(custom-resources): AwsCustomResource returns no data #25283
Comments
|
After several hours of debugging, it turns out that the
However, this caused a breaking change which seems to have gone unnoticed. |
|
Hi @bobveringa Do you mean prior to 2.69 you don't need to define |
|
In version 2.63 only defining the These are the 2 implementations I pulled out of our git history. This initial version has had this implementation since at least CDK v2.20. iot_endpoint = cr.AwsCustomResource(
self,
'IoTEndpoint',
policy=cr.AwsCustomResourcePolicy.from_sdk_calls(
resources=cr.AwsCustomResourcePolicy.ANY_RESOURCE
),
on_create=cr.AwsSdkCall(
service='Iot',
action='describeEndpoint',
physical_resource_id=cr.PhysicalResourceId.from_response(
'endpointAddress'),
parameters={
'endpointType': 'iot:Data-ATS'
}
)
)
endpoint = iot_endpoint.get_response_field('endpointAddress')This broke updating to 2.76. Implementing the iot_endpoint = cr.AwsCustomResource(
self,
'IoTEndpoint',
policy=cr.AwsCustomResourcePolicy.from_sdk_calls(
resources=cr.AwsCustomResourcePolicy.ANY_RESOURCE
),
on_create=cr.AwsSdkCall(
service='Iot',
action='describeEndpoint',
physical_resource_id=cr.PhysicalResourceId.from_response(
'endpointAddress'),
parameters={
'endpointType': 'iot:Data-ATS'
}
),
on_update=cr.AwsSdkCall(
service='Iot',
action='describeEndpoint',
parameters={
'endpointType': 'iot:Data-ATS'
}
)
)
endpoint = iot_endpoint.get_response_field('endpointAddress') |
|
I ran into what sounds like it could be the same problem as this bumping from a VERY old /**
* Use the AWS SDK to call get the CloudFrontDistribution with CognitoIdentityServiceProvider::describeUserPoolDomain
*
* @see https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_custom-resources.AwsCustomResource.html
* @see https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CognitoIdentityServiceProvider.html#describeUserPoolDomain-property
*/
const describeCognitoUserPoolDomain = new AwsCustomResource(
this,
'DescribeCognitoUserPoolDomain',
{
resourceType: 'Custom::DescribeCognitoUserPoolDomain',
onCreate: {
region: 'us-east-1', // TODO: is this required?
service: 'CognitoIdentityServiceProvider',
action: 'describeUserPoolDomain',
parameters: {
Domain: userPoolDomain.domain,
},
physicalResourceId: PhysicalResourceId.of(userPoolDomain.domain),
},
policy: AwsCustomResourcePolicy.fromSdkCalls({
resources: AwsCustomResourcePolicy.ANY_RESOURCE,
}),
}
)
describeCognitoUserPoolDomain.node.addDependency(userPoolDomain)
const userPoolDomainDistribution = describeCognitoUserPoolDomain.getResponseField(
'DomainDescription.CloudFrontDistribution'
)
new CfnOutput(this, 'UserPoolDomainDistribution', {
value: userPoolDomainDistribution,
})
new ARecord(this, 'UserPoolDomainAliasRecord', {
recordName: userPoolDomain.domain,
target: RecordTarget.fromAlias({
bind: () => ({
hostedZoneId: 'Z2FDTNDATAQYW2', // CloudFront Zone ID
dnsName: userPoolDomainDistribution,
}),
}),
zone,
})
In my use case I just ended up working around it by switching to the modern built-in construct equivalent: /**
* Route53 alias record for the UserPoolDomain CloudFront distribution
*
* @see https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-route53.ARecord.html
* @see https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-route53.RecordTarget.html
* @see https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-route53-targets.UserPoolDomainTarget.html
*/
new ARecord(this, 'UserPoolDomainAliasRecord', {
zone,
target: RecordTarget.fromAlias(new UserPoolDomainTarget(userPoolDomain)),
recordName: userPoolDomain.domainName,
})Which generates this CloudFormation output: // ..snip..
"UserPoolDomainCloudFrontDomainName0B254952": {
"Type": "Custom::UserPoolCloudFrontDomainName",
"Properties": {
"ServiceToken": {
"Fn::GetAtt": [
"AWS679f53fac002430cb0da5b7982bd22872D164C4C",
"Arn"
]
},
"Create": {
"Fn::Join": [
"",
[
"{\"service\":\"CognitoIdentityServiceProvider\",\"action\":\"describeUserPoolDomain\",\"parameters\":{\"Domain\":\"",
{
"Ref": "UserPoolDomain5479B217"
},
"\"},\"physicalResourceId\":{\"id\":\"",
{
"Ref": "UserPoolDomain5479B217"
},
"\"}}"
]
]
},
"Update": {
"Fn::Join": [
"",
[
"{\"service\":\"CognitoIdentityServiceProvider\",\"action\":\"describeUserPoolDomain\",\"parameters\":{\"Domain\":\"",
{
"Ref": "UserPoolDomain5479B217"
},
"\"},\"physicalResourceId\":{\"id\":\"",
{
"Ref": "UserPoolDomain5479B217"
},
"\"}}"
]
]
},
"InstallLatestAwsSdk": true
},
"DependsOn": [
"UserPoolDomainCloudFrontDomainNameCustomResourcePolicyF374B62C"
],
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete",
"Metadata": {
"aws:cdk:path": "REDACTED-Auth/UserPoolDomain/CloudFrontDomainName/Resource/Default"
}
},
// ..snip..Which when runs, successfully returns the expected data: |
|
I'm also experiencing the same issue, I'm issuing a KMS Error: Redacted code: |
|
For those who is having For example, you should be able to see logs like this: |
|
@bobveringa thanks for info! @davidjmemmett, can you try adding on on_update to your code? |
There isn't a KMS API call which returns the same response for updates, therefore only on_create works, any further updates fail. |
|
I assume this should have been fixed in #29949 Feel free to open a new ticket if it's still relevant. |
|
Comments on closed issues and PRs are hard for our team to see. |
Describe the bug
To get create certain resources, we use AWS Custom Resources to fetch details from the SDK. Upgrading to the latest version 2.76 broke all our custom resources that fetch data using the SDK. This only applies to resources using the
AwsCustomResourceconstruct.When attempting to fetch the resources, the following error is returned from CDK.
Failures occur on all platforms (Mac, Windows, Linux) including CDK Code Pipeline. The previous version 2.63 was working without issue.
Expected Behavior
Normal operation without breaking changes.
Current Behavior
Investigating lambda return values in CloudWatch there is a difference in the returned response.
Return on 2.76
{ "Status": "SUCCESS", "Reason": "OK", "PhysicalResourceId": "[HIDDEN]-ats.iot.eu-central-1.amazonaws.com", "StackId": "arn:aws:cloudformation:eu-central-1:[HIDDEN]:stack/iot/462a6010-82e4-11ed-ad4c-06513e2530cc", "RequestId": "4a7eed3c-296d-4472-aa2a-e367c08ac434", "LogicalResourceId": "IoTEndpoint9F0B923E", "NoEcho": false, "Data": {} }Return < 2.76
{ "Status": "SUCCESS", "Reason": "OK", "PhysicalResourceId": "[HIDDEN]-ats.iot.eu-central-1.amazonaws.com", "StackId": "arn:aws:cloudformation:eu-central-1:[HIDDEN]:stack/iot/462a6010-82e4-11ed-ad4c-06513e2530cc", "RequestId": "f99dfa9a-e771-49fd-aa7f-faefc122e921", "LogicalResourceId": "IoTEndpoint9F0B923E", "NoEcho": false, "Data": { "apiVersion": null, "region": "eu-central-1", "endpointAddress": "[HIDDEN]-ats.iot.eu-central-1.amazonaws.com" } }Reproduction Steps
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.76.0 (build 78c411b)
Framework Version
No response
Node.js Version
v16.14.2
OS
Windows
Language
Python
Language Version
Python 3.9.6
Other information
No response
The text was updated successfully, but these errors were encountered: