aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::S3::BucketPolicy] - [BUG] - CloudFormation hangs for 20 minutes before rolling back when invalid principal is provided
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::S3::BucketPolicy
### Resource Name
_No response_
### Issue Description
I wrote the following code in AWS CDK:
```ts
const policyBucket = new Bucket(this, "PolicyBucket", {
bucketName: `policy-bucket-${uniqueId}`,
enforceSSL: true,
removalPolicy: RemovalPolicy.DESTROY,
autoDeleteObjects: true,
});
const bucketPolicy = new BucketPolicy(this, "BucketPolicy", {
bucket: policyBucket,
});
bucketPolicy.document.addStatements(
new PolicyStatement({
effect: Effect.ALLOW,
principals: [
new ArnPrincipal("arn:aws:iam::123456789012:user/exampleuser"),
],
actions: ["s3:GetObject", "s3:ListBucket"],
resources: [policyBucket.bucketArn, `${policyBucket.bucketArn}/*`],
}),
);
```
It's the same as creating a new S3 bucket with the following policy statement:
```json
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:user/exampleuser"
},
"Action": [
"s3:GetBucket*",
"s3:ListBucket*"
],
"Resource": [
"arn:aws:s3:::policy-bucket-c8930c4c",
"arn:aws:s3:::policy-bucket-c8930c4c/*"
]
}
```
### Expected Behavior
I assumed CloudFormation would promptly return an error, stating that the principal is invalid when trying to add the S3 policy statement.
In essence, I expected CloudFormation to behave just like the S3 AWS Console, returning an error like this:

### Observed Behavior
Upon deployment, CloudFormation hanged for 20 minutes on the creation of the S3 bucket policy:

Eventually, the stack got rolled back:

### Test Cases
CloudFormation should make an API call to test if the principal exists and immediately return.
### Other Details
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.