aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

DependsOn should work with AWS::NoValue

Open
#1,015 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

Other

### Resource name

Not resource specific

### Description

### Background
**DependsOn** is particularly useful in cases where a direct dependency cannot be determined and where the resource to be depended on takes a while to be created. It is the case for example, when an ```AWS::AppStream::Fleet``` is created with a dependency on ```AWS::AppStream::DirectoryConfig```. The latter can take a while to create and is entirely optional.

Please note that there is no direct dependency between the two: you cannot use !Ref or !GetAtt in ```AWS::AppStream::Fleet``` to refer to ```AWS::AppStream::DirectoryConfig```. Given that there is no dependency between these resources, and that ```AWS::AppStream::DirectoryConfig``` may not exist, the ```DependsOn:``` should be disabled from ```AWS::AppStream::Fleet``` by using ```AWS::NoValue```.

### Test example
The example below is simplified for testing purposes.
The two security groups can be created:
- in parallel (when the condition is true and ```DependsOn: AWS::NoValue``` or
- SG1 before SG2.

The error that I am getting, when I try to execute the code is: ```Template format error: DependsOn must be a string or list of strings```.
If ```AWS::NoValue``` is a string or not is debatable, which is why I am raising this as an enhancement and not a bug

```
Parameters:
VPC:
Type: String
Default: vpc-xxxx
Flag:
Type: String
Conditions:
Available: !Equals
- !Ref Flag
- OK
Resources:
SG1:
Type: AWS::EC2::SecurityGroup
Properties:
GroupName: SG1
GroupDescription: SG1
Tags:
- Key: Name
Value: SG1
VpcId: !Ref VPC
SG2:
DependsOn: !If
- Available
- SG1
- !Ref AWS::NoValue
Type: AWS::EC2::SecurityGroup
Properties:
GroupName: SG2
GroupDescription: SG2
Tags:
- Key: Name
Value: SG2
VpcId: !Ref VPC
```

### Other Details

The workaround to this issue would be to replace ```AWS::NoValue``` with a resource that is created in any circumstances as early as possible. Further tests revealed that this was not an workaround. It would seem that ```DependsOn``` cannot accept any functions.

Contributor guide

Open the contributing guide

Research direction

Use the SG1/SG2 template in the issue as the starting reproduction, focusing on DependsOn with !If and AWS::NoValue. Done means SG2 omits the dependency when Available is false while still depending on SG1 when it is true; the issue names no repository file or test to run.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.