aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Unexpected Cloudformation-generated physical resource ID on stack rollback of in-flight custom resources

Open
#1,814 3 comments 6 reactions 0 assignees View on GitHub
documentation
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::CloudFormation::CustomResource

### Resource name

_No response_

### Reference Link

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/crpg-ref-requesttypes-delete.html

### Details

I am observing behavior in Custom Resources that I have been unable to find anywhere else on either the web or AWS documentation. It involves the presence of a value in `PhysicalResourceId` that I suspect CloudFormation is generating on-the-fly under specific rollback scenarios.

This behavior only surfaces during the rollback of a stack creation operation in which a custom resource began to be provisioned prior to the rollback-inducing event.

Here's the sequence of events from CloudFormation's perspective:
1. CFN begins creating resources, one of which is an `AWS::CloudFormation::CustomResource`
2. While the custom resource is still `CREATE_IN_PROGRESS`, another resource fails to be created
3. CFN begins to roll back the stack creation
4. CFN emits a `CREATE_FAILED` event (with reason `Resource creation cancelled`) for the custom resource
5. CFN begins deleting the custom resource (event: `DELETE_IN_PROGRESS`)

On the custom resource side, I've observed the following:
- I get a `Delete` request for the custom resource (makes sense)
- The `Delete` request is sent before the `Create` request response was ever received by CFN (makes less sense)
- The `Delete` request contains a physical resource ID that I never set on the resource. It's always a concatenation of a) the stack name, b) the logical ID, and c) some random hash. For example: `MYSTACK-LOGICALID-B36FTLCJN97H`

I've been unable to find any documentation explaining the pseudo-physical resource ID that CloudFormation includes on `Delete` requests sent due to a stack rollback (if that is indeed the intended scenario where this occurs). All documentation implies that the `PhysicalResourceId` field is always a value that was provided by the custom resource provider after a successful `Create` request.

Contributor guide

Open the contributing guide

Research direction

Start with the linked AWS CloudFormation custom-resource delete-request documentation and reproduce the rollback sequence described in the issue. Confirm whether the generated PhysicalResourceId and Delete-before-Create response are expected, then document the observed behavior or the required clarification.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.