CREATE_FAILED Custom::RFDK_X509Generator openssl: command not found

I did

conda deactivate

and then

> gcm openssl

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Application     openssl.exe                                        1.1.1.14   C:\tools\cygwin\bin\openssl.exe

I have openssl installed in 3 different places.

> which -a openssl
/usr/bin/openssl
/cygdrive/c/Program Files (x86)/Subversion/bin/openssl

Even without miniconda it's still accessible. Plus this only applies to windows. Inside docker openssl is always available.

Ok, I cloned aws-rfdk repo and debugged it. I found this code

  private static async generateSelfSigned(
    tmpDir: string,
    subject: DistinguishedName,
    passphrase: string,
    certValidFor: number,
  ): Promise<[string, string]> {
    const crtFile: string = path.join(tmpDir, 'crt');
    const keyFile: string = path.join(tmpDir, 'key');
    const cmd: string =
      'openssl req -x509 ' +
      '-passout env:CERT_PASSPHRASE ' +
      '-newkey rsa:2048 ' +
      `-days ${certValidFor} ` +
      '-extensions v3_ca ' +
      `-keyout ${keyFile} -out ${crtFile} ` +
      `-subj ${subject.toString()}`;

    console.debug(`Running: ${cmd}`);
    await exec(cmd, { env: { CERT_PASSPHRASE: passphrase, PATH: process.env.PATH } });

    const cert: string = await readAsciiFile(crtFile);
    const key: string = await readAsciiFile(keyFile);

    return [cert, key];
  }

in ./packages/aws-rfdk/lib/lambdas/nodejs/lib/x509-certs/certificate.ts . And this is in fact running in a lambda function. So this is a bug in the library. It's not my machine. I tried with older version of aws-rdfk but I get the same bug. The question now is why do I get this bug and others don't? Is there something wrong with my code? I think the source of the problem might be in .\packages\aws-rfdk\lib\lambdas\lambdaLayerVersionArns.ts. I'm running on eu-west-1 so maybe somebody could connect to arn:aws:lambda:eu-west-1:224375009292:layer:openssl-al2:2 and make sure it has openssl

Yes, Andril and I came to same conclusion: machine executing CDK does not have openssl installed. See my own answer.

I put this snippet

exec("which openssl", (error, stdout, stderr) => {
  if (error) {
      console.log(`error: ${error.message}`);
      return;
  }
  if (stderr) {
      console.log(`stderr: ${stderr}`);
      return;
  }
  console.log(`stdout: ${stdout}`);
});

and then ran cdk synth and I get this on windows

stdout: /cygdrive/c/tools/miniconda3/Library/bin/openssl

and this in docker

stdout: /usr/bin/openssl

I think that the error openssl: command not found doesn't come from my machine but from some aws lambda coming from the library. I'm running things locally, not on CodePipeline or anything like that. I just run cdk deploy inside a docker container, but I observe the exact same results even when trying outside docker. I even cloned the repo https://github.com/aws/aws-cdk and tried to inspect it a bit to figure out where openssl is being called exactly and whether it uses the right environment variables (such as PATH) but I couldn't find anything there. I'm not an expert but I think the openssl call doesn't happen on my machine.