aws / aws/aws-cdk

No way to specify role for s3 bucket autoDeleteObjects lambda custom resource

Open
#16,496 4 comments 5 reactions 0 assignees View on GitHub
@aws-cdk/aws-s3 effort/small feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

If using [autoDeleteObjects](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3.Bucket.html#autodeleteobjects) on a s3 Bucket construct, CDK creates a lambda function that will delete everything in the bucket when the stack is destroyed. However, a role is created for this lambda and there is no way to override that behaviour. This is a problem for environments where IAM changes are tightly controlled. In those environments it would be desirable to be able to supply the role arn.

Note that by contrast the s3 BucketDeployment construct _does_ allow you to pass a role (see https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3-deployment.BucketDeployment.html#role).

The only workaround I can think of is to manually empty the bucket before destroying the stack which is highly undesirable (and not always even possible if objects are being frequently created in the bucket).

----

Notes for anyone looking to fix this:

- bucket deployment passes the role from the prop into the `lambda.SingletonFunction`: https://github.com/aws/aws-cdk/blob/d4a1c28fcac142e226159d42473990e592ed86be/packages/%40aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts#L204
- autoDeleteObjects however uses `CustomResourceProvider` https://github.com/aws/aws-cdk/blob/d4a1c28fcac142e226159d42473990e592ed86be/packages/%40aws-cdk/aws-s3/lib/bucket.ts#L1833 which explicitly creates a role https://github.com/aws/aws-cdk/blob/d4a1c28fcac142e226159d42473990e592ed86be/packages/%40aws-cdk/core/lib/custom-resource-provider/custom-resource-provider.ts#L193

Contributor guide

Open the contributing guide

Research direction

Read packages/@aws-cdk/aws-s3/lib/bucket.ts at the autoDeleteObjects CustomResourceProvider call, then compare the role handling in packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts and packages/@aws-cdk/core/lib/custom-resource-provider/custom-resource-provider.ts. Done means the auto-delete provider accepts the requested role ARN and uses it without changing existing behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.