No way to specify role for s3 bucket autoDeleteObjects lambda custom resource
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
If using [autoDeleteObjects](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3.Bucket.html#autodeleteobjects) on a s3 Bucket construct, CDK creates a lambda function that will delete everything in the bucket when the stack is destroyed. However, a role is created for this lambda and there is no way to override that behaviour. This is a problem for environments where IAM changes are tightly controlled. In those environments it would be desirable to be able to supply the role arn.
Note that by contrast the s3 BucketDeployment construct _does_ allow you to pass a role (see https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3-deployment.BucketDeployment.html#role).
The only workaround I can think of is to manually empty the bucket before destroying the stack which is highly undesirable (and not always even possible if objects are being frequently created in the bucket).
----
Notes for anyone looking to fix this:
- bucket deployment passes the role from the prop into the `lambda.SingletonFunction`: https://github.com/aws/aws-cdk/blob/d4a1c28fcac142e226159d42473990e592ed86be/packages/%40aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts#L204
- autoDeleteObjects however uses `CustomResourceProvider` https://github.com/aws/aws-cdk/blob/d4a1c28fcac142e226159d42473990e592ed86be/packages/%40aws-cdk/aws-s3/lib/bucket.ts#L1833 which explicitly creates a role https://github.com/aws/aws-cdk/blob/d4a1c28fcac142e226159d42473990e592ed86be/packages/%40aws-cdk/core/lib/custom-resource-provider/custom-resource-provider.ts#L193
Contributor guide
Research direction
Read packages/@aws-cdk/aws-s3/lib/bucket.ts at the autoDeleteObjects CustomResourceProvider call, then compare the role handling in packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts and packages/@aws-cdk/core/lib/custom-resource-provider/custom-resource-provider.ts. Done means the auto-delete provider accepts the requested role ARN and uses it without changing existing behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100