aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::S3::BucketPolicy] - [BUG] - CloudFormation hangs for 20 minutes before rolling back when invalid principal is provided

Open
#2,124 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::S3::BucketPolicy

### Resource Name

_No response_

### Issue Description

I wrote the following code in AWS CDK:

```ts
const policyBucket = new Bucket(this, "PolicyBucket", {
bucketName: `policy-bucket-${uniqueId}`,
enforceSSL: true,
removalPolicy: RemovalPolicy.DESTROY,
autoDeleteObjects: true,
});

const bucketPolicy = new BucketPolicy(this, "BucketPolicy", {
bucket: policyBucket,
});

bucketPolicy.document.addStatements(
new PolicyStatement({
effect: Effect.ALLOW,
principals: [
new ArnPrincipal("arn:aws:iam::123456789012:user/exampleuser"),
],
actions: ["s3:GetObject", "s3:ListBucket"],
resources: [policyBucket.bucketArn, `${policyBucket.bucketArn}/*`],
}),
);
```

It's the same as creating a new S3 bucket with the following policy statement:

```json
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:user/exampleuser"
},
"Action": [
"s3:GetBucket*",
"s3:ListBucket*"
],
"Resource": [
"arn:aws:s3:::policy-bucket-c8930c4c",
"arn:aws:s3:::policy-bucket-c8930c4c/*"
]
}
```

### Expected Behavior

I assumed CloudFormation would promptly return an error, stating that the principal is invalid when trying to add the S3 policy statement.

In essence, I expected CloudFormation to behave just like the S3 AWS Console, returning an error like this:

![image](https://github.com/user-attachments/assets/3180a744-a686-4a32-942c-eb37d2534fc9)

### Observed Behavior

Upon deployment, CloudFormation hanged for 20 minutes on the creation of the S3 bucket policy:

![image](https://github.com/user-attachments/assets/fde0f45a-ad6d-4b38-a853-213f985a2f1a)

Eventually, the stack got rolled back:

![image](https://github.com/user-attachments/assets/d78ac143-7dc5-439e-b8a1-f8e80a5ef7a3)

### Test Cases

CloudFormation should make an API call to test if the principal exists and immediately return.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.