fix(eks): remove usage of shell=True in helm commands

[aemada-aws]

Improve subprocess handling in EKS Helm custom resource handler.

Same PR as: #35141

Reason for this change

The EKS Helm custom resource handler used shell=True with subprocess calls, which is not aligned with security best practices. Following Python's recommended approach for subprocess execution improves code robustness and follows secure coding guidelines.

Description of changes

Refactor subprocess execution to follow Python best practices
https://docs.python.org/3/library/subprocess.html#replacing-shell-pipeline

• Replaced shell command strings with array-based commands: Refactored get_oci_cmd() to return structured command objects instead of shell strings
• Implemented proper subprocess pipelines: Used Popen with PIPE to chain aws ecr get-login-password and helm registry login commands following Python documentation recommendations
• Removed shell=True: Adopted array-based command execution as recommended by Python subprocess documentation
• Maintained functionality: Preserved all existing behavior for private ECR, public ECR, and fallback scenarios

Files modified:

• packages/@aws-cdk/custom-resource-handlers/lib/aws-eks/kubectl-handler/helm/__init__.py
• packages/@aws-cdk/aws-eks-v2-alpha/lib/kubectl-handler/helm/__init__.py
• packages/@aws-cdk/aws-eks-v2-alpha/test/integ.alb-controller.js.snapshot/asset.*/helm/__init__.py

Technical approach:

• Commands are now built as arrays: ['helm', 'pull', repository, '--version', version, '--untar']
• Pipeline implementation follows Python subprocess best practices using Popen with proper PIPE connections
• User inputs are passed as separate array elements, ensuring proper argument handling

Describe any new or updated permissions being added

No new IAM permissions required. The change maintains the same AWS API calls and functionality.

Description of how you validated changes

• Functionality testing: Confirmed that ECR authentication and Helm chart pulling continues to work correctly for all scenarios
• Code review: Verified implementation follows Python subprocess best practices as documented in the Python documentation
• Compatibility testing: Ensured backward compatibility with existing CDK Helm chart deployments

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 08f2ee9
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

integ tests updated

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.