How do I get CDK Assets from Tooling Account (CodePipeline) into Application Account

[tennantje]

Hi there,

My application utilizes three accounts [tooling, uat, prod]. A CodePipeline in the tooling account builds several application lambdas, and also has a build task to synthesize the application's CDK stack into CloudFormation. A CloudFormation CodeDeploy step then deploys the synthesized CloudFormation into uat and prod accounts. This has worked well until I introduced a certificatemanager.DnsValidatedCertificate resource in my stack.

    const certificate = new acm.DnsValidatedCertificate(
      this,
      "ReactApplicationCertificate",
      {
        domainName: fqdn,
        hostedZone: zone,
        region: "us-east-1",
      }
    );

It seems that when I include the DnsValidatedCertificate that CDK automagically creates a Lambda Function for the purpose of validating the certificate. I can see when I run cdk synth that (a) CloudFormation has the new function - see below and (b) an asset (javascript function) is automagically created to perform the validation step.

  "ReactApplicationCertificateCertificateRequestorFunctionXXXXXXXXX": {
   "Type": "AWS::Lambda::Function",
   "Properties": {
    "Code": {
     "S3Bucket": "cdk-XXXXXXXXX"-assets-<APP_ACCOUNT>-ap-southeast-2",
     "S3Key": "e85f10a8bf0e7f4f7931fce24b29d4faf6874948090a2b568b2da33a7116cf84.zip"
    },
...
...
...

Note in the synthesized output above, the S3Bucket and S3Key where CloudFormation expects to find the asset/code

Though my CodeBuild step successfully executes npm run cdk synth -- -o dist and when I manually download and unzip the output artifact, the asset files for the above function are included in the zip file. Unfortunately, the asset itself is not copied into the S3Bucket in the application account. Therefore my CloudFormation deploy step fails, because the application accounts do not have e85f10a8bf0e7f4f7931fce24b29d4faf6874948090a2b568b2da33a7116cf84.zip in the bucket cdk-XXXXXXXXX"-assets-<APP_ACCOUNT>-ap-southeast-2

Are the generated assets supposed to be copied into cdk-XXXXXXXXX"-assets-<APP_ACCOUNT>-ap-southeast-2 , or am I missing some step where I need to automate copying those assets myself?

[tennantje]

May be similar to #20609

[tennantje]

CDK bundles up the assets in the account where ‘cdk synth’ is called (Account A).

I don’t believe CDK understands or cares that CodePipeline in account A is assuming an account B role to deploy cloudformation, and that the assets only exist in account A’s CDK S3 bucket.

I wrote a step in my codebuild to manually copy the assets post synthesis from account a to account b.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.