feat(amplify): add compute role support for Amplify app #33962

mazyu36 · 2025-03-28T13:09:32Z

Issue # (if applicable)

Closes #33882 .

Reason for this change

To support compute role for SSR app.

Description of changes

Add computeRole property.
Changed to automatically create compute role when SSR App is created.

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Add unit tests and an integ test.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

BREAKING CHANGE: A compute role is created when platform is Platform.WEB_COMPUTE or Platform.WEB_DYNAMIC.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

codecov · 2025-03-28T13:19:20Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.98%. Comparing base (74cbe27) to head (faa392f).
Report is 56 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33962   +/-   ##
=======================================
  Coverage   83.98%   83.98%           
=======================================
  Files         120      120           
  Lines        6976     6976           
  Branches     1178     1178           
=======================================
  Hits         5859     5859           
  Misses       1005     1005           
  Partials      112      112

Flag	Coverage Δ
suite.unit	`83.98% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`83.98% <ø> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…ld in `customRule` (#33973) ### Issue # (if applicable) N/A I found this problem while working on #33962. ### Reason for this change Re-running `packages/@aws-cdk/aws-amplify-alpha/test/integ.app.ts`, got the following error: ```sh Resource handler returned message: "Invalid request provided: Status field in rewrite custom rules should not be empty (Service: Amplify, Status Code: 400, Request ID: 3f3694f1-3eeb-4af3-8cdf-8b77b6387e57) (SDK Attempt Count: 1)" (RequestToken: 5748aef8-c0e1-1a1d-ab27-1bab938e0bd3, HandlerErrorCode: InvalidRequest) ``` If `status` is omitted in `customRules`, `App` cannot be deployed. ### Description of changes Specify `status` property in integ test. ### Describe any new or updated permissions being added N/A ### Description of how you validated changes Re-ran integ test. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…pute-role

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

mazyu36 · 2025-04-08T13:48:43Z

packages/@aws-cdk/aws-amplify-alpha/lib/app.ts

+  /**
+   * The IAM role for an SSR app.
+   * The Compute role allows the Amplify Hosting compute service to securely access specific AWS resources based on the role's permissions.
+   * @default undefined - a new role is created when `platform` is `Platform.WEB_COMPUTE` or `Platform.WEB_DYNAMIC`, otherwise no compute role


Since the compute role is used when SSR apps access AWS resources, I thought it would be more user-friendly to auto-generate it.

Ref: https://aws.amazon.com/jp/blogs/mobile/iam-compute-roles-for-server-side-rendering-with-aws-amplify-hosting/

Please let me know if you have any opinions on this.

badmintoncryer

Thank you for your contribution! I've made a nit comment and I think this is good to go.

badmintoncryer · 2025-04-16T14:02:44Z

packages/@aws-cdk/aws-amplify-alpha/test/integ.app-compute-role.ts

+  enableLookups: true,
+  stackUpdateWorkflow: false,


Are these options needed? This is not a blocking comment.

Thanks. I've removed.

paulhcsun

Thanks for the contribution @mazyu36 and thanks for reviewing @badmintoncryer!

The changes look good to me and change is creating a minimal default role for the compute role. We will bring this up as a low-risk change for a security review but I don't expect there to be any issues. I will approve for now and then remove the do-not-merge label and merge once the security review is complete.

packages/@aws-cdk/aws-amplify-alpha/lib/app.ts

Pull request has been modified.

mazyu36 · 2025-05-14T06:40:40Z

@Mergifyio update

mergify · 2025-05-14T06:40:45Z

update

❌ Mergify doesn't have permission to update

For security reasons, Mergify can't update this pull request. Try updating locally.
GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/README.md without workflows permission

Pull request has been modified.

paulhcsun · 2025-05-21T18:46:06Z

Security review is good! Thanks again for the contribution!

