fix(core): only hash stack template files during validation, not entire cdk.out - #38628
Open
sanyamk23 wants to merge 5 commits into
Open
fix(core): only hash stack template files during validation, not entire cdk.out#38628sanyamk23 wants to merge 5 commits into
sanyamk23 wants to merge 5 commits into
Conversation
The AWS Cognito API only accepts a domain prefix that starts and ends with a lowercase alphanumeric character, contains only lowercase alphanumeric characters and hyphens (not leading or trailing), and is 1-63 characters in length. The previous validation accepted any string of lowercase alphanumerics and hyphens, which allowed invalid values that fail at deploy time. Fixes aws#38531
…Object] The out-of-range error interpolated the Size object directly into the message. Size has no toString(), so the value rendered as [object Object] and gave no indication of what was actually passed. Convert to mebibytes in the message, matching the conversion already performed by the range check on the line above. Fixes aws#38621
Allow customers to specify a KMS key to encrypt the DSQL cluster, matching the underlying CfnCluster.KmsEncryptionKey property. Previously users had to resort to the L1 construct or an escape hatch to set a customer-managed key. The new property uses kms.IKeyRef (the L1 reference interface) rather than IKey, satisfying the awslint:prefer-ref-interface lint rule. Fixes aws#38618
…re cdk.out The pre-plugin tamper-detection snapshot called snapshotFileHashes(outdir), which walked and hashed every file in the cloud assembly output directory. On long-lived working directories cdk.out accumulates stale asset.* staging directories (often hundreds of MB or GB of files), making synthesis stall for minutes in validateTemplates while hashing files unrelated to the templates being validated. Instead collect only the templateFullPath values from the stack artifacts handed to each plugin and hash just those. This makes the cost O(number of templates) rather than O(outdir size), which also resolves aws#38295: the collectFilePaths() directory walk that crashed on symlink-to-directory no longer runs, so EISDIR can no longer occur. Fixes aws#38614 Fixes aws#38295
github-actions
Bot
added
beginning-contributor
aws-cdk-automation
added
the
pr/needs-further-review
Add new feature flag @aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2025 (FlagType.ApiDefault) and update Distribution renderViewerCertificate to select TLSv1.2_2025 when the 2025 flag is enabled, falling back to 2021 then 2019. Closes aws#38600
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
Closes #38614.
Fixes #38295.
Reason for this change
The pre-plugin tamper-detection snapshot called
snapshotFileHashes(outdir), which recursively walked and hashed every file in the cloud assembly output directory (cdk.out). On long-lived working directoriescdk.outaccumulates staleasset.*staging directories (often hundreds of MB or even GB across millions of files), making everycdk synth/cdk deploystall for minutes invalidateTemplateswhile hashing files unrelated to the templates being validated.Verified isolation: a fresh
cdk.outsynths in ~3.3s; the same dirtycdk.outwith validation takes ~213s;--no-validationdrops to ~2.3s. The cost is proportional to the total size ofcdk.out, not the size of the current synth output.Description of changes
Changed
snapshotFileHashes()to accept an explicit list of file paths (thetemplateFullPathof each stack artifact handed to each validation plugin) instead of walking the entire outdir directory tree. Now only the stack template files are hashed — O(number of templates) instead of O(outdir size).This also incidentally fixes #38295: the
collectFilePaths()recursive directory walk (which crashed with EISDIR on symlink-to-directory entries) is no longer invoked, so symlinks in the assembly no longer reachhashFile().Removed the now-unused
collectFilePaths()function.Updated the symlink regression test comment to reflect the new scoping behavior.
Describe any new or updated prerequisites
None.
Any behavior changes
The tamper-detection check now only covers stack template files (the same files passed to validation plugins), rather than every file in
cdk.out. Untrusted plugins that modify template files are still caught and rejected withIllegalPluginOperation. Plugins that only modify non-template files (e.g. asset staging artifacts) are no longer treated as malicious.Is this a breaking change to the CDK CLI?
No
Is this a breaking change to the library or any generated client interfaces?
No