aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Unexpected Cloudformation-generated physical resource ID on stack rollback of in-flight custom resources
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::CloudFormation::CustomResource
### Resource name
_No response_
### Reference Link
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/crpg-ref-requesttypes-delete.html
### Details
I am observing behavior in Custom Resources that I have been unable to find anywhere else on either the web or AWS documentation. It involves the presence of a value in `PhysicalResourceId` that I suspect CloudFormation is generating on-the-fly under specific rollback scenarios.
This behavior only surfaces during the rollback of a stack creation operation in which a custom resource began to be provisioned prior to the rollback-inducing event.
Here's the sequence of events from CloudFormation's perspective:
1. CFN begins creating resources, one of which is an `AWS::CloudFormation::CustomResource`
2. While the custom resource is still `CREATE_IN_PROGRESS`, another resource fails to be created
3. CFN begins to roll back the stack creation
4. CFN emits a `CREATE_FAILED` event (with reason `Resource creation cancelled`) for the custom resource
5. CFN begins deleting the custom resource (event: `DELETE_IN_PROGRESS`)
On the custom resource side, I've observed the following:
- I get a `Delete` request for the custom resource (makes sense)
- The `Delete` request is sent before the `Create` request response was ever received by CFN (makes less sense)
- The `Delete` request contains a physical resource ID that I never set on the resource. It's always a concatenation of a) the stack name, b) the logical ID, and c) some random hash. For example: `MYSTACK-LOGICALID-B36FTLCJN97H`
I've been unable to find any documentation explaining the pseudo-physical resource ID that CloudFormation includes on `Delete` requests sent due to a stack rollback (if that is indeed the intended scenario where this occurs). All documentation implies that the `PhysicalResourceId` field is always a value that was provided by the custom resource provider after a successful `Create` request.
Contributor guide
Research direction
Start with the linked AWS CloudFormation custom-resource delete-request documentation and reproduce the rollback sequence described in the issue. Confirm whether the generated PhysicalResourceId and Delete-before-Create response are expected, then document the observed behavior or the required clarification.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100