@Mergifyio update

mergify · 2025-05-21T18:49:31Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-05-21T21:18:00Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 45df95a
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-05-21T21:18:21Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-05-21T21:18:33Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

feat(amplify): add compute role support for Amplify app

a9730bf

aws-cdk-automation requested a review from a team March 28, 2025 13:09

github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Mar 28, 2025

aws-cdk-automation previously requested changes Mar 28, 2025

View reviewed changes

wip

3ea34d5

mazyu36 mentioned this pull request Mar 29, 2025

fix(amplify): unable to re-run integ test due to missing status field in customRule #33973

Merged

1 task

mazyu36 added 2 commits April 8, 2025 22:25

Merge remote-tracking branch 'upstream/main' into feature/amplify-com…

ffc41e2

…pute-role

update test

f173b30

update docs

745228c

mazyu36 marked this pull request as ready for review April 8, 2025 13:38

mazyu36 commented Apr 8, 2025

View reviewed changes

rosseta

97a91c0

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 9, 2025

Merge branch 'main' into feature/amplify-compute-role

faa392f

badmintoncryer approved these changes Apr 16, 2025

View reviewed changes

aws-cdk-automation added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Apr 16, 2025

mazyu36 added 3 commits April 17, 2025 00:06

fix integ

d9cf099

Merge branch 'main' into feature/amplify-compute-role

7ea2224

Merge branch 'main' into feature/amplify-compute-role

4a51eb9

shikha372 assigned paulhcsun May 6, 2025

Merge branch 'main' into feature/amplify-compute-role

c378d16

paulhcsun added the needs-security-review Related to feature or issues that needs security review label May 14, 2025

paulhcsun previously approved these changes May 14, 2025

View reviewed changes

packages/@aws-cdk/aws-amplify-alpha/lib/app.ts Outdated Show resolved Hide resolved

paulhcsun added the pr/do-not-merge This PR should not be merged at this time. label May 14, 2025

Update packages/@aws-cdk/aws-amplify-alpha/lib/app.ts

946a3a4

paulhcsun previously approved these changes May 14, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 14, 2025

Merge branch 'main' into feature/amplify-compute-role

02945c1

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 14, 2025

paulhcsun approved these changes May 21, 2025

View reviewed changes

paulhcsun removed the pr/do-not-merge This PR should not be merged at this time. label May 21, 2025

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 21, 2025

Merge branch 'main' into feature/amplify-compute-role

45df95a

mergify bot merged commit 7490b92 into aws:main May 21, 2025
16 checks passed

github-actions bot locked as resolved and limited conversation to collaborators May 21, 2025

mazyu36 deleted the feature/amplify-compute-role branch May 21, 2025 23:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(amplify): add compute role support for Amplify app #33962

feat(amplify): add compute role support for Amplify app #33962

Uh oh!

mazyu36 commented Mar 28, 2025 •

edited

Loading

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

codecov bot commented Mar 28, 2025 •

edited

Loading

Uh oh!

mazyu36 Apr 8, 2025

Uh oh!

badmintoncryer left a comment

Uh oh!

badmintoncryer Apr 16, 2025 •

edited

Loading

Uh oh!

mazyu36 Apr 16, 2025

Uh oh!

paulhcsun left a comment

Uh oh!

Uh oh!

mazyu36 commented May 14, 2025

Uh oh!

mergify bot commented May 14, 2025

Uh oh!

paulhcsun commented May 21, 2025

Uh oh!

mergify bot commented May 21, 2025

Uh oh!

aws-cdk-automation commented May 21, 2025

Uh oh!

Uh oh!

mergify bot commented May 21, 2025

Uh oh!

github-actions bot commented May 21, 2025

Uh oh!

Uh oh!

feat(amplify): add compute role support for Amplify app #33962

feat(amplify): add compute role support for Amplify app #33962

Uh oh!

Conversation

mazyu36 commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

mazyu36 Apr 8, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer left a comment

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Apr 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mazyu36 Apr 16, 2025

Choose a reason for hiding this comment

Uh oh!

paulhcsun left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mazyu36 commented May 14, 2025

Uh oh!

mergify bot commented May 14, 2025

❌ Mergify doesn't have permission to update

Uh oh!

paulhcsun commented May 21, 2025

Uh oh!

mergify bot commented May 21, 2025

Uh oh!

aws-cdk-automation commented May 21, 2025

AWS CodeBuild CI Report

Uh oh!

Uh oh!

mergify bot commented May 21, 2025

Uh oh!

github-actions bot commented May 21, 2025

Uh oh!

Uh oh!

mazyu36 commented Mar 28, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Mar 28, 2025 •

edited

Loading

badmintoncryer Apr 16, 2025 •

edited

Loading