Error installed cfn-nag

[dannosaur]

Describe the bug
The CodeBuild script install_stage_dependencies.sh installed cfn-nag as part of its normal operation, and this is currently failing in my Control Tower.

ERROR:  Error installing cfn-nag:
    The last version of aws-eventstream (~> 1, >= 1.3.0) to support your Ruby & RubyGems was 1.3.2. Try installing it with `gem install aws-eventstream -v 1.3.2` and then running the current command again
    aws-eventstream requires Ruby version >= 2.7. The current ruby version is 2.6.10.210.

To Reproduce
Steps to reproduce the behavior.

Expected behavior
I expect the script to install its dependencies correctly.

Please complete the following information about the solution:

• Version: 2.7.0

To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0089) - customizations-for-aws-control-tower Solution. Version: v1.0.0". You can also find the version from releases

• Region: us-gov-west-1
• Was the solution modified from the version published on this repository? I don't think so
• If the answer to the previous question was yes, are the changes available on GitHub?
• Have you checked your service quotas for the sevices this solution uses?
• Were there any errors in the CloudWatch Logs? Yes (see above)

Screenshots
If applicable, add screenshots to help explain your problem (please DO NOT include sensitive information).

Additional context
Add any other context about the problem here.

[schwinbp]

I am getting same error. ALso on v2.7.0 in region us-east-1

ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts. -- 85 | cfn-lint 1.20.2 requires pyyaml>5.4, but you have pyyaml 5.3.1 which is incompatible. 86 | aws-sam-cli 1.132.0 requires PyYAML~=6.0, but you have pyyaml 5.3.1 which is incompatible. 87 | WARNING: You are using pip version 21.0.1; however, version 25.0.1 is available. 88 | You should consider upgrading via the '/root/.pyenv/versions/3.8.17/bin/python3.8 -m pip install --upgrade pip' command. 89 | WARNING: You are using pip version 21.0.1; however, version 25.0.1 is available. 90 | You should consider upgrading via the '/root/.pyenv/versions/3.8.17/bin/python3.8 -m pip install --upgrade pip' command. 91 | ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts. 92 | flask 3.0.3 requires Jinja2>=3.1.2, but you have jinja2 2.11.3 which is incompatible. 93 | aws-sam-cli 1.132.0 requires PyYAML~=6.0, but you have pyyaml 5.3.1 which is incompatible. 94 | WARNING: You are using pip version 21.0.1; however, version 25.0.1 is available. 95 | You should consider upgrading via the '/root/.pyenv/versions/3.8.17/bin/python3.8 -m pip install --upgrade pip' command. 96 | ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts. 97 | docker 7.1.0 requires requests>=2.26.0, but you have requests 2.25.1 which is incompatible. 98 | aws-sam-cli 1.132.0 requires PyYAML~=6.0, but you have pyyaml 5.3.1 which is incompatible. 99 | aws-sam-cli 1.132.0 requires requests~=2.32.3, but you have requests 2.25.1 which is incompatible. 100 | WARNING: You are using pip version 21.0.1; however, version 25.0.1 is available. 101 | You should consider upgrading via the '/root/.pyenv/versions/3.8.17/bin/python3.8 -m pip install --upgrade pip' command. 102 | WARNING: You are using pip version 21.0.1; however, version 25.0.1 is available. 103 | You should consider upgrading via the '/root/.pyenv/versions/3.8.17/bin/python3.8 -m pip install --upgrade pip' command. 104 | WARNING: You are using pip version 21.0.1; however, version 25.0.1 is available. 105 | You should consider upgrading via the '/root/.pyenv/versions/3.8.17/bin/python3.8 -m pip install --upgrade pip' command. 106 | Successfully installed lightly-0.3.3 107 | ERROR: Error installing cfn-nag: 108 | The last version of aws-eventstream (~> 1, >= 1.3.0) to support your Ruby & RubyGems was 1.3.2. Try installing it with `gem install aws-eventstream -v 1.3.2` and then running the current command again 109 | aws-eventstream requires Ruby version >= 2.7. The current ruby version is 2.6.10.210. 110 | Successfully installed jmespath-1.6.2 111 | Successfully installed base64-0.3.0 112 |   113 | [Container] 2025/06/05 17:32:57.052986 Command did not exit successfully bash install_stage_dependencies.sh $STAGE_NAME exit status 1 114 | [Container] 2025/06/05 17:32:57.057982 Phase complete: PRE_BUILD State: FAILED 115 | [Container] 2025/06/05 17:32:57.057996 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: bash install_stage_dependencies.sh $STAGE_NAME. Reason: exit status 1

[schwinbp]

@dannosaur I upgraded to v2.8.* version and problem was resolved.

[utk231]

aws-control-tower-customizations/customizations-for-aws-control-tower.template

Line 701 in 6d28308

BuildSpec: "version: 0.2\nphases:\n install:\n runtime-versions:\n python: 3.11\n ruby: 3.3\n commands:\n - export current=$(pwd)\n - if [ -f manifest.yaml ];then export current=$(pwd);else if [ -f custom-control-tower-configuration/manifest.yaml ]; then export current=$(pwd)/custom-control-tower-configuration; else echo 'manifest.yaml does not exist at the root level of custom-control-tower-configuration.zip or inside custom-control-tower-configuration folder, please check the ZIP file'; exit 1; fi; fi;\n - apt-get -q update 1> /dev/null\n - apt-get -q install zip wget python3-pip libyaml-dev -y 1>/dev/null\n - export LC_ALL='en_US.UTF-8'\n - locale-gen en_US en_US.UTF-8\n - dpkg-reconfigure locales --frontend noninteractive\n pre_build:\n commands:\n - cd $current\n - echo 'Download CustomControlTower Scripts'\n - aws s3 cp --quiet s3://control-tower-cfct-assets-prod-${AWS_REGION}/customizations-for-aws-control-tower/v2.8.1/custom-control-tower-scripts.zip $current\n - unzip -q -o $current/custom-control-tower-scripts.zip -d $current\n - cp codebuild_scripts/* .\n - bash install_stage_dependencies.sh $STAGE_NAME\n build:\n commands:\n - echo 'Starting build $(date) in $(pwd)'\n - echo 'bash execute_stage_scripts.sh $STAGE_NAME $LOG_LEVEL $WAIT_TIME $SM_ARN $ARTIFACT_BUCKET $KMS_KEY_ALIAS_NAME $BOOL_VALUES $NONE_TYPE_VALUES'\n - bash execute_stage_scripts.sh $STAGE_NAME $LOG_LEVEL $WAIT_TIME $SM_ARN $ARTIFACT_BUCKET $KMS_KEY_ALIAS_NAME $BOOL_VALUES $NONE_TYPE_VALUES \n - echo 'Running build scripts completed $(date)'\n post_build:\n commands:\n - echo 'Starting post build $(date) in $(pwd)'\n - echo 'build completed on $(date)'\n\nartifacts:\n files:\n - '**/*'\n\n"

Ruby version expects the minor version as well. Looks like this needs to be modified.

Ruby 3.4.4
Ruby 3.4.3
Ruby 3.3.8
Ruby 3.2.8
Ruby 3.1.7
Ruby 3.4.2

Attached error screenshot below:

[OlivierCloudar]

Same issue here.

As a workaround - if you're willing to adjust the source/codebuild_scripts/install_stage_dependencies.sh script - you can adjust:

    # Install CFN Nag
    gem install --quiet aws-eventstream -v 1.3.2 # Pin version to avoid new requirement of Ruby 2.7
    gem install --quiet aws-sigv4 -v 1.11.0 # Pin version to avoid new requirement of Ruby 2.7
    gem install --quiet aws-partitions -v 1.1109.0 # Pin version to avoid new requirement of Ruby 2.7
    gem install --quiet aws-sdk-core -v 3.224.1 # Pin version to avoid new requirement of Ruby 2.7
    gem install --quiet aws-sdk-kms -v 1.101.0 # Pin version to avoid new requirement of Ruby 2.7
    gem install --quiet aws-sdk-s3 -v 1.188.0 # Pin version to avoid new requirement of Ruby 2.7
    gem install --quiet cfn-nag -v 0.7.2