aws-amplify / aws-amplify/amplify-cli
gen2-migration "generate" crashes on uncaught ResourceNotFoundException when a Lambda permission references a deleted EventBridge rule
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
### How did you install the Amplify CLI?
npm
### If applicable, what version of Node.js are you using?
20.19.6
### Amplify CLI Version
@aws-amplify/cli-internal-gen2-migration-experimental-alpha@0.7.0 (host @aws-amplify/cli 14.3.0) — bug is in the experimental gen2-migration alpha, not the core CLI
### What operating system are you using?
macOS
### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
Yes — relevant to the bug: the EventBridge rule referenced by an orphaned Lambda permission was deleted out-of-band while the lambda:InvokeFunction permission statement was left in place. That orphan state is what triggers the crash.
### Describe the bug
Running amplify gen2-migration generate (@aws-amplify/cli-internal-gen2-migration-experimental-alpha@0.7.0) crashes when a Lambda has a leftover events.amazonaws.com invoke permission referencing an EventBridge rule that no longer exists (rule deleted, RemovePermission never called — an "orphan" permission).
fetchFunctionSchedule in lib/commands/gen2-migration/generate/_infra/aws-fetcher.js extracts the (syntactically valid) rule name and calls DescribeRule. EventBridge returns ResourceNotFoundException, which is not caught — it propagates and aborts the whole generate. Note the sibling GetPolicy call in the same method is wrapped in try/catch; the DescribeRule call is not. In our project, HelpDeskTicketMessageEmailIncoming still carries a permission for a ProcessEmailRule deleted long ago.
### Expected behavior
An orphan permission pointing at a deleted rule should be treated as "no schedule" — caught and skipped, exactly like the existing GetPolicy try/catch in the same method. One dangling permission shouldn't abort the migration.
### Reproduction steps
1. Create a Lambda OrphanRuleFn.
2. Create an EventBridge rule TempRule and grant it permission to invoke the function.
3. Delete the rule without removing the Lambda permission:
`aws events delete-rule --name TempRule
# (do NOT run aws lambda remove-permission — leave the orphan permission)`
4. In a Gen 1 project including this function, run npx amplify gen2-migration generate.
5. The command throws an uncaught ResourceNotFoundException and aborts.
### Project Identifier
_No response_
### Log output
```
# Put your logs below this line
ResourceNotFoundException: Rule TempRule does not exist on EventBus default.
at DescribeRuleCommand (…/generate/_infra/aws-fetcher.js → fetchFunctionSchedule)
```
### Additional information
Wrap DescribeRule in try/catch mirroring the existing GetPolicy handling — swallow ResourceNotFoundException, rethrow the rest:
```
- const ruleResponse = await this.clients.cloudWatchEvents.send(new client_cloudwatch_events_1.DescribeRuleCommand({ Name: ruleName }));
- return ruleResponse.ScheduleExpression;
+ try {
+ const ruleResponse = await this.clients.cloudWatchEvents.send(new client_cloudwatch_events_1.DescribeRuleCommand({ Name: ruleName }));
+ return ruleResponse.ScheduleExpression;
+ }
+ catch (e) {
+ if (e instanceof Error && e.name === 'ResourceNotFoundException') {
+ return undefined;
+ }
+ throw e;
+ }
```
### Before submitting, please confirm:
- [x] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [x] I have removed any sensitive information from my code snippets and submission.
Contributor guide
Research direction
Start in lib/commands/gen2-migration/generate/_infra/aws-fetcher.js at fetchFunctionSchedule and compare the DescribeRule path with the sibling GetPolicy handling. Run the documented orphan EventBridge rule reproduction with amplify gen2-migration generate; done means the deleted-rule permission no longer aborts generation while unrelated errors still surface.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cli, cloud
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 85/100