case, do not end with a period, do not include issue refs
  • PR Description
    • Rationale: describe rationale of change and approach taken
    • Issues: indicate issues fixed via: fixes #xxx or closes #xxx
    • Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
  • Testing
    • Unit test added. Prefer to add a new test rather than modify existing tests
    • CLI or init templates change? Re-run/add CLI integration tests
  • Documentation
    • README: update module README to describe new features
    • API docs: public APIs must be documented. Copy from official AWS docs when possible
    • Design: for significant features, follow design process

@ryanotella
Copy link

ryanotella commented Nov 28, 2022

In some situations it may be necessary to add --qualifier to the bootstrap command, to avoid resource name collisions with other CDK bootstrap toolkits.

cdk bootstrap --qualifier gateway --toolkit-stack-name=CDKToolkitGateway \
  --cloudformation-execution-policies arn:aws:iam::123:policy/GatewayExecutionPolicy

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
contribution/core This is a PR that came from AWS.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

cdk bootstrap in multi-tenant accounts
4 participants