Running cdktf on airgapped network

I have a use case where we need to deploy an application where we do not have access to the public internet. We have implemented our infrastructure using terraform CDK and have the basic workflow for deploying the application but there is some internal process that appears to be timing out when we run cdktf diff | apply. I came across Allow to Skip Synth · Issue #671 · hashicorp/terraform-cdk · GitHub which describes this use case we have, i.e. be able to support apply/plan reusing a previously run synth. Eventually whatever synth is doing times out and plans/applies fine, but it takes 2+ minutes to do so. I have a work around that doesn’t require synth again doing

cd cdktf.out/stacks/stack_name/ && terraform init && terraform plan

this takes closer to 10s. The question I have is what is synth doing that is causing this timeout and is there a way to bypass this?

Secondarily, if there is not a way to bypass this are there any other commands that I should be executing if I need to run stick with my work around?

You could try disabling the telemetry data.
Otherwise, cdktf synth is pretty much just running the command specified in your cdktf.json file. Depending on what language you are working in, this command could be trying to install reference packages.

It doesn’t appear that this is the issue.

I’m not super familiar with how CDKTF and JSii work together, but it looks like now I’m running into an issue with how JSii and the aws provider operate. When running cdktf synth in a docker container with no network connectivity I am unable to synth the project. Looks like there may be some dynamic imports?

⠦  Synthesizing
[2023-08-22T12:09:45.554] [ERROR] default -     from cdktf_cdktf_provider_aws.provider import AwsProvider
  File "/opt/app/.venv/lib64/python3.11/site-packages/cdktf_cdktf_provider_aws/", line 105, in <module>
    from ._jsii import *
  File "/opt/app/.venv/lib64/python3.11/site-packages/cdktf_cdktf_provider_aws/_jsii/", line 16, in <module>
    __jsii_assembly__ = jsii.JSIIAssembly.load(
  File "/opt/app/.venv/lib64/python3.11/site-packages/jsii/", line 55, in load
    _kernel.load(, assembly.version, os.fspath(assembly_path))
  File "/opt/app/.venv/lib64/python3.11/site-packages/jsii/_kernel/", line 299, in load
    self.provider.load(LoadRequest(name=name, version=version, tarball=tarball))
  File "/opt/app/.venv/lib64/python3.11/site-packages/jsii/_kernel/providers/", line 354, in load
    return self._process.send(request, LoadResponse)
  File "/opt/app/.venv/lib64/python3.11/site-packages/jsii/_kernel/providers/", line 332, in send
    self._next_message(), _ProcessResponse
  File "/opt/app/.venv/lib64/python3.11/site-packages/jsii/_kernel/providers/", line 251, in _next_message
    return json.loads(self._process.stdout.readline(), object_hook=ohook)
  File "/usr/lib64/python3.11/json/", line 359, in loads
    return cls(**kw).decode(s)
  File "/usr/lib64/python3.11/json/", line 337, in decode

As long as all of the necessary packages are already installed in your docker image I would expect it to work. The JSII assembly loading should be referencing files that are bundled in the Python packages.

How can I ensure that ?

Your dockerfile could contain a run command that actually does cdktf synth. I believe getting that to run successfully should ensure that you have all the correct dependencies.

I’m already doing that but that wasn’t enough unfortunately. Anything else that I can try?

You could try running cdktf diff when building the image. I believe synth installs everything Terraform needs, but perhaps it doesn’t and that comes later.

Are there any more details from the error that you are seeing?

I don’t think diff will work. We are looking at updating resources that are not accessible from the build environment so a diff will fail.

I’m not sure why, but it appears things are now working. I need to do a bit more testing, but I am able to synth the stacks without issue. I’ll try to dig into the differences and provide more details.