aws_cdk.aws_cloudfront.experimental: cyclic reference if role is passed
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### What is the problem?
If a role is passed to `EdgeFunction` created in a stack located outside of `us-east-1` it will result in a cyclic dependency error.
### Reproduction Steps
try to deploy the following stack to a location outside `us-east-1`:
```python
class LambdaEdgeStack(BaseStack):
def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
super().__init__(scope, construct_id, **kwargs)
# create edge function execution role
lambda_edge_execution_role_policy = Policy(
self, 'frontend-edge-lambda-policy',
policy_name='frontend-edge-lambda-policy',
statements=[
aws_iam.PolicyStatement(
resources=[
"arn:aws:logs:*:*:*"
],
actions=["logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"]
)
])
lambda_edge_s3_policy = Policy(
self, 'frontend-edge-lambda-s3-policy',
policy_name='frontend-edge-lambda-s3-policy',
statements=[
aws_iam.PolicyStatement(
resources=[
f'arn:aws:s3:::{self.config.frontend_bucket_name}',
f'arn:aws:s3:::{self.config.frontend_bucket_name}/*',
],
actions=['s3:Get*',
's3:List*',
's3-object-lambda:Get*',
's3-object-lambda:List*']
)
])
lambda_service_role = Role(
self, 'edge-lambda-role',
role_name='edge-lambda-role',
assumed_by=aws_iam.CompositePrincipal(
aws_iam.ServicePrincipal("lambda.amazonaws.com")
))
lambda_service_role.attach_inline_policy(lambda_edge_execution_role_policy)
lambda_service_role.attach_inline_policy(lambda_edge_s3_policy)
# create edge function
lambda_code_path = Path(__file__).parent / '../resources/kms_lambda_edge'
self.edge_lambda = EdgeFunction(self, "sigv4-req-to-s3",
runtime=Runtime.NODEJS_12_X,
handler="index.handler",
code=Code.from_asset(str(lambda_code_path)),
role=lambda_service_role)
```
### What did you expect to happen?
That the role is detached from the original stack an re-attached to the on-demand created `us-east-1` stack.
### What actually happened?
```
jsii.errors.JavaScriptError:
Error: 'EdgeLambda' depends on 'edge-lambda-stack-c8d3ca2e2477a28d9d4f54c5c27d9241b592f0a31e' (dependency added using stack.addDependency()). Adding this dependency ("edge-lambda-stack-c8d3ca2e2477a28d9d4f54c5c27d9241b592f0a31e/sigv4-req-to-s3/Resource" depends on "EdgeLambda/edge-
lambda-role/Resource") would create a cyclic reference.
```
### CDK CLI Version
2.16.0
### Framework Version
_No response_
### Node.js Version
v16.13.0
### OS
Windows
### Language
Python
### Language Version
Python 3.9.6
### Other information
_No response_
Contributor guide
Research direction
Start from the aws_cloudfront.experimental EdgeFunction role handling and the on-demand us-east-1 stack creation, then reproduce the example by deploying outside us-east-1. Done means a passed role is detached from the original stack, re-attached to the regional stack, and no cyclic dependency error is produced.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100