aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Intermittent "conflicting conditional operation" error when applying bucket policy
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::S3::BucketPolicy
### Resource Name
_No response_
### Issue Description
When deploying a cloudformation stack containing a custom bucket policy for a bucket that is used for VPC Flow Logs, or Route 53 Resolver Query Logs, the deployment will occasionally fail on the bucket policy resource with an error such as
```
Resource handler returned message: "A conflicting conditional operation is currently in progress against this resource. Please try again. (Service: S3, Status Code: 409, Request ID: , Extended Request ID: )" (RequestToken: , HandlerErrorCode: GeneralServiceException)
```
We have deployed this configuration over 3500 times across 2500+ accounts and have encountered this error in roughly 4% of attempts. Our fix is to delete the stack and retry with no changes, which usually works.
I suspect this is due to both VPC Flow and R53 RQLC attempting to add their own automatic configurations to the bucket while cloudformation is attempting to attach the the provided bucket policy.
Here is a sample cfn we have used to reproduce this issue with a VPC Flow configuration.
[cfn.json](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/files/14487443/cfn.json)
The event in cloudformation with the failure error message is for the "VpcFlowS3BucketPolicy" resource.
### Expected Behavior
The provided custom bucket policy should apply without the S3 "conflicting conditional operation" error.
### Observed Behavior
The error "A conflicting conditional operation is currently in progress against this resource. Please try again." is returned in a small percentage of cases.
### Test Cases
The attached cfn.json file was deployed approximately 20 times and failed twice with this error.
### Other Details
This error message is often cited as being related to creating a bucket with the same name as a recently deleted bucket. This does not apply in our case, since the bucket name is generated to be unique each time and we have observed that the bucket creates successfully - It's the policy that causes the error.
Contributor guide
Research direction
Start by deploying the attached cfn.json reproduction and inspect the CloudFormation events for VpcFlowS3BucketPolicy. Compare successful and failed runs while tracking the bucket policy and VPC Flow Logs configuration operations. Done would require a confirmed explanation and an accepted CloudFormation or AWS-side mitigation for the intermittent conflict.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 20/100