RFC: missing security-impacting changes from cdk diff "scrutiny report" #1299

rix0rrr · 2018-12-06T13:31:54Z

Summary

CDK libraries you depend on may affect your security posture. In order to increase confidence in stacks generated the CDK, we will attempt to identify when you're making changes that are potentially security-sensitive. You will see a prompt that looks like this:

This deployment will make potentially sensitive changes.
Please confirm you intend to make the following modifications:

IAM Statement Changes
┌───┬─────────────────────────┬────────┬───────────────────────┬──────────────────────────────┬─────────────────────────────────┐
│   │ Resource                │ Effect │ Action                │ Principal                    │ Condition                       │
├───┼─────────────────────────┼────────┼───────────────────────┼──────────────────────────────┼─────────────────────────────────┤
│ + │ ${Echo}                 │ Allow  │ lambda:InvokeFunction │ Service:sns.amazonaws.com    │ "ArnLike": {                    │
│   │                         │        │                       │                              │   "AWS:SourceArn": "${MyTopic}" │
│   │                         │        │                       │                              │ }                               │
├───┼─────────────────────────┼────────┼───────────────────────┼──────────────────────────────┼─────────────────────────────────┤
│ + │ ${Echo/ServiceRole.Arn} │ Allow  │ sts:AssumeRole        │ Service:lambda.amazonaws.com │                                 │
└───┴─────────────────────────┴────────┴───────────────────────┴──────────────────────────────┴─────────────────────────────────┘
IAM Policy Changes
┌───┬─────────────────────────┬────────────────────────────────────────────────────────────────────────────────┐
│   │ Resource                │ Managed Policy ARN                                                             │
├───┼─────────────────────────┼────────────────────────────────────────────────────────────────────────────────┤
│ + │ ${Echo/ServiceRole.Arn} │ arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole │
└───┴─────────────────────────┴────────────────────────────────────────────────────────────────────────────────┘

Do you wish to deploy these changes (y/n)?

Request for comments

Please use this GitHub issue to let us know how this feature is working out for you. Is the diff correct? Is CDK identifying the right changes? Anything else you'd like to tell us?

The text was updated successfully, but these errors were encountered:

rix0rrr · 2018-12-06T15:17:57Z

Here's a known list of resources that are not currently included in the diff:

AWS::IAM::User
Network ACLs

insanitybit · 2019-05-19T20:33:08Z

I like this in principal, but is there a way to opt out? Sometimes I'm working on a dev setup, and it takes ~15-20 minutes to run all of my cdk deployments. Having to sit there and hit 'y' is actually quite a pain, and really slows me down. If I could run the deployment script I have and walk away from the computer, it would be great.

A flag like --accept-scrutiny-report would be really helpful for me.

davidbarsky · 2019-05-20T14:16:56Z

@insanitybit cdk deploy --require-approval=never might resolve your issue.

insanitybit · 2019-05-20T20:41:33Z

That looks like it'd be exactly what I want, thanks.

skinny85 · 2019-05-22T14:55:48Z

Resolving, as I think @insanitybit got the info they needed, feel free to re-open if not.

emanserav · 2019-10-29T10:15:59Z

"CDK libraries you depend on may affect your security posture. In order to increase confidence in stacks generated the CDK, we will attempt to identify when you're making changes that are potentially security-sensitive. You will see a prompt that looks like this:"

My concern is more general than security related ( I am thinking to ask here 1st, maybe I am missing something ):
I've just noticed that cdk diff is not displaying the ChangeSet in the AWS CF Console.
Why ? Any reason for that ?
( seeing the ChangeSet in AWS CF Console history is too late with cdk deploy)

I like seeing the changes in console using cdk diff but they should be identical to what I should be visualising in AWS CF ChangeSet before applying them. Are they identical ?

oups - just noticed this has been closed ...

shivlaks · 2020-05-04T18:51:48Z

Still relevant.

Please use this GitHub issue to let us know how this feature is working out for you. Is the diff correct? Is CDK identifying the right changes? Anything else you'd like to tell us?

Although the issue is closed, the conversation is not locked.

gmiretti · 2020-06-18T14:38:08Z

Using CfnInclude with template
https://s3.amazonaws.com/aws-transfer-resources/custom-idp-templates/aws-transfer-custom-idp-secrets-manager-apig.template.yml
cdk diff doesn't report any policy created with a role, is that expected?

skinny85 · 2020-06-22T17:13:35Z

It is not @gmiretti .... would you mind opening us a separate issue about this?

gmiretti · 2020-06-22T17:42:43Z

Bug reported as #8683

skinny85 · 2020-06-22T18:18:56Z

Bug reported as #8683

Thanks!

TrentonAdams · 2022-12-04T23:27:06Z

I receive this message...
(NOTE: There may be security-related changes not in this list. See #1299)

I'm unsure why the message is showing up. The diff shows me IAM changes and security group changes. Is that the reason it's showing up? It claims that there may be security related changes not in the list, but I don't know what that means. Could the message just tell me what other security related changes there are?

jorgemaroto-eb · 2023-02-09T19:16:24Z

Is this still an issue? I'm always seeing the warning, but not sure if it's kept updated.
I'm using:
├── [email protected]
├── [email protected]

selsAT · 2023-02-15T09:20:38Z

yeah please remove the warning if its not relevant, PLEASE

nerdile · 2023-06-30T04:26:11Z

CDK Deploy gives a warning that implies there are known issues preventing IAM policy diffs from showing up in the confirmation prompt, and directs users to read this issue for more information.

However, this issue reads like you know there is an issue, but you don't know what it is. There is no information on this page.

Why is it necessary for developers to consult this page on every deployment? It seems unnecessary. Should I assume that all similar warnings from the CDK are equally irrelevant? Please consider what action you are requesting from developers when they deploy, and then reword the known issue warning to make it clear, or remove it if there is no action required from developers.

It is sometimes useful to see the delta between the current branch and the CODE CloudFormation stack. This change allows us to run: ```bash npm -w cdk run diff:code ``` to yield something like this: ```console Stack ServiceCatalogue-CODE (deploy-CODE-service-catalogue) Creating a change set, this may take a while... IAM Policy Changes ┌───┬─────────────────────────────────────┬────────────────────────────────────────┐ │ │ Resource │ Managed Policy ARN │ ├───┼─────────────────────────────────────┼────────────────────────────────────────┤ │ - │ ${steampipeTaskDefinition/TaskRole} │ arn:aws:iam::aws:policy/ReadOnlyAccess │ └───┴─────────────────────────────────────┴────────────────────────────────────────┘ (NOTE: There may be security-related changes not in this list. See aws/aws-cdk#1299) Resources [~] AWS::IAM::Role steampipeTaskDefinition/TaskRole steampipeTaskDefinitionTaskRole8DC44379 └─ [-] ManagedPolicyArns └─ ["arn:aws:iam::aws:policy/ReadOnlyAccess"] [~] AWS::ECS::TaskDefinition steampipeTaskDefinition steampipeTaskDefinition767BA166 replace └─ [~] ContainerDefinitions (requires replacement) └─ @@ -11,7 +11,7 @@ [ ] "App": "service-catalogue" [ ] }, [ ] "Essential": true, [-] "Image": "ghcr.io/guardian/service-catalogue/steampipe:2", [+] "Image": "ghcr.io/guardian/service-catalogue/steampipe:1", [ ] "LogConfiguration": { [ ] "LogDriver": "awsfirelens", [ ] "Options": { ✨ Number of stacks with differences: 1 ```

nilroy · 2024-03-16T21:28:48Z

Is this still relevant? I am seeing this issue linked in cdk deploy prompt and I am using 2.129.0. Could you please remove this warning message if its not relevant anymore. It creating confusion

jonasfschuh · 2024-09-15T13:46:24Z

I'm using CDK version 2.158.0 and for me this message still appears.

rix0rrr closed this as completed in 9e121a7 Dec 10, 2018

rix0rrr reopened this Dec 10, 2018

eladb changed the title ~~RFC: diff/prompt of security-impacting changes~~ RFC: missing security-impacting changes from cdk diff "scrutiny report" Dec 17, 2018

eladb added enhancement package/tools Related to AWS CDK Tools or CLI @aws-cdk/aws-iam Related to AWS Identity and Access Management and removed @aws-cdk/aws-iam Related to AWS Identity and Access Management labels Dec 17, 2018

srchase added feature-request A feature should be added or improved. and removed enhancement labels Jan 3, 2019

skinny85 closed this as completed May 22, 2019

alsmola mentioned this issue Aug 25, 2019

fix(cli): update bit.ly link to be directly to github #3782

Merged

gidimariastorm mentioned this issue Oct 3, 2019

outbound networks methods dont' work with imported security groups #4361

Closed

aravraje mentioned this issue Nov 12, 2019

invoking add_ingress_rule() on an imported security group throws AttributeError: 'Resource' object has no attribute 'add_ingress_rule' #4966

Closed

marcindulak mentioned this issue May 1, 2020

cdk deploy prints a link to the closed aws-cdk/issues/1299 #7743

Closed

Blyseur mentioned this issue Oct 21, 2020

CDK WorkShop Issue with cdk bootstrap command on Windows 7 Professional #11010

Closed

SomayaB mentioned this issue Oct 26, 2020

CDK WorkShop Issue with cdk bootstrap command on Windows 7 Professional aws-samples/aws-cdk-intro-workshop#173

Closed

This was referenced Apr 4, 2021

testing dlq and dlq as source to lambda thakurrishabh/event-bridge-aws-cdk#17

Merged

Dev thakurrishabh/event-bridge-aws-cdk#20

Merged

ivann1990 mentioned this issue Aug 10, 2023

bug: cdklocal deploy is failing localstack/localstack#8883

Closed

1 task

mazyu36 mentioned this issue Nov 30, 2023

Queueを追加 mazyu36/cdk_git_sync#9

Closed

github-actions bot mentioned this issue Nov 30, 2023

Queueを追加 mazyu36/cdk_git_sync#13

Closed

mawallace added a commit to mawallace/aws-cdk that referenced this issue Mar 29, 2024

Stop printing note about aws#1299.

562c606

This was referenced Apr 1, 2024

Monthly PR metrics report #29668

Closed

Weekly PR metrics report #29673

Closed

This was referenced Oct 4, 2024

VPCを追加 yutaro-sakamoto/cobol4j-aws-web#13

Merged

ECSクラスタを作成 yutaro-sakamoto/cobol4j-aws-web#14

Merged

Network constructを修正 yutaro-sakamoto/cobol4j-aws-web#21

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RFC: missing security-impacting changes from cdk diff "scrutiny report" #1299

RFC: missing security-impacting changes from cdk diff "scrutiny report" #1299

rix0rrr commented Dec 6, 2018 •

edited

Loading

rix0rrr commented Dec 6, 2018

insanitybit commented May 19, 2019

davidbarsky commented May 20, 2019

insanitybit commented May 20, 2019

skinny85 commented May 22, 2019

emanserav commented Oct 29, 2019 •

edited

Loading

shivlaks commented May 4, 2020

gmiretti commented Jun 18, 2020

skinny85 commented Jun 22, 2020

gmiretti commented Jun 22, 2020

skinny85 commented Jun 22, 2020

TrentonAdams commented Dec 4, 2022

jorgemaroto-eb commented Feb 9, 2023

selsAT commented Feb 15, 2023

nerdile commented Jun 30, 2023

nilroy commented Mar 16, 2024

jonasfschuh commented Sep 15, 2024

RFC: missing security-impacting changes from cdk diff "scrutiny report" #1299

RFC: missing security-impacting changes from cdk diff "scrutiny report" #1299

Comments

rix0rrr commented Dec 6, 2018 • edited Loading

Summary

Request for comments

rix0rrr commented Dec 6, 2018

insanitybit commented May 19, 2019

davidbarsky commented May 20, 2019

insanitybit commented May 20, 2019

skinny85 commented May 22, 2019

emanserav commented Oct 29, 2019 • edited Loading

shivlaks commented May 4, 2020

gmiretti commented Jun 18, 2020

skinny85 commented Jun 22, 2020

gmiretti commented Jun 22, 2020

skinny85 commented Jun 22, 2020

TrentonAdams commented Dec 4, 2022

jorgemaroto-eb commented Feb 9, 2023

selsAT commented Feb 15, 2023

nerdile commented Jun 30, 2023

nilroy commented Mar 16, 2024

jonasfschuh commented Sep 15, 2024

rix0rrr commented Dec 6, 2018 •

edited

Loading

emanserav commented Oct 29, 2019 •

edited

Loading