Sceptre: Question: CodePipeline and Profiles

[brentbain]

Hello!

We've been using Sceptre to run complex cloudformation scripts and dependencies by hand for several months. I'm finally taking the step to try and automate this via CodePipeline/CodeBuild.

However, we have been using the config.yaml to control which account cloudformation should run on by controlling which profile it uses. My original thinking was to set up a pipeline/build on a "tools" account, and then somehow configure the role that it's using to have execution permissions on the target account. But that only works if there is one account being used by sceptre/cloudformation. If, say, I am building a TransitGateway with cloudformation and dependencies running on multiple accounts, I think I'm stuck (something that is working great with a properly configured credentials file, and running sceptre locally).

Has anyone done this with CodeBuild? I thought about using something like:
profile: {{ var.profile | default("qa-public") }}
That would allow us to continue to run it by hand, and deploy to our qa-public account.
However, I'm not quite sure how to set the variable correctly on the CodeBuild side, and seems like I'd end up having to create an IAM user and store the credentials somewhere so I could update CodeBuild.

Suggestions? Am I just going about this wrong way?

[SpyderDave]

Have not worked much with Codebuild/Codepipeline, but it should work just like using Jenkins or Bamboo? If thats the case, just use RoleArn to assume an IAM role in the target account.https://sceptre.cloudreach.com/dev/docs/stack_config.html#role_arn

[robertsigler]

Alternatively, you can use the iam_role configuration item on your StackGroup to assume an IAM role before running the Sceptre deployment: https://github.com/Sceptre/sceptre/pull/799

So you would have an assumer IAM role that your CodeBuild is using, and a deployer IAM role in the account that you want to deploy to. You'll need to configure the trust relationship on your deployer IAM role to allow the assumer to assume it.

[adamcousins]

I created a stack group per account then using the following in the stack group config
iam_role: sceptre_execution_role_arn_per_account

CodeBuild will need to have a role assigned to the environment which can assume a specific 'sceptre execution' role in all accounts.

[brentbain]

Is iam_role available in sceptre 2? I see it in #799 but don't see it in the documentation or the release notes. Or was it replaced by RoleArn on the stack config rather than the stack group config?

I've tried just adding iam_role but codebuild doesn't seem to be doing a assumeRole step.

[robertsigler]

Is iam_role available in sceptre 2? I see it in #799 but don't see it in the documentation or the release notes. Or was it replaced by RoleArn on the stack config rather than the stack group config?

I've tried just adding iam_role but codebuild doesn't seem to be doing a assumeRole step.

The latest release of Sceptre, 2.2.1, came out before #799 was merged. Therefore I don't think you'll be able to use the feature until the next Sceptre version comes out, or if you install Sceptre directly from the master branch.

[adamcousins]

I created a stack group per account then using the following in the stack group config
iam_role: sceptre_execution_role_arn_per_account

CodeBuild will need to have a role assigned to the environment which can assume a specific 'sceptre execution' role in all accounts.

sorry i meant role_arn:

[brentbain]

Thanks all! These got me a lot farther!!

[brentbain]

And just a follow-up - I have this successfully working on 3 accounts now. Thanks everyone!
Doing a pip install directly from the git repo and iam_role are what I'm using in my buidlspec for codebuild.

[ngfgrant]

@brentbain would you be willing to write up a dummy example for this for the sceptre examples repository?

[brentbain]

I could take a stab at that - just so I can look at what others have done, that's here, right?
https://github.com/Sceptre/sceptre-examples

It does depend on a new release including iam_role - right now my ci/cd is doing the pip install directly from git.