aws / aws/aws-cdk

(aws eks): EKS stack deletes resources in the wrong order, causing DELETE_FAILED

Open
#18,650 8 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-eks @aws-cdk/aws-eks-v2-alpha bug p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### What is the problem?

Running `cdk destroy` on an EKS cluster stack always results in DELETE_FAILED.

It appears to be attempting to delete the security group before deleting the cluster, causing a failure to delete as the resource is in use.

This error returns from the control plane security group deletion in cloudformation:
```
resource has a dependent object (Service: AmazonEC2; Status Code: 400; Error Code: DependencyViolation; Request ID: ; Proxy: null)
```

The cloudformation stack itself then fails to delete with an error like this:
```
The following resource(s) failed to delete: [].
```

### Reproduction Steps

Define a new cluster:
```
new aws_eks.FargateCluster(this, id, {
version: this.props.version,
vpc: this.props.vpc,
endpointAccess: EndpointAccess.PRIVATE,
placeClusterHandlerInVpc: true,
vpcSubnets: [{
subnetType: SubnetType.PRIVATE_WITH_NAT
}]
});
```
then run `cdk deploy`.
After it succeeds, run `cdk destroy` and the error will happen.

### What did you expect to happen?

Handler should delete the EKS cluster first, and then delete the security group.

### What actually happened?

Handler deletes the security group first, which fails because the resource is in use. It then causes rollback failed and/or delete failed.

### CDK CLI Version

2.8.0 (build 8a5eb49)

### Framework Version

_No response_

### Node.js Version

v17.3.1

### OS

MacOS Catalina 10.15.7

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the aws_eks.FargateCluster construct and reproduce the issue using the configuration in the report, then run cdk deploy followed by cdk destroy. Trace the generated resources and deletion dependencies, focusing on the cluster, Fargate profile, and control plane security group. Done means the EKS cluster is deleted before its dependent security group and the stack completes deletion without DELETE_FAILED.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.