aws / aws/aws-cdk

aws_cdk.aws_cloudfront.experimental: cyclic reference if role is passed

Open
#19,416 2 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-cloudfront bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### What is the problem?

If a role is passed to `EdgeFunction` created in a stack located outside of `us-east-1` it will result in a cyclic dependency error.

### Reproduction Steps

try to deploy the following stack to a location outside `us-east-1`:
```python
class LambdaEdgeStack(BaseStack):

def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
super().__init__(scope, construct_id, **kwargs)

# create edge function execution role
lambda_edge_execution_role_policy = Policy(
self, 'frontend-edge-lambda-policy',
policy_name='frontend-edge-lambda-policy',
statements=[
aws_iam.PolicyStatement(
resources=[
"arn:aws:logs:*:*:*"
],
actions=["logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"]
)
])

lambda_edge_s3_policy = Policy(
self, 'frontend-edge-lambda-s3-policy',
policy_name='frontend-edge-lambda-s3-policy',
statements=[
aws_iam.PolicyStatement(
resources=[
f'arn:aws:s3:::{self.config.frontend_bucket_name}',
f'arn:aws:s3:::{self.config.frontend_bucket_name}/*',
],
actions=['s3:Get*',
's3:List*',
's3-object-lambda:Get*',
's3-object-lambda:List*']
)
])

lambda_service_role = Role(
self, 'edge-lambda-role',
role_name='edge-lambda-role',
assumed_by=aws_iam.CompositePrincipal(
aws_iam.ServicePrincipal("lambda.amazonaws.com")
))
lambda_service_role.attach_inline_policy(lambda_edge_execution_role_policy)
lambda_service_role.attach_inline_policy(lambda_edge_s3_policy)

# create edge function
lambda_code_path = Path(__file__).parent / '../resources/kms_lambda_edge'
self.edge_lambda = EdgeFunction(self, "sigv4-req-to-s3",
runtime=Runtime.NODEJS_12_X,
handler="index.handler",
code=Code.from_asset(str(lambda_code_path)),
role=lambda_service_role)
```

### What did you expect to happen?

That the role is detached from the original stack an re-attached to the on-demand created `us-east-1` stack.

### What actually happened?

```
jsii.errors.JavaScriptError:
Error: 'EdgeLambda' depends on 'edge-lambda-stack-c8d3ca2e2477a28d9d4f54c5c27d9241b592f0a31e' (dependency added using stack.addDependency()). Adding this dependency ("edge-lambda-stack-c8d3ca2e2477a28d9d4f54c5c27d9241b592f0a31e/sigv4-req-to-s3/Resource" depends on "EdgeLambda/edge-
lambda-role/Resource") would create a cyclic reference.
```

### CDK CLI Version

2.16.0

### Framework Version

_No response_

### Node.js Version

v16.13.0

### OS

Windows

### Language

Python

### Language Version

Python 3.9.6

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start from the aws_cloudfront.experimental EdgeFunction role handling and the on-demand us-east-1 stack creation, then reproduce the example by deploying outside us-east-1. Done means a passed role is detached from the original stack, re-attached to the regional stack, and no cyclic dependency error is produced.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.