aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::LakeFormation::PrincipalPermissions] - [BUG] - Inconsistent tracking of status of permissions, when multiple resources are created at the same time

Open
#2,500 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::LakeFormation::PrincipalPermissions

### Resource Name

_No response_

### Issue Description

When creating multiple permissions at the same time, it seems that CloudFormation is not able to properly track individual resources, which results in failures during creation. It seems that the resource tracking is deleted/taken out of memory in some way, as an exception occurs, stating that the resource already exists.

### Expected Behavior

Multiple principle permissions are created, at the same time

### Observed Behavior

Some permissions are created in AWS and tracked in CloudFormation, whilst others are created in AWS, but are not detected from CloudFormation post creation. This results in the following error

> Stack | 11:31:03 | CREATE_FAILED | AWS::LakeFormation::PrincipalPermissions | Stack-resource (StackResource) Resource handler returned message: "Resource of type 'AWS::LakeFormation::PrincipalPermissions' with identifier 'StackResource' already exists." (RequestToken: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, HandlerErrorCode: **AlreadyExists**)

Notice how the error code states the resource already exists?

### Test Cases

Drift detection only detects permissions upon successful deployment

Testing using multiple permissions being created at the same time - FAILS

Using the same stack, adding a dependency for each lakeformation permission, depending on the previous permission in the list - PASSES
```ts
declare const lakeformationPermissions: lakeformationCfn.CfnPrincipalPermissions;

for (let i = 1; i < lakeformationPermissions.length; i++) {
lakeformationPermissions[i].addDependency(
lakeformationPermissions[i - 1]
);
}
```
The above test is written in CDK, but it uses the L1 Construct, which is a 1:1 match with CloudFormation

### Other Details

The resource is created in AWS, but CloudFormation is not able to detect that the permission had been created via the CloudFormation stack. So CloudFormation would create the permission in AWS (alongside a bunch of others), have some form of memory leak, and state that the resource is already created

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.