feat(codepipeline-actions): show status reason in the pipeline for fa…

…iled change set executions (aws#29534) ### Reason for this change The CodePipeline ExecuteChangeSet action can now show a summary of why the change set execution failed. But, it needs an additional IAM permission: `cloudformation:DescribeStackEvents`. With the current action policy generated by CDK, I get the following message in the pipeline when a change set execution fails: ``` Additional Information: Failed to execute change set. Current stack status: UPDATE_ROLLBACK_COMPLETE. Status reason is not available because IAM role associated with the action does not have CloudFormation DescribeStackEvents permission ``` ### Description of changes Added `cloudformation:DescribeStackEvents` permission to the policy generated for the ChangeSetExecute pipeline action. ### Description of how you validated changes Updated unit tests and integ test with the new permission. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
jun1-t · Mar 23, 2024 · bbd034b · bbd034b
1 parent 232d2a2
commit bbd034b
Show file tree

Hide file tree

Showing 8 changed files with 26 additions and 16 deletions.
diff --git a/...eg.cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.assets.json b/...eg.cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.assets.json
diff --git a/....cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json b/....cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json
@@ -795,6 +795,7 @@
       {
        "Action": [
         "cloudformation:DescribeChangeSet",
+        "cloudformation:DescribeStackEvents",
         "cloudformation:DescribeStacks",
         "cloudformation:ExecuteChangeSet"
        ],

diff --git a/...g/test/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.js.snapshot/cdk.out b/...g/test/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.js.snapshot/cdk.out
diff --git a/...est/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.js.snapshot/integ.json b/...est/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.js.snapshot/integ.json
diff --git a/.../aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.js.snapshot/manifest.json b/.../aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.js.snapshot/manifest.json
diff --git a/...test/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.js.snapshot/tree.json b/...test/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.js.snapshot/tree.json
diff --git a/packages/aws-cdk-lib/aws-codepipeline-actions/lib/cloudformation/private/singleton-policy.ts b/packages/aws-cdk-lib/aws-codepipeline-actions/lib/cloudformation/private/singleton-policy.ts
@@ -37,6 +37,7 @@ export class SingletonPolicy extends Construct implements iam.IGrantable {
     this.statementFor({
       actions: [
         'cloudformation:DescribeStacks',
+        'cloudformation:DescribeStackEvents',
         'cloudformation:DescribeChangeSet',
         'cloudformation:ExecuteChangeSet',
       ],

diff --git a/packages/aws-cdk-lib/aws-codepipeline-actions/test/cloudformation/pipeline-actions.test.ts b/packages/aws-cdk-lib/aws-codepipeline-actions/test/cloudformation/pipeline-actions.test.ts
@@ -163,6 +163,7 @@ describe('Pipeline Actions', () => {
           {
             Action: [
               'cloudformation:DescribeChangeSet',
+              'cloudformation:DescribeStackEvents',
               'cloudformation:DescribeStacks',
               'cloudformation:ExecuteChangeSet',
             ],