Unnecessary "Missing CDK bootstrap bucket" action request?

Question

Hi,

This morning (UTC+3) I received couple of emails from AWS regarding missing CDK bootstrap buckets. The emails are titled in the format

> [Action Required] Missing CDK bootstrap bucket [AWS Account: 111111111111]

The message tells me that the affected accounts contains a default deployment Role `cdk-hnb659fds-deploy-role--` but is missing the default asset Bucket `cdk-hnb659fds-assets--`.

However, I've checked each of the reported accounts and for every `cdk-hnb659fds-deploy-role--` Role there exists a matching default asset Bucket. Is this a false positive from AWS or am I missing something?

For context all of the affected accounts are in an organization as follows:
* Root account 111111111111: CDK is bootstrapped (BootstrapVersion: 15), received action required email, and asset bucket is not missing.
  * Account 222222222222: CDK is bootstrapped (BootstrapVersion: 20) with trust relationship to Root account, received action required email, and asset bucket is not missing.
  * Account 333333333333: CDK is bootstrapped  (BootstrapVersion: 18) with trust relationship to Root account, **didn't receive** action required email, and asset bucket is not missing.

Rico · Accepted Answer

Hi,

It was me that caused you to receive this message. The truth is that I made a mistake in generating the data file that was used to contact customers, and I included too many customers by accident. There's a very good chance that if you receive this message, it's a false positive, and there is nothing for you to do.

It is still a good idea to confirm that all your bootstrap buckets exist. If they do, there is no further action necessary for you. You can also use this moment to update your bootstrap stacks.

We are working to issue a retraction to anyone who received this message that shouldn't have. I'm very sorry for the confusion and consternation this has caused.

re:Post Agent · Answer

The situation you're describing appears to be a false positive from AWS. Based on the information you've provided, it seems that the CDK bootstrap buckets are indeed present in the accounts where AWS is reporting them as missing.

In a properly bootstrapped CDK environment, each account should have both the deployment role (cdk-hnb659fds-deploy-role--) and the corresponding asset bucket (cdk-hnb659fds-assets--). You've confirmed that both of these resources exist in the accounts that received the action required emails.

The fact that you're seeing different bootstrap versions across your accounts (15, 20, and 18) is not necessarily a problem, but it's worth noting that keeping these versions consistent across your organization can help prevent potential issues.

It's interesting that Account 333333333333 didn't receive the action required email despite having a lower bootstrap version than Account 222222222222. This inconsistency further suggests that there might be an issue with AWS's detection or notification system rather than with your actual CDK bootstrap setup.

Given that you've manually verified the presence of both the deployment roles and asset buckets in the affected accounts, it's likely safe to consider these emails as false positives. However, if you're concerned, you might want to:

1. Double-check the exact names and ARNs of the buckets to ensure they match the expected format.
2. Verify that the buckets have the correct permissions set up.
3. Consider updating all accounts to the same, latest bootstrap version if possible.

If the issue persists or you receive further notifications, it may be worth contacting AWS support to investigate why these false positive alerts are being generated.

**Sources**  
['AWS CDK bootstrap' variables - Amazon CodeCatalyst](https://docs.aws.amazon.com/codecatalyst/latest/userguide/cdk-boot-action-variables.html)  
[Bootstrapping an AWS CDK app with a workflow - Amazon CodeCatalyst](https://docs.aws.amazon.com/codecatalyst/latest/userguide/cdk-boot-action.html)  
['AWS CDK bootstrap' action YAML - Amazon CodeCatalyst](https://docs.aws.amazon.com/codecatalyst/latest/userguide/cdk-boot-action-ref.html)  
[class BootstrapRole · AWS CDK](https://docs.aws.amazon.com/cdk/api/v2/docs/@aws-cdk_app-staging-synthesizer-alpha.BootstrapRole.html)

Unnecessary "Missing CDK bootstrap bucket" action request?

Add your answer

Relevant content