Question

A DevOps team uses AWS CDK to define infrastructure for a service deployed through a CDK Pipelines self-mutating pipeline. Several stacks call methods like ec2.Vpc.fromLookup() and ssm.StringParameter.valueFromLookup() to resolve existing VPCs and configuration at synthesis time. The team notices that builds in the pipeline's CodeBuild synth step intermittently fail or produce templates that reference incorrect subnet IDs, and the errors do not reproduce on developers' laptops. What is the MOST likely root cause and the recommended fix?

Accepted Answer

Context lookups require AWS credentials and a populated cdk.context.json; the pipeline's synth environment resolves lookups against a different account/region than developers, so cache the context by committing cdk.context.json and ensure the synth role can perform the lookups in the correct target environment.

Answer

Lookups are non-deterministic because CDK caches nothing; disable all context lookups by hardcoding subnet IDs as CloudFormation parameters passed in at deploy time.

Answer

The synth step is using an outdated CDK CLI version; pin the CDK version in package.json and the problem will be fully resolved without any changes to context handling.

Answer

fromLookup() performs the lookup during CloudFormation deployment, so the CodeBuild role lacks deploy-time EC2 permissions; attach ec2:DescribeSubnets to the CloudFormation execution role instead.