AWS Amplify module with CodeCommit Repository

[kinbald]

❓ General Issue

The Question

Hello,

With the introduction of the Amplify constructors (App, Branch, Domain), I updated my code from CfnApp to App.
I'm facing a problem with the accessToken and oauthToken parameters, they are now mandatory if you connect to a repository.

I understand this behavior when you connect to a 3rd party source provider like Github, Gitlab but what about the case of CodeCommit ?
My deployment used to work with CfnApp connected to a CodeCommit repository and no token as parameters.

Best regards,

Environment

• CDK CLI Version: 1.30.0
• Module Version: 1.30.0
• OS: OSX Catalina
• Language: TypeScript

Other information

Related code from app.ts
if (props.repository && !props.accessToken && !props.oauthToken) { throw new Error('EitheraccessTokenoroauthToken must be specified'); }

[MrArnoldPalmer]

Hey @kinbald, so when providing a codecommit repository using CfnApp, if you no authToken and no oauthToken it still works? Do you have to give the amplify project's role access through iam?

@jogold for visibility.

[jogold]

@kinbald Did you maybe connect the repository manually using the console?

@MrArnoldPalmer the amplify project's role is only used when working with backends I think

[kinbald]

Hey there,

I do not use the amplify console to connect the repo, I use the repository parameter of App constructor.
To understand a little bit more the bug, I tested 3 different stacks (CDK 1.30.0) :

1. CfnApp + CfnBranch + CfnDomain WITHOUT token ✅ (Amplify build succeeded)
2. App + Branch + Domain WITH valid accessToken ✅ (Amplify build succeeded)
3. App + Branch + Domain WITH random string as accessToken ❌ (Amplify build failed)
   => Succeeded to clone the repo but failed at Backend step with accessDenied error.

And as you asked I create the app with this role :

const amplifyPrincipal = new iam.ServicePrincipal("amplify.amazonaws.com")
const amplifyRole = new iam.Role(this, "AmplifyConsoleRole", {
      assumedBy: amplifyPrincipal,
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName("AWSCodeCommitReadOnly")
      ],
      roleName: "AmplifyConsoleRole"
})

Thanking you in advance