aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::Kinesis::ResourcePolicy] - [BUG] - Stream consumer resource policy fails to create

Open
#2,442 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::Kinesis::StreamConsumer

### Resource Name

_No response_

### Issue Description

If you define a resource policy for a stream consumer, it will fail to create. Based on the error message, it's likely the internal handler doesn't wait for the stream consumer to become active.

There is a workaround: if you add an explicit `DependsOn` relationship between the stream consumer and the resource policy, the resource policy will be created.

### Expected Behavior

The resource policy CFN resource should be created

### Observed Behavior

The resource fails to create with:

> Resource handler returned message: "Consumer test-consumer with creation timestamp xxxx under stream test-stream and account xxx is not in ACTIVE status. (Service: Kinesis, Status Code: 400, Request ID: xxx, Extended Request ID: xxx) (SDK Attempt Count: 1)" (RequestToken: xxx, HandlerErrorCode: AlreadyExists)

### Test Cases

Minimal reproducible template fragment:
```json
{
"Resources": {
"testconsumer": {
"Type": "AWS::Kinesis::StreamConsumer",
"Properties": {
"ConsumerName": "test-consumer",
"StreamARN": {
"Fn::GetAtt": ["testconsumer", "Arn"]
}
}
},
"testconsumerpolicy": {
"Type": "AWS::Kinesis::ResourcePolicy",
"Properties": {
"ResourceArn": {
"Fn::GetAtt": ["testconsumer", "ConsumerARN"]
},
"ResourcePolicy": {
"Statement": [
{
"Action": [
"kinesis:DescribeStreamConsumer",
"kinesis:SubscribeToShard"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Sub": "arn:aws:iam::${AWS::AccountId}:root"
}
},
"Resource": {
"Fn::GetAtt": ["testconsumer", "ConsumerARN"]
}
}
],
"Version": "2012-10-17"
}
}
}
}
}
```

### Other Details

This happens only for the stream consumer; creating a resource policy for the stream works as expected.

Contributor guide

Open the contributing guide

Research direction

Start by deploying the minimal CloudFormation template in the issue and reproduce the failure for AWS::Kinesis::StreamConsumer with AWS::Kinesis::ResourcePolicy. Compare it with the explicit DependsOn workaround. Done means the policy creates successfully without that dependency and the stream-consumer case remains compatible with stream policies.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.