aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::Lambda::Function] - [BUG] - VpcConfig.Ipv6AllowedForDualStack does not reset when removed from template
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::Lambda::Function
### Resource Name
_No response_
### Issue Description
When Lambda is deployed into VPC with IPV6 support enabled and then updated to remove it from VPC, an error is produced.
This can be worked around by first, manually unsetting the `Ipv6AllowedForDualStack` flag in VPC configuration, either in UI console or CLI and then running the deployment with updated template.
### Expected Behavior
Lambda should deploy without error and manual intervention.
### Observed Behavior
Error message:
> Resource handler returned message: "Ipv6AllowedForDualStack cannot be true without subnet or security groups. Please remove Ipv6AllowedForDualStack value from your request and try again.
### Test Cases
Deploy VPC with IPV6 subnets and a Lambda function using that vpc, `VpcConfig` with `Ipv6AllowedForDualStack` set to `true` (you will have to set subnet and security group as well).
Change the template to disassociate Lambda from the VPC and remove the `VpcConfig` section.
Lambda should redeploy without errors.
### Other Details
_No response_
Contributor guide
Research direction
Start with the deployment sequence in the Test Cases: create the VPC-backed Lambda with VpcConfig.Ipv6AllowedForDualStack set to true, then remove VpcConfig and redeploy. Done means the update succeeds without manual console or CLI cleanup and without the reported error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100