aws-amplify / aws-amplify/amplify-cli

gen2-migration "generate" crashes on uncaught ResourceNotFoundException when a Lambda permission references a deleted EventBridge rule

Open Beginner friendly
#14,912 0 comments 0 reactions 0 assignees View on GitHub
pending-triage
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

20.19.6

### Amplify CLI Version

@aws-amplify/cli-internal-gen2-migration-experimental-alpha@0.7.0 (host @aws-amplify/cli 14.3.0) — bug is in the experimental gen2-migration alpha, not the core CLI

### What operating system are you using?

macOS

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

Yes — relevant to the bug: the EventBridge rule referenced by an orphaned Lambda permission was deleted out-of-band while the lambda:InvokeFunction permission statement was left in place. That orphan state is what triggers the crash.

### Describe the bug

Running amplify gen2-migration generate (@aws-amplify/cli-internal-gen2-migration-experimental-alpha@0.7.0) crashes when a Lambda has a leftover events.amazonaws.com invoke permission referencing an EventBridge rule that no longer exists (rule deleted, RemovePermission never called — an "orphan" permission).

fetchFunctionSchedule in lib/commands/gen2-migration/generate/_infra/aws-fetcher.js extracts the (syntactically valid) rule name and calls DescribeRule. EventBridge returns ResourceNotFoundException, which is not caught — it propagates and aborts the whole generate. Note the sibling GetPolicy call in the same method is wrapped in try/catch; the DescribeRule call is not. In our project, HelpDeskTicketMessageEmailIncoming still carries a permission for a ProcessEmailRule deleted long ago.

### Expected behavior

An orphan permission pointing at a deleted rule should be treated as "no schedule" — caught and skipped, exactly like the existing GetPolicy try/catch in the same method. One dangling permission shouldn't abort the migration.

### Reproduction steps

1. Create a Lambda OrphanRuleFn.
2. Create an EventBridge rule TempRule and grant it permission to invoke the function.
3. Delete the rule without removing the Lambda permission:
`aws events delete-rule --name TempRule
# (do NOT run aws lambda remove-permission — leave the orphan permission)`
4. In a Gen 1 project including this function, run npx amplify gen2-migration generate.
5. The command throws an uncaught ResourceNotFoundException and aborts.

### Project Identifier

_No response_

### Log output

```
# Put your logs below this line
ResourceNotFoundException: Rule TempRule does not exist on EventBus default.
at DescribeRuleCommand (…/generate/_infra/aws-fetcher.js → fetchFunctionSchedule)

```

### Additional information

Wrap DescribeRule in try/catch mirroring the existing GetPolicy handling — swallow ResourceNotFoundException, rethrow the rest:
```
- const ruleResponse = await this.clients.cloudWatchEvents.send(new client_cloudwatch_events_1.DescribeRuleCommand({ Name: ruleName }));
- return ruleResponse.ScheduleExpression;
+ try {
+ const ruleResponse = await this.clients.cloudWatchEvents.send(new client_cloudwatch_events_1.DescribeRuleCommand({ Name: ruleName }));
+ return ruleResponse.ScheduleExpression;
+ }
+ catch (e) {
+ if (e instanceof Error && e.name === 'ResourceNotFoundException') {
+ return undefined;
+ }
+ throw e;
+ }
```

### Before submitting, please confirm:

- [x] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [x] I have removed any sensitive information from my code snippets and submission.

Contributor guide

Open the contributing guide

Research direction

Start in lib/commands/gen2-migration/generate/_infra/aws-fetcher.js at fetchFunctionSchedule and compare the DescribeRule path with the sibling GetPolicy handling. Run the documented orphan EventBridge rule reproduction with amplify gen2-migration generate; done means the deleted-rule permission no longer aborts generation while unrelated errors still surface.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cli, cloud
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
85/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.