(cli) Early Validation error during bootstrap

[mrgrain]

Based on this comment: #1000 (comment)

cdk bootstrap may result in failed AWS::EarlyValidation checks with errors hidden. In this case we should attempt to call the API to retrieve more detailed output.

According to this:

https://docs.amplify.aws/react/build-a-backend/troubleshooting/cdktoolkit-stack/

~ $ cdk bootstrap aws://$(aws sts get-caller-identity --query Account --output text)/$AWS_REGION
⏳ Bootstrapping environment aws://xxxxxxxxxx/eu-central-1...
Trusted accounts for deployment: (none)
Trusted accounts for lookup: (none)
Using default execution policy of 'arn:aws:iam::aws:policy/AdministratorAccess'. Pass '--cloudformation-execution-policies' to customize.
CDKToolkit: creating CloudFormation changeset...
❌ Environment aws://xxxxxxxxxx/eu-central-1 failed bootstrapping: ToolkitError: Failed to create ChangeSet cdk-deploy-change-set on CDKToolkit: FAILED, The following hook(s)/validation failed: [AWS::EarlyValidation::ResourceExistenceCheck]. To troubleshoot Early Validation errors, use the DescribeEvents API for detailed failure information.

[pahud]

Hey @mrgrain,

Tried to repro #1032 on v2.1101.0 - can't reproduce.

What I tested:

• Fresh bootstrap to us-east-2 in a new account (never bootstrapped before) with non-existent IAM policy
• Existing bootstrap region (ap-southeast-4) that triggered S3 bucket conflict

Results:

• Fresh region: Error caught during stack execution, showed detailed message

• Existing region: Early validation triggered, also showed detailed error:

  ChangeSet 'cdk-deploy-change-set' on stack 'CDKToolkit' failed early validation:

  • Resource of type 'AWS::S3::Bucket' with identifier '...' already exists.

Neither case showed the generic "use DescribeEvents API" message from the original comment.

[mrgrain]

@zhartaunik can you help @pahud with more infos for a reproduction? E.g. which version of the CLI are you using?

[zhartaunik]

@mrgrain
I confirm that the issue was on my side. Below is a description of what happened and which steps led to the resolution.

1. I removed the IAM roles, the S3 bucket, and the CloudFormation stacks and tried to recreate the CDKToolkit, but the stack kept failing during creation.
2. The process moved a bit further after I deleted the version stored in SSM.
3. During further debugging, I discovered that I had previously created an additional CDKToolkit stack with a similar name. As a result, there was most likely a naming conflict in SSM, which prevented the standard CDKToolkit from being created.
4. After removing the custom stack CDKToolkitAmplify (that was its name), the standard CDKToolkit was created successfully, and Amplify started deploying correctly.

Additionally, I would like to point out an important observation:

• For the Amplify sandbox environment, the custom CDKToolkit was sufficient.
• However, when deploying the staging environment (the second environment in Amplify), the process strictly searched for a stack named CDKToolkit and did not attempt to use alternative names — it did not even try to look them up.

I am not sure whether this behavior is expected, but it looks like a potential defect. I would recommend testing this scenario separately and, if confirmed, registering an issue.

[mrgrain]

Moved to Amplify: aws-amplify/amplify-backend#3111