From 0c6515e4078c9866c900e5c677e19ba73bf2f8b4 Mon Sep 17 00:00:00 2001 From: David Stone Date: Sun, 28 Jun 2026 11:13:19 -0700 Subject: [PATCH] fix(cdk): reference existing GitHub OIDC provider via fromAccount aws-cdk-github-oidc v4 switched GithubActionsIdentityProvider from a Lambda-backed custom resource (Custom::AWSCDKOpenIdConnectProvider) to the native AWS::IAM::OIDCProvider. Reusing the same logical id across that type change made CloudFormation reject the change set ("Update of resource type is not permitted"). The provider is an account-level singleton, so reference the existing one with fromAccount instead of managing it in this stack. Migration was done in two deploys: first retaining the v2 custom resource's physical provider, then removing it here so the retained provider survives and UploadRole's trust policy points at the existing provider ARN. Co-Authored-By: Claude Opus 4.8 (1M context) --- cdk/lib/trashcal-cdk-stack.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/cdk/lib/trashcal-cdk-stack.ts b/cdk/lib/trashcal-cdk-stack.ts index eebbb8c..d536663 100644 --- a/cdk/lib/trashcal-cdk-stack.ts +++ b/cdk/lib/trashcal-cdk-stack.ts @@ -29,7 +29,12 @@ export class TrashcalCdkStack extends cdk.Stack { constructor(scope: Construct, id: string, props: TrashcalCdkStackProps) { super(scope, id, props); - const provider = new GithubActionsIdentityProvider(this, "GithubProvider"); + // The GitHub OIDC provider is an account-level singleton, created in a + // prior deploy. Reference the existing one rather than managing it here. + const provider = GithubActionsIdentityProvider.fromAccount( + this, + "GithubProvider", + ); const uploadRole = new GithubActionsRole(this, "UploadRole", { provider: provider, owner: "stabbylambda